What Is Primary Source Verification (PSV)? Why the Data Source Matters
By DEA Lookup.com, Inc. · Updated October 3, 2026
What primary source verification means
When a pharmacy, distributor, hospital, or health plan accepts a provider, it has to confirm the provider's credentials are real and current. Primary source verification is the standard way to do that: you go to the source that issued the credential, not to the provider and not to an unverified copy.
The Joint Commission defines it as verification by the original organization or governmental entity that issued the credential, or through a designated equivalent source, such as the AMA Physician Masterfile or the American Board of Medical Specialties for certain credentials. Information that comes to you through the provider or their agent does not count, even if it looks official.
The primary source for each credential
| Credential | Primary source | What to confirm |
|---|---|---|
| DEA registration | Drug Enforcement Administration registrant data | Active status, expiration date, authorized drug schedules, registered address and state |
| State license | The licensing board in each state where the provider practices | Active and unrestricted status, expiration date, disciplinary actions |
| NPI | NPPES, the national NPI registry run by CMS | Identity, provider type, practice location (an NPI is an identifier, not a license) |
| Board certification | The specialty board, or a designated equivalent such as ABMS | Certification status and specialty |
| Education and training | The school or program, or a designated equivalent such as the AMA Physician Masterfile or ECFMG | Degree and training completion |
| Exclusions | OIG exclusion list (LEIE) and SAM.gov | Not barred from federal health care programs |
Why the data source matters
Many tools show license and registration data. They are not all equal. Four things separate a primary source check from a risky one:
- Freshness. Registrations expire, get surrendered, or are revoked. A copy of the data that is weeks or months old can show an expired registration as active. Primary source data, or data updated daily from the primary source, reflects the current status.
- Completeness. A DEA registration that is active may still not cover the drug schedule involved. A state license may carry a restriction or disciplinary action. Partial data gives you a "valid" answer to the wrong question.
- Proof for audits. Accreditors and auditors want to see where you verified, when, who did it, and what the result was. A primary source check should produce a record you can show them, such as a proof of registration or licensure document and a dated log entry.
- Authorized access. The DEA restricts who can access and redistribute its registrant data, and the rules changed when NTIS stopped distributing the database in November 2020. A verification service should be able to explain how its access to DEA data is compliant.
How recent does verification need to be?
Timing rules come from your accrediting body and your own policies. The most common benchmark is NCQA. Under NCQA standards effective July 1, 2025:
- Verifications must be completed within 120 days before the credentialing decision for accreditation (90 days for certification), down from 180 days.
- License expirations, sanctions, and Medicare and Medicaid exclusions must be monitored at least every 30 days.
- Providers are recredentialed every 36 months.
In practice, that means verification is no longer a one-time check at onboarding. Licenses and registrations need to be rechecked continuously, which is hard to do by hand.
How to evaluate a verification service
If you use software or a service instead of checking each source by hand, ask these questions:
- Where does the data come from? The answer should name the primary source for each credential type, not just "public records."
- How often is it updated? Daily updates or real-time lookups are the standard to look for.
- Can I get proof? You should be able to view or download a source document or snapshot for each verification.
- Is every search logged? An audit trail shows who checked what, and when.
- What does it cover? Check which license types and states are included, and whether disciplinary actions are returned.
- Is DEA data access compliant? Ask how the service obtains DEA registrant data under the current access rules.
How DEA Lookup.com helps
For over 15 years, DEA Lookup.com has built primary source verification tools for pharmacies, distributors, hospitals, and credentialing teams:
- DEA License Lookup: searches primary source DEA data with daily updates, an encrypted data container with a full audit trail, and downloadable DEA proof-of-registration PDFs.
- State Medical License API: real-time primary source verification from state board databases in all 50 states, with a saved snapshot of the proof of licensure and disciplinary actions in reporting states.
- DEA API Data Engine: builds daily-updated primary source DEA data into order processing and credentialing systems.
- DEA List Validator: validates up to 1,000 DEA numbers at once and can download the proof-of-registration PDFs automatically.
New to DEA checks? Start with How to Verify a DEA Number.
Frequently asked questions
What is primary source verification?
Primary source verification (PSV) means confirming a credential directly with the organization that issued it, or with a designated equivalent source, rather than relying on a copy supplied by the provider. For example, a state medical license is verified with the state licensing board, and a DEA registration is verified against DEA registrant data.
Is a copy of a license or DEA certificate from the provider acceptable?
No. A copy supplied by the provider, or information passed through the provider or their agent, is not primary source verification. The credential must be confirmed with the issuing source or a designated equivalent source.
How recent does primary source verification need to be?
It depends on your accrediting body. Under NCQA standards effective July 1, 2025, verifications must be completed within 120 days before the credentialing decision for accreditation, and license expirations, sanctions, and Medicare and Medicaid exclusions must be monitored at least every 30 days. Check the current standards that apply to your organization.
Can verification software count as primary source verification?
Yes, when the software retrieves the data from the issuing source or a designated equivalent source and records the source, the date, and the result. A tool that relies on a third-party copy of the data, with no clear source or update schedule, may not meet the standard. Confirm with your accrediting body if you are unsure.
What is the primary source for a DEA registration?
The Drug Enforcement Administration is the primary source for DEA registrations. Verification should be checked against current DEA registrant data, which shows the registration status, expiration date, authorized drug schedules, and registered address.
DEA Lookup.com is not affiliated with the Drug Enforcement Administration. This guide is general information, not legal or compliance advice.