HIPAA Background Check Requirements for Healthcare Staff
Comprehensive guide to screening, verification, and sanctions checks for workforce members
Quick Answer: HIPAA requires background checks including criminal history, license verification, employment history, and sanctions list screening before any employee accesses PHI.
HIPAA Background Check Requirements Overview
The HIPAA Safeguards Rule (45 CFR 164.308(a)(3)) requires covered entities and business associates to implement procedures to ensure that workforce members are appropriately screened and authorized. While HIPAA doesn't mandate specific types of background checks, it requires documented screening before access to PHI.
Key Principle: Organizations must develop and enforce policies that specify:
- Who must undergo background checks (all employees, contractors, volunteers)
- What types of screening are required by role
- How disqualifying information is handled
- Documentation and retention procedures
Required Background Check Components
1. Criminal Background Check
- Seven-year criminal history (or longer per state law)
- County, state, and federal records
- Sex offender registry check
- Violent offender registry screening
- Fraud/theft conviction history
- Drug-related offense screening
2. Professional License Verification
- Current state licensure for regulated professionals (MD, RN, PT, etc.)
- License validity and expiration dates
- Disciplinary actions or sanctions on license
- Board actions or license suspensions
- Verification through official state licensing boards
3. Employment & Reference History
- Previous employer contact and verification
- Dates of employment confirmation
- Reason for leaving previous positions
- Reference checks (minimum 2-3)
- Gaps in employment explanation
4. Government Sanctions List Screening
- OIG Exclusions List check (Office of Inspector General)
- General Services Administration (GSA) list check
- OFAC sanctions screening
- State licensing board sanctions
- Healthcare fraud and abuse database
5. Education & Credential Verification
- Verification of claimed degrees and certifications
- Licensure type and specialty confirmation
- Board certification status (where applicable)
- Continuing education credits (if required)
Background Check Procedures by Role
| Role Type | Criminal Check | License Verify | Sanctions Screen | References |
|---|---|---|---|---|
| Licensed Clinicians (MD, RN, PT) | Yes (7+ years) | Yes - Required | Yes | Yes (3+) |
| Administrative Staff | Yes (7 years) | No | Yes | Yes (2+) |
| IT/Technical Staff | Yes (7 years) | Certifications | Yes | Yes (2+) |
| Contractors/Consultants | Yes (7 years) | As needed | Yes | Yes (2+) |
| Volunteers | Yes (7 years) | No | Yes | Yes (1-2) |
Background Check Documentation Template
BACKGROUND CHECK VERIFICATION RECORD
Employee Name: _____________________________
Date of Birth: _____________________________
Position: _____________________________
Start Date: _____________________________
Screening Components:
| Criminal Background Check | ☐ Passed ☐ Failed ☐ Pending | Date: _______ |
| Professional License Verification | ☐ Verified ☐ N/A ☐ Pending | Exp: _______ |
| Employment History Verification | ☐ Verified ☐ Pending | Date: _______ |
| Sanctions List Screening | ☐ Clear ☐ Findings ☐ Pending | Date: _______ |
Approval/Clearance Decision: ☐ Clear to Proceed ☐ Conditional ☐ Denied
Reviewed By: _________________________ Date: _________
HR Director Signature: _________________________ Date: _________
Handling Disqualifying Information
When Background Checks Reveal Concerns
- Criminal Convictions: Evaluate job-relevance and time elapsed; violent crimes and healthcare fraud are typically disqualifying
- Excluded Provider Status: Any individual on OIG Exclusions List cannot be employed in any capacity
- License Suspensions/Revocations: Individuals with suspended/revoked licenses cannot perform licensed duties
- Reference Concerns: Follow up on negative or poor employment history explanations
- Falsified Information: Dishonest application information is grounds for immediate termination
Due Process Considerations
- Provide candidate opportunity to explain findings
- Document all review and decision-making processes
- Consider legal guidance if denying hire based on background
- Retain all screening records for compliance audit purposes
- Maintain confidentiality of background check results
OIG Exclusions List Compliance
Critical: Employing an individual on the OIG Exclusions List is federal fraud and can result in significant penalties for the organization.
- Check OIG Exclusions List (LEIE) monthly or quarterly
- Screen all new hires before employment start
- Monitor current employees at least annually
- Document all LEIE verification dates and results
- Immediately terminate employment if individual added to list
- Report the situation to your Office of Inspector General
OIG Resources: The List of Excluded Individuals/Entities (LEIE) can be accessed at exclusions.oig.hhs.gov
Ongoing Screening & Compliance
Continuous Monitoring
- Re-screen current employees quarterly or annually
- Update professional license verification annually
- Monitor for additions to sanctions lists
- Track and investigate any new disqualifying findings
- Document all ongoing screening activities
Annual Verification Checklist
- Professional license status (if applicable)
- OIG Exclusions List screening
- State licensing board sanctions
- Compliance training completion
- Policy acknowledgment and signature
Frequently Asked Questions
Q: How far back should criminal background checks go?
A: HIPAA requires at least 7 years of criminal history. However, many states require longer periods (10 years or more) and federal crimes have no statute of limitations for background check purposes. Check your state's healthcare licensing requirements for specific timeframes.
Q: What if a candidate has a minor criminal conviction from 15 years ago?
A: You must evaluate job-relevance, nature and gravity of the offense, and time elapsed. Non-violent, minor offenses with significant time elapsed may not be disqualifying. Healthcare fraud, violent crimes, and drug trafficking are typically disqualifying. Document your analysis and retain decision records.
Q: Is it legal to deny employment based on background check findings?
A: Yes, but with limitations. Federal law (Fair Credit Reporting Act) and many state laws require individualized assessment, opportunity for explanation, and consideration of business necessity. Blanket policies denying employment for any criminal history may violate employment discrimination laws.
Q: What should we do if we discover an employee is on the OIG Exclusions List?
A: Immediately terminate employment and report to your compliance officer. The organization risks substantial federal penalties for continued employment. Document the discovery date, notification to employee, and termination. Notify your Office of Inspector General if billing occurred while excluded individual was employed.
Ensure Compliant Background Screening
Medcurity provides background check documentation templates and compliance procedures to ensure proper workforce screening.
Get Screening Templates