The Compliance Risk Nobody Is Auditing: Your Locum Credentialing Chain

Every health system that uses locum tenens physicians has a credentialing process. Most of them believe it is adequate. Very few have tested that belief against the question that actually matters: if a locum physician on your staff were involved in a serious patient safety event tomorrow, could you reconstruct, on demand, the complete chain of credentialing, supervision, and oversight that authorized them to practice in your facility? Not in three weeks, not with a team of people pulling records from multiple systems. On demand, in a format that would hold up in a legal proceeding or a regulatory review.

For most health systems, the honest answer is no. And that answer carries consequences that are not theoretical.

The locum tenens model creates a credentialing structure that is fundamentally different from the one that governs employed physicians. When a health system hires a physician directly, the credentialing process is internal, documented in a single system, and subject to the organization's own medical staff bylaws and oversight structures. When a locum physician is placed through an agency, the credentialing chain becomes distributed. The agency conducts its own credentialing. The health system conducts its own credentialing. The malpractice carrier conducts its own verification. The state medical board has its own records. And in many cases, none of these parties have a complete view of what the others have verified, when they verified it, and what they found.

This distributed structure creates gaps that are invisible during normal operations and become acutely visible during adverse events. A locum physician may have a history of disciplinary action in a state where they previously practiced that was disclosed to the agency but not forwarded to the health system. A gap in malpractice coverage may exist during the transition between assignments that neither the agency nor the health system tracked. A privilege granted at one facility may have been based on documentation that was subsequently found to be incomplete. None of these gaps are necessarily the result of negligence. They are the predictable result of a credentialing architecture that was not designed to be auditable as a unified chain.

The legal exposure from this architecture is significant and underappreciated. In a malpractice case involving a locum physician, plaintiff attorneys will request the complete credentialing file, including all communications between the health system and the agency, all verification records, all privilege documentation, and all supervision records. They will also request the same from the agency. If the two sets of records are inconsistent, if the health system's file shows verification of credentials that the agency's file shows were never completed, or if either file has gaps that cannot be explained, the liability exposure expands beyond the clinical facts of the case to include the systemic question of whether the organization exercised appropriate oversight in placing this physician.

Regulatory exposure follows a similar pattern. Joint Commission standards, CMS Conditions of Participation, and state medical board requirements all impose obligations on health systems regarding the credentialing and privileging of practitioners, including locum tenens. These obligations do not transfer to the agency simply because the agency conducted its own credentialing. The health system retains responsibility for verifying that the physician it is allowing to practice in its facility meets the standards required by its own medical staff bylaws and applicable regulations. When a regulatory body investigates an adverse event, the question it will ask is not whether the agency credentialed the physician. It is whether the health system credentialed the physician to its own required standards and can document that it did so.

The supervision component of the credentialing chain is often the weakest link. Locum physicians, by definition, are temporary. They may be unfamiliar with the facility's specific protocols, electronic health record systems, and clinical workflows. The expectation that a locum physician will perform at the same level as a physician who has practiced in the facility for years, without a structured orientation and supervision process, is not a reasonable one. Yet most health systems do not have a formal locum orientation protocol that is documented, consistently applied, and tied to the privilege granted. When a supervision failure contributes to an adverse event, the absence of a documented orientation process is not just an operational gap. It is a liability.

The practical challenge is that the credentialing chain for locum physicians involves parties that the health system does not control. The agency has its own processes, its own documentation standards, and its own interests in the event of a claim. The health system cannot compel the agency to maintain records in a format that is compatible with the health system's own documentation requirements. What the health system can control is its own side of the chain, and that control requires a level of rigor that most organizations have not applied to locum credentialing specifically.

The organizations that have addressed this risk have done so by treating locum credentialing as a distinct process with its own documentation requirements, rather than as a simplified version of the employed physician credentialing process. This means maintaining a complete credentialing file for every locum physician that includes not just the primary source verifications but also the communications with the agency, the specific privileges granted, the supervision plan, the orientation records, and the dates and duration of each assignment. It means establishing a clear policy on what the health system will and will not accept from an agency's credentialing file and documenting that policy so it can be produced in a regulatory review. And it means conducting periodic audits of locum credentialing files to identify gaps before they become relevant in an adverse event.

The cost of building this infrastructure is real but modest compared to the cost of a single adverse event that exposes systemic credentialing failures. More importantly, it is a cost that can be planned for and budgeted. The cost of a regulatory investigation, a malpractice judgment that includes punitive damages for systemic negligence, or a Joint Commission finding that results in a corrective action plan cannot be planned for in the same way. The organizations that are managing locum credentialing risk proactively are not doing it because they expect adverse events. They are doing it because they understand that the question is not whether they will be asked to produce the credentialing chain. It is whether they will be able to answer when they are.