Harold Shipman murdered more than 200 patients during a 23-year career as a general practitioner in England. He was trusted, respected, and held full professional registration throughout the period of his offences. Beverley Allitt attacked 13 children during a 59-day period on a hospital ward in Grantham, killing four and causing serious harm to others. She held a valid nursing qualification and had passed the pre-employment checks in place at the time.
These cases are extreme. They represent the outer boundary of what can happen when verification fails. But they serve an important purpose in any discussion of healthcare background verification: they remind us that the stakes in healthcare are fundamentally different from every other sector. A bad hire in financial services costs money. A bad hire in technology costs time. A bad hire in healthcare can cost lives.
This is not rhetoric. It is a documented, recurring pattern. Clinical negligence claims cost NHS England over £2 billion annually. Regulatory investigations into healthcare practitioners who should have been identified at the point of hire or through continuous monitoring thereafter appear with sobering regularity.
What Makes Healthcare Verification Different
Healthcare BGV is more complex than verification in any other sector, for several interconnected reasons.
The range of roles is enormous. A single hospital employs consultant surgeons, junior doctors, nurses at multiple grades, healthcare assistants, midwives, pharmacists, radiographers, physiotherapists, occupational therapists, speech therapists, porters, cleaners, catering staff, administrative assistants, and IT support. Each of these roles has a different risk profile, different regulatory requirements, and different verification needs. A one-size-fits-all screening approach is inadequate in healthcare the checks required for a consultant anaesthetist are categorically different from those required for an administrative assistant, even though both work in the same building.
Staffing pressure is intense and chronic. Healthcare is the sector where the phrase “we can’t wait for the checks to come back” is most frequently heard and where the consequences of acting on that sentiment are most severe. Understaffed wards, unfilled rotas, patients waiting for care the operational pressure to get people into roles quickly is real and constant. This pressure creates a persistent temptation to allow workers to start before verification is complete, or to accept incomplete checks as “good enough.” Every time this happens, the verification process is functionally bypassed even if it exists on paper.
Multi-sector career patterns are common. Healthcare workers frequently move between the NHS, private healthcare, agency work, locum roles, and international positions sometimes within the space of a single year. Each transition creates a new verification obligation, and each gap between roles is a period during which the worker’s status may have changed without detection. A nurse who left the NHS due to a fitness-to-practise concern may appear on an agency’s books six months later with no record of the issue if the agency does not conduct its own independent verification.
The growth of gig-model healthcare delivery is accelerating. Telemedicine platforms, locum staffing apps, on-demand home care services, and freelance clinical consulting are all growing rapidly. These models combine the operational characteristics of the gig economy speed, scale, minimal supervision with the risk profile of healthcare direct contact with vulnerable patients, access to controlled substances, clinical decision-making with life-or-death consequences. The verification standards applied to workers on these platforms are, in many cases, materially lower than those applied in traditional healthcare employment.
The Non-Negotiable Checks
Certain verification checks in healthcare are not discretionary. They are regulatory requirements, professional obligations, or both. Any healthcare organisation that does not conduct them is operating outside acceptable standards regardless of what its policy documents may state.
Professional registration verification. Every healthcare professional must be verified against their relevant regulatory body’s register before they begin any patient-facing work. In the UK, this means checking the General Medical Council (GMC) register for doctors, the Nursing and Midwifery Council (NMC) register for nurses and midwives, the General Pharmaceutical Council (GPhC) register for pharmacists, and the Health and Care Professions Council (HCPC) register for allied health professionals. This is not a check that can be deferred, abbreviated, or assumed.
Critically, registration verification must confirm not just that the individual appears on the register, but that their registration is current, unrestricted, and free from conditions, warnings, suspensions, or undertakings. A practitioner with conditions attached to their registration may be permitted to practise but only within defined limitations. If the employing organisation is not aware of those limitations, the practitioner may be placed in roles that breach their conditions creating risk for patients and regulatory exposure for the organisation.
Criminal record disclosure. In the UK, the Disclosure and Barring Service (DBS) provides three levels of check: basic, standard, and enhanced. For the majority of healthcare roles particularly those involving direct patient contact an enhanced DBS check is required. This reveals not only convictions and cautions, but also any relevant information held by local police forces that they consider relevant to the role.
For roles involving work with children or vulnerable adults, the enhanced DBS check also includes a check against the barred lists the children’s barred list and the adults’ barred list which identify individuals who are prohibited from working in these settings. Employing a barred individual in a role from which they are barred is a criminal offence.
Equivalent disclosure frameworks exist in other jurisdictions: the Garda vetting process in Ireland, PVG scheme in Scotland, police clearances in Australia, and various state-level processes in the US. The specifics differ, but the principle is universal: criminal history relevant to patient safety must be identified before a healthcare worker begins practice.
Right to work verification. This is a legal requirement in every jurisdiction, but it has specific significance in healthcare because of the sector’s reliance on international recruitment. In the UK, penalties for employing workers without the right to work are up to £60,000 per worker. More significantly, a healthcare worker whose immigration status expires and who therefore loses the right to work may also lose their professional registration, creating a compounding risk that affects both compliance and patient safety.
Health and occupational clearances. Healthcare workers may need to demonstrate that they are physically capable of performing their role, that they do not pose an infection risk to patients (particularly relevant for workers in surgical or immunocompromised settings), and that they have received required immunisations. Occupational health clearances are not background verification in the traditional sense, but they form part of the overall assurance framework that every healthcare employer must maintain.
The Locum and Agency Challenge
Locum and agency staffing represents a specific and growing verification risk in healthcare.
The typical pattern works as follows: a healthcare professional is verified once by a staffing agency. That agency then deploys the professional to multiple client organisations hospitals, clinics, GP practices over a period of months or years. Each deployment is treated as a continuation of the original engagement, and the original verification is assumed to remain valid.
The problems with this model are significant. The agency’s verification standards may not meet the standards of the client organisation. The checks may have been conducted months or years ago and may no longer reflect the professional’s current status. The agency may not conduct continuous monitoring between deployments. And the client organisation, which bears the ultimate responsibility for patient safety, may not independently verify the worker relying instead on the agency’s assurance.
NHS Temporary Staffing Standards address this issue directly, setting requirements for how agencies must verify the healthcare workers they supply. But compliance is uneven. And outside the NHS in private healthcare, in social care, in the growing ecosystem of healthcare platform startups the standards are often less clearly defined and less consistently applied.
The solution is straightforward in principle, if operationally demanding: every deploying organisation should independently verify the registration status and DBS disclosure of agency and locum workers, regardless of what verification the agency claims to have conducted. Trust, but verify.
Continuous Monitoring: A Current Obligation, Not a Future Enhancement
In most sectors, continuous monitoring is presented as a forward-looking improvement to background verification something organisations should aspire to rather than something they are required to do. In healthcare, this framing is misleading.
The Care Quality Commission (CQC) in England and NHS England are both moving toward an expectation that healthcare organisations conduct ongoing monitoring of their workforce’s registration status, criminal record changes, and fitness-to-practise developments not just at the point of hire.
The logic is unanswerable. A nurse whose registration is suspended three months after starting work poses the same risk as a nurse whose registration was suspended before they applied arguably more risk, because they are already embedded in the workforce, with access to patients, medication, and clinical systems. The only way to detect this change is through continuous monitoring.
In practice, continuous monitoring in healthcare should include: automated alerts when a professional’s registration status changes on the relevant regulatory body’s register; ongoing DBS monitoring through the DBS Update Service (or equivalent); periodic checks against sanctions lists and exclusion databases; and adverse media monitoring for senior clinical and leadership roles.
The technology to deliver this monitoring is available and affordable. AMS Inform and other providers offer automated registration monitoring that checks regulatory body registers at defined intervals and alerts the employing organisation to any change. The cost is a fraction of the cost of a single clinical negligence claim.
Gig Healthcare: The Fastest-Growing Blind Spot
The growth of gig-model healthcare delivery telemedicine platforms, locum staffing apps, on-demand home care services represents the largest emerging verification risk in the healthcare sector.
These platforms are scaling rapidly. They are addressing genuine market needs patients who need care quickly, professionals who want flexibility, healthcare systems that cannot fill roles through traditional recruitment. But they are doing so, in many cases, without verification infrastructure that matches the risk profile of the work being performed.
A telemedicine platform that connects patients with doctors for remote consultations must verify that those doctors hold current, unrestricted registration. A home care app that sends care workers into elderly people’s homes must conduct enhanced DBS checks equivalent to those required of care workers employed directly. A locum staffing platform that places nurses in NHS hospitals must meet NHS Temporary Staffing Standards.
Yet evidence suggests that many of these platforms are operating with verification processes closer to gig economy standards than healthcare standards identity checks and basic criminal screening, but not the full scope of registration verification, enhanced disclosure, and continuous monitoring that the risk profile of healthcare work demands.
The regulatory expectation is clear: platforms that facilitate healthcare delivery bear the same verification responsibilities as organisations that employ healthcare workers directly. The fact that the engagement is mediated by an app rather than a traditional employment contract does not reduce the clinical risk and therefore should not reduce the verification standard.
Building a Healthcare Verification Programme
For healthcare organisations reviewing or rebuilding their verification programmes, several principles should guide the design.
Start with regulatory requirements as the floor, not the ceiling. Regulatory requirements represent the minimum acceptable standard. Best practice in healthcare verification goes beyond regulatory minimums incorporating continuous monitoring, multi-jurisdiction checks for internationally recruited staff, gap analysis for career history, and enhanced reference checks that probe fitness-to-practise history rather than simply confirming employment dates.
Design checks around role risk, not organisational convenience. The verification requirements for a consultant surgeon should be different from those for a cleaner but both should be systematically defined and consistently applied. A risk-tiered approach ensures that verification resources are concentrated where patient safety risk is highest, without over-screening roles where the risk profile is lower.
Verify independently, regardless of agency assurance. For any healthcare worker supplied through an agency, locum bank, or staffing platform, the deploying organisation should independently confirm registration status and DBS disclosure. This is not about distrusting the agency it is about recognising that the deploying organisation bears the ultimate responsibility for the workers who interact with its patients.
Implement continuous monitoring as standard, not exceptional. Ongoing monitoring of registration status, criminal record changes, and sanctions list additions should be standard for all clinical and patient-facing staff. The cost is marginal; the risk of not monitoring is substantial.
Treat gig healthcare to employment-grade standards. Any worker who delivers healthcare whether employed directly, supplied through an agency, or engaged through a platform should be verified to the same standard. The delivery mechanism is an operational detail. The clinical risk is identical.
Conclusion
Healthcare verification is not a compliance exercise. It is a patient safety function. Every check that is skipped, deferred, or conducted inadequately is a gap through which harm can enter.
The healthcare organisations that verify well comprehensively, continuously, and independently are not doing so because they distrust their staff. They are doing so because they understand that verification is the mechanism through which trust is made reliable. Trust without verification is hope. Trust with verification is assurance. And in healthcare, where the consequences of misplaced trust can be measured in human suffering, assurance is the only standard that is acceptable.
