A healthcare staffing compliance checklist has three stages, not one: pre-offer, post-offer through pre-placement, and ongoing monitoring for the length of the assignment. Most gaps in a staffing agency’s program come from treating the middle stage as the whole checklist and skipping the third stage entirely. This guide organizes each component by where it belongs in that sequence.
Key takeaways
- A compliance program built only around the point-of-hire background check misses the ongoing stage, and the ongoing stage is where most preventable gaps, a lapsed license, a new exclusion, actually surface.
- The FCRA disclosure, authorization, and adverse action sequence governs specific components of the checklist, criminal history, license status compiled by a vendor, credit history where used, but not every component sits inside it.
- A healthcare staffing agency that is the employer of record has its own Form I-9 and E-Verify obligation, separate from whatever the client facility does, and cannot skip E-Verify because a client requests it.
- Exclusion screening against the OIG’s List of Excluded Individuals and Entities is expected before placement and monthly thereafter for the length of the engagement, not as a one-time gate.
- Records tied to a hiring decision, including background check records, generally need to be kept for at least one year under EEOC recordkeeping rules; Form I-9 specifically has its own longer retention rule of three years after hire or one year after termination, whichever is later.
- A completed checklist is only as defensible as its documentation: date, method, and result recorded for every check.
What the checklist needs to cover, and why stage matters
A healthcare staffing compliance program is not one background check followed by a start date. It is a sequence of distinct legal and operational obligations that attach at different points, some before an offer is extended, some between offer and first shift, some that only make sense as a recurring practice for as long as the clinician is actively placed.
| Stage | What it covers | Roughly when |
| Pre-offer | Scoping the role’s requirements and preparing disclosures | Before an offer is extended |
| Post-offer, pre-placement | The bulk of individual verification checks | Between offer acceptance and first shift |
| Ongoing | Recurring rechecks and monitoring | For the full length of the placement |
Skipping a stage doesn’t just create a documentation gap; it usually means an entire category of legal obligation, FCRA’s adverse action sequence, or I-9’s three-day Section 2 deadline, never gets triggered at all. This is what GCheck calls Compliance for Good®: an operating standard built on three pillars, one of which is Protective Compliance, verification that safeguards vulnerable populations and reduces organizational risk, with human judgment over fully automated decisions and secure data handling. A checklist built stage by stage, rather than treated as a single point-of-hire gate, is Protective Compliance applied specifically to a staffing agency’s own intake program.
Stage 1: Pre-offer
Before an offer goes out, the checklist’s job is narrow: confirm what the role actually requires, not run every possible check regardless of relevance. A role’s specific license, certification, and exclusion-screening requirements should be identified here, since running the wrong checks, or missing a state-specific requirement, gets expensive to unwind later. A per diem ICU role, a home health aide role, and an administrative role with patient-record access don’t carry identical screening requirements, and deciding that at the pre-offer stage keeps Stage 2 from becoming a generic bundle ordered by default.
This stage also sets up the disclosures the candidate needs to see before any consumer report is ordered. The FCRA requires a standalone written disclosure that a consumer report may be obtained for employment purposes, separate from the employment application itself, and this document needs to be ready before Stage 2 begins, not drafted after a candidate has already accepted an offer. A disclosure form assembled reactively, after onboarding is already underway, is a common source of the process failures that generate FCRA disputes.
Finally, pre-offer is the point to confirm which party in the placement relationship, the agency or the receiving facility, owns each obligation. Whether the staffing agency is the legal employer of record for a given placement changes who completes Form I-9, who runs E-Verify, and in some arrangements who is responsible for specific screening components. Settling this at the contract level before the first candidate moves through the pipeline avoids the scenario where neither party believes it owns a given check.
Stage 2: Post-offer, pre-placement
This is the stage most healthcare staffing checklists treat as the entire program, and it carries the largest volume of individual checks. The subsections below group them by function, each with its own specific requirement and timing.
Identity and authorization to work
A staffing agency acting as the employer of record must complete Form I-9 for every new hire, using either the date the candidate accepts an offer and enters the assignment pool, or the date of the candidate’s first assignment, as the consistent first day of employment across both the I-9 and any E-Verify case. Section 2 of the I-9 has to be completed within three business days of that date.
An agency enrolled in E-Verify must create a case for every new hire it is the employer of record for; it cannot selectively skip E-Verify because a specific client asks it to, and USCIS treats selective verification as a program violation in its own right.
Criminal history and identity verification
A nationwide criminal database search paired with county-level court record checks is standard, since many disqualifying convictions exist only at the county level and won’t surface in a nationwide database alone. Identity verification, confirming the candidate presenting for the assignment is who their documents say they are, typically runs alongside this step rather than as a separate checklist item, since both draw on the same identifying information.
License and credential verification
Primary source verification, confirming the license directly with the issuing board or an approved equivalent, is what the Joint Commission and CMS both expect, not a copy of the license the candidate provides. A checklist item here should specify the verification method used and record it, since “the license was on file” and “the license was verified” are not the same claim.
Where the clinician holds a multistate compact license, the placement state’s current compact status is worth confirming separately, since a compact license issued in one state does not automatically extend to a state that has not yet joined or implemented the compact.
Exclusion and sanctions screening
Every candidate needs to be checked against the HHS-OIG List of Excluded Individuals and Entities, the GSA’s System for Award Management, and the applicable state Medicaid exclusion list before placement, since an excluded worker cannot be paid, directly or indirectly, with federal healthcare program funds for services they provide.
Abuse registry checks
For roles involving direct patient care, state abuse and neglect registry checks apply alongside the criminal and exclusion screening above. These registries are state-specific rather than federal, so the applicable list depends on where the placement occurs, not where the agency is headquartered, and a program built around a single national abuse-registry search will miss the state-level requirement entirely.
Drug testing and occupational health
Pre-placement drug testing and occupational health clearance, immunization records and any facility-specific health documentation, typically complete this stage, since most receiving facilities require both before a clinician’s first shift regardless of the agency’s own default policy. Where a facility’s requirement is stricter than the agency’s standard panel, the facility’s requirement generally governs for that placement.
The FCRA sequence
Where any of the checks above are compiled by a third-party consumer reporting agency into a report furnished to the staffing agency, the full FCRA sequence attaches to that finding, and it has four steps. A direct primary-source check an agency performs itself, rather than receiving through a vendor-compiled report, sits outside this sequence, though it still needs to be verified and documented.
- Disclosure. A standalone written notice that a consumer report may be obtained for employment purposes.
- Authorization. Written consent from the candidate before the report is ordered.
- Pre-adverse action. A copy of the report and a reasonable opportunity to review and dispute the finding before a final decision.
- Adverse action. A final notice if the decision proceeds, along with a summary of the candidate’s rights.
Rather than sorting each individual finding into “covered” or “not covered,” the more defensible practice is to apply this same sequence to every vendor-compiled finding that could affect a placement decision, criminal history, license status, exclusion status, or a drug test result relayed through a bundled report alike. This sequence also exists alongside, not instead of, the EEOC’s individualized-assessment expectation for criminal-history-based decisions: a policy that excludes candidates with certain records without considering the offense’s nature, its relevance to the role, and the time elapsed can create disparate impact liability even where every FCRA step was followed correctly.
Stage 3: Ongoing, post-placement monitoring
A checklist that stops at Stage 2 is a checklist that only knows a candidate was clean on the day they were hired. Three ongoing practices close that gap.
Exclusion status needs rechecking monthly, not annually, because the LEIE itself updates monthly and a worker who was clear at placement can be excluded during the assignment without anything on the original background check changing. License status benefits from the same logic: a real-time monitoring service that alerts the agency the moment a license status changes catches an encumbrance or lapse between scheduled checks, rather than waiting for the next renewal cycle to surface it.
| Ongoing item | Recommended cadence | Why |
| OIG/SAM exclusion recheck | Monthly | The LEIE updates monthly; a point-in-time check goes stale the day it runs |
| State Medicaid exclusion recheck | Per applicable state cadence, at least as often as federal | Some states layer their own monthly requirement on top of federal guidance |
| License status monitoring | Real-time alerting, not a fixed interval | Encumbrances and lapses can occur at any point during an assignment |
| License renewal verification | At each renewal | Confirms the license remains active under its new expiration cycle |
| Periodic drug testing | Per facility or program requirement | Varies by receiving facility and role, not standardized federally |
This appetite for ongoing verification, rather than a single point-in-time check, is not unique to healthcare. 80% of workers say ongoing or periodic screening is important, not just a one-time check at hire (GCheck, 2026 Trust in Hiring Report). Building the ongoing stage into a program from the start, rather than treating it as an optional add-on once the pre-placement checklist is complete, is what turns a compliance program into something that actually reflects the worker’s current status rather than a snapshot from months earlier.
What this checklist doesn’t cover: state and local law layers on top
Everything above is a federal baseline, not a complete compliance program on its own. State and local law adds requirements in at least four areas:
- Ban-the-box ordinances, which restrict when in the hiring process a criminal history question or check can occur, with timing that varies by jurisdiction.
- Arrest-versus-conviction limitations, since several states limit or prohibit using arrest records, as distinct from convictions, in an employment decision.
- Lookback period caps, since many states limit how far back a criminal history report can reach, a limit the FCRA doesn’t impose federally.
- State-specific disclosure or authorization language, required in some states, California among them, beyond the federal standalone FCRA disclosure.
None of this changes the federal sequence described above; it layers on top of it. A staffing agency placing clinicians across multiple states needs its checklist to route each placement through the state and local rules that apply there, not just the federal baseline this article covers.
The checklist at a glance
The table below consolidates every item above into a single reference, organized by the stage where it belongs rather than by topic.
| Stage | Checklist item | Why it’s here |
| Pre-offer | Identify role-specific license, certification, and screening requirements | Prevents ordering the wrong checks or missing a state-specific one |
| Pre-offer | Prepare the standalone FCRA disclosure form | Must exist before any consumer report is ordered |
| Pre-offer | Confirm which party owns each obligation: agency as employer of record, or facility | Avoids a gap where neither party believes it owns a check |
| Post-offer, pre-placement | Complete Form I-9 and, where enrolled, create an E-Verify case | Federal identity and work-authorization requirement |
| Post-offer, pre-placement | Run nationwide criminal database search plus county-level court records | Many disqualifying records exist only at the county level |
| Post-offer, pre-placement | Primary source verify the license or credential | A copy on file is not the same as a verified license |
| Post-offer, pre-placement | Screen against OIG LEIE, SAM, and applicable state Medicaid exclusion lists | An excluded worker can’t be paid with federal program funds |
| Post-offer, pre-placement | Check applicable state abuse and neglect registries for direct patient care roles | State-specific, not covered by federal exclusion lists |
| Post-offer, pre-placement | Complete drug testing and occupational health clearance per facility requirement | Most facilities require both before first shift |
| Post-offer, pre-placement | Issue pre-adverse and, if the decision proceeds, final adverse action notices for any vendor-compiled finding that could affect the placement | The FCRA sequence a vendor-compiled report triggers |
| Ongoing | Recheck OIG/SAM exclusion status monthly | The LEIE itself updates monthly |
| Ongoing | Recheck applicable state Medicaid exclusion status per state cadence | Some states layer their own requirement on top of federal |
| Ongoing | Enroll license status in real-time monitoring | Encumbrances can occur any time during an assignment |
| Ongoing | Re-verify license at each renewal cycle | Confirms the license is active under its new expiration |
| Ongoing | Repeat drug testing per facility or program requirement | Varies by receiving facility, not standardized federally |
Documentation and retention: what makes the checklist auditable
What the record needs to show
A checklist that was actually followed and one that only exists on paper look identical unless the documentation distinguishes them. For every check performed, the record needs to show three things, the same standard the Joint Commission applies to primary source verification:
- The date the check happened
- The method used
- The result
A file of source documents alone, without a record of what verification step was taken and when, does not meet this bar even if every underlying document is genuine.
Retention, disposal, and file separation
Retention periods differ by record type, and treating them as a single blanket policy creates risk in both directions. Form I-9 has its own federal retention rule: three years after the date of hire, or one year after termination, whichever is later. Personnel and hiring records more broadly, including background check records, fall under EEOC recordkeeping rules requiring retention for at least one year after the record was made or after the personnel action was taken, whichever is later, and longer if a discrimination charge is filed. This distinction matters more for a staffing agency running high-turnover, short-tenure placements than for an employer with mostly long-tenure staff: a per diem clinician who works one assignment can trigger the one-year clock almost immediately, while that clinician’s Form I-9 may still need three years from the original hire date.
Two further practices round out the program, and a checklist that gets every check right but skips them has not finished the job:
- Secure disposal. Once a record’s retention period expires, it needs secure disposal, not simply deletion, using methods that leave the information unreadable and unreconstructable, paper or electronic.
- Separate medical files. Drug testing and occupational health information is medical information; it belongs in a separate, access-restricted file rather than the general personnel or credentialing file.
Frequently asked questions
What should a healthcare staffing compliance checklist include?
At minimum: role-specific requirements identified before an offer, identity and I-9/E-Verify processing, criminal history and license verification, OIG and state Medicaid exclusion screening, abuse registry checks where applicable, drug testing and occupational health clearance, the FCRA disclosure and adverse action sequence where a third-party report is used, and an ongoing monitoring stage for the length of the placement.
Does a staffing agency need to complete Form I-9 for every placement?
If the agency is the employer of record, yes, for every new hire, using a consistent first-day-of-employment date across the I-9 and any E-Verify case. If the agency is only matching candidates to a client that directly hires them, the client completes the I-9, not the agency.
How often should exclusion screening be repeated after placement?
Monthly, at minimum, because the HHS-OIG exclusion list itself updates on that cadence. A one-time check at hire reflects the worker’s status on that date only.
Does the FCRA apply to every item on this checklist?
Not automatically, since it specifically governs reports compiled and furnished by a consumer reporting agency, not every verification step. But the more defensible practice is to apply the same disclosure, authorization, and adverse action sequence to any vendor-compiled finding that could affect a placement decision, rather than sorting individual findings into covered and uncovered categories. A direct, internal check an agency performs itself, such as its own primary-source license lookup, sits outside a vendor-compiled report, though it still needs to be done correctly and documented.
How long should background check records be kept?
At least one year after the record was made or the personnel action was taken, whichever is later, under EEOC recordkeeping rules, and longer if a discrimination charge is filed. Form I-9 has its own separate rule: three years after hire or one year after termination, whichever is later.
What’s the difference between a one-time compliance check and a compliance program?
A one-time check answers whether a candidate was clear on a specific date. A program adds the ongoing stage, monthly exclusion rechecks and real-time license monitoring, keeping the answer current for the length of the placement.
Sources cited
- U.S. Citizenship and Immigration Services. Handbook for Employers M-274, Section 10.0, Retaining Form I-9. https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274/100-retaining-form-i-9
- U.S. Citizenship and Immigration Services / E-Verify. Completing Section 2, Employer Review and Attestation. https://www.uscis.gov/i-9-central/completing-form-i-9/completing-section-2-employer-review-and-attestation
- E-Verify.gov. Reminder: Staffing Agencies Must Not Selectively Verify Employees. https://www.e-verify.gov/about-e-verify/whats-new/reminder-staffing-agencies-must-not-selectively-verify-employees
- U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements. https://www.eeoc.gov/employers/recordkeeping-requirements
- U.S. Equal Employment Opportunity Commission and Federal Trade Commission (joint publication). Background Checks: What Employers Need to Know. https://www.eeoc.gov/laws/guidance/background-checks-what-employers-need-know (covers the individualized-assessment/disparate-impact standard for criminal history, the FCRA disclosure/adverse-action sequence, and the secure-disposal requirement for background report information)
- Federal Trade Commission. Background Checks: What Employers Need to Know. https://www.ftc.gov/business-guidance/resources/background-checks-what-employers-need-know
- U.S. Department of Health and Human Services, Office of Inspector General. Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (2013, May 8). https://oig.hhs.gov/documents/special-advisory-bulletins/881/sab-05092013.pdf
- GCheck. (2026). 2026 Trust in Hiring Report (n=1,500).
ABOUT THE CREATOR
Charm Paz, CHRP
Recruiter & Editor
Charm Paz is an HR professional at GCheck, specializing in background screening, fair hiring, and regulatory compliance. She holds from the Professional Background Screening Association (PBSA) and helps organizations navigate employment regulations with clarity and confidence.
With a background in Industrial and Organizational Psychology, she translates policy into practice to build ethical, compliant, human-centered hiring systems that strengthen decision-making over time.
