You've found a remote scheduler who interviews well, types fast, and can start Monday. Then the screening invoice arrives with line items you didn't expect, and a report that says clear in one place and consider in another. If you're asking what do background checks check, the short answer is that there's no single check. You're buying a bundle of separate investigations, each with its own source, limits, and legal rules, and the right bundle depends on what that person will touch in your practice: patient records, payments, phones, or none of those.
For medical practices, that distinction matters more than it does for most employers. A remote hire who only confirms appointments carries different risk than a biller who works in your clearinghouse or a coordinator who reads referral notes all day. A proportionate screen validates what the candidate claimed and looks for job-related risk. It doesn't prove someone is trustworthy, and a maximalist screen that collects everything available can create legal exposure while still missing the one registry that matters in healthcare.
A background check isn't a database lookup. It's a set of investigations you assemble before you ever see a report, and what do background checks check in your practice is whatever you put in that scope. A typical employment background investigation may verify identity and address history, criminal records, employment history, education, professional references, driving record, military service, and, where legally relevant, credit history. Healthcare adds a layer most general explainers skip, which is exclusion screening against the federal healthcare programs list covered later in this guide.
Think of each component as answering a different question. Identity verification asks whether this person is who they claim to be. Employment and education verification asks whether the resume is accurate. Criminal history asks whether there's a record relevant to this specific role. License and exclusion checks ask whether the person is legally barred from the work. None of those answers substitutes for another, which is why a report can be clean on criminal history and still flag a fabricated degree.
That bundle logic shows up in other high-trust vetting contexts too. Practices comparing how different sectors assemble proportionate checks sometimes look at what the fostering checks involve from Organic Fostering, where screening is similarly layered around the vulnerability of the people being served rather than run as one generic search.
A virtual medical receptionist handling scheduling and insurance calls needs identity, employment, and relevant criminal screening, plus the healthcare exclusion check. A billing support hire who posts payments justifies closer attention to financial misconduct history. A staff member who drives between clinic sites justifies a motor vehicle record that a fully remote scheduler doesn't. Ordering the same package for all three wastes money on one end and under-screens on the other.
Practical rule: Write down what each role can access, then order only the components that map to that access.
Jurisdiction shapes the bundle as much as job duties do. State and city rules govern when you can ask about criminal history and what you can consider, and a candidate living outside the United States may have records held by institutions with no centralized database at all. Two candidates for the same remote job can legitimately receive different searches because they live in different places, and your policy should anticipate that rather than treat it as an inconsistency.
Most screening failures I've seen in practice hiring weren't dramatic criminal findings. They were mundane mismatches in the biographical components, and they were catchable early if someone had read the report carefully instead of scanning for a pass stamp.
Identity verification confirms the legal name, date of birth, and address history that anchor every other search. This step matters because name-only criminal searches produce false matches, especially with common names. A defensible vendor resolves identity using multiple identifiers before attributing any record to your candidate. Address history also tells the vendor which counties and states to search, so a thin address trace results in a thin criminal search downstream.
Employment verification contacts prior employers, or their verification services, to confirm dates, titles, and sometimes eligibility for rehire. The discrepancies that surface are usually inflated titles, stretched dates that hide a gap, or a job that doesn't exist at all. A remote patient scheduler who claims three years at a large practice but whose former employer confirms fourteen months in a different role hasn't necessarily lied about something disqualifying, but you now know the resume needs a conversation. If you want the mechanics of confirming work history step by step, this guide to verifying a candidate's employment history walks through what to ask and what documentation to accept when a former employer won't respond.
Education verification works the same way at the institution level. It confirms the degree, dates of attendance, and sometimes the field of study. It catches diploma mill credentials and degrees that were started but never finished. For administrative roles it matters less than employment history, but for any role where you've advertised a credential requirement, skipping verification means you're taking the candidate's word for your own stated standard.
Common Non-Criminal Components and What They Verify
| Component | Source | Typical Discrepancy Caught |
|---|---|---|
| Identity and address | Government ID, address records | Mismatched legal name, undisclosed prior addresses |
| Employment history | Prior employers, verification services | Inflated title, altered dates, nonexistent job |
| Education | Institution registrar | Unfinished degree listed as completed |
| References | Named professional contacts | Supervisor who was actually a coworker |
| Driving record | State motor vehicle agency | Suspended license, serious violations |
Reference checks are the weakest component if you run them passively, because candidates choose friendly referees. They get useful when you ask specific questions about reliability, handling of confidential information, and reason for leaving, and when you verify the referee supervised the candidate. Treat references as a consistency check against the rest of the file, not as independent proof.
Driving records only belong in the bundle when the role involves driving, such as a courier for a multi-site practice or a home-visit support role. If you're unsure how traffic matters surface in screening at all, Fiscella Law LLC on traffic records explains the boundary between driving violations and criminal records in plain terms. For a fully remote biller, ordering a motor vehicle report adds cost and collects data you have no job-related reason to hold.
Criminal history is the component practice managers worry about most and interpret worst. The most common error is treating the report as a verdict instead of as input to a job-related risk judgment you're responsible for making and documenting.
A thorough criminal search isn't one search either. County records hold most misdemeanor and felony filings where the case was prosecuted. State repositories aggregate records unevenly, since reporting quality varies. Federal records cover offenses prosecuted in federal court, which county searches won't return. Sex offender registries are a separate check entirely. A vendor that runs only a national database scan is aggregating other people's data, and those databases can miss records or carry stale dispositions. Ask which jurisdictions were searched and why, because coverage gaps are usually scope decisions, not candidate facts.
This is the distinction that carries legal weight. An arrest alone does not establish that criminal conduct occurred, and a defensible process evaluates the nature and seriousness of the offense, how much time has passed, and the nature of the job. An arrest tells you police detained someone. It doesn't tell you a crime happened, that this person did it, or that a prosecutor thought the case worth pursuing. Refusing to hire based only on an arrest isn't automatically job-related, and it exposes you under Title VII if the practice screens out protected groups at higher rates.
A conviction is different. It's a court outcome, and you can weigh it. But weighing it means running the individualized review, not applying a blanket rule.
An "any record, any age, automatic no" policy feels safe. It's actually the riskiest policy you can write, because it excludes people for conduct with no connection to the job.
Work through three questions for every conviction you find:
A recent fraud conviction for a remote biller who will post payments and handle refund workflows is directly relevant, because the conduct and the job access point at the same risk. An old, unrelated offense for a scheduling role with no payment access is weak evidence of present risk, and excluding that candidate is hard to defend. EEOC guidance for employers on background checks also stresses that screening can't be used to discriminate based on race, national origin, sex, religion, disability, genetic information, or age.
Consistency is what makes the review defensible. Apply the same criteria to every candidate for the same role, give the candidate a chance to explain or correct the record, and write down how you reached the decision. If two managers would reach different conclusions from the same report, your criteria aren't written tightly enough yet.
These three components get bundled into screening conversations constantly, but they answer unrelated questions and carry very different justifications. Ordering all three by default is how practices end up holding sensitive data they never needed.
A credit check in hiring isn't a credit score pull like a lender runs. It's a consumer report view of payment patterns and obligations, and under the FCRA it requires clear disclosure and written authorization. The honest use case is a role with real financial control, such as someone who manages practice banking or has unsupervised authority over disbursements. For a remote receptionist, scheduler, or insurance verification specialist, credit history has no plausible connection to job performance, and several jurisdictions restrict its use for exactly that reason. If you can't articulate the connection in one sentence, don't order it.
Right-to-work checks confirm the person is legally authorized for the engagement. For U.S. employees that means Form I-9 documentation and, for many employers, E-Verify confirmation. The paperwork discipline matters as much as the check itself, and teams building document packets for cross-border staff often keep a visa documents checklist from LegalWeg handy to track which identity and authorization documents belong in which file. Keep authorization documents separate from the screening report, since they serve different legal purposes and different retention rules apply.
International screening is where U.S. habits break down. An employer may need country-specific consent, translated records, alternative identity documents, or verification through institutions that do not use centralized databases. A U.S.-style consumer report often doesn't exist for a candidate in Colombia or Mexico. Instead, the screen may rely on local police or judicial records, national identity validation, and direct outreach to the university or former employer, each with its own turnaround and documentation norms.
For help structuring that process, international background check services built for cross-border hiring can localize consent language and record sources by country instead of forcing a U.S. template onto a foreign records system. LatHire is one option in that category, offering human-led verification of identity, employment, education, and criminal records for Latin American candidates. Whoever you use, ask what the fallback is when a record source doesn't respond. "Unavailable" is a legitimate result. Treating it as either a pass or a fail without a documented alternative, such as verified references plus credential confirmation, is where cross-border screening goes wrong.
Knowing what do background checks check only gets you halfway. The legal exposure for most practices sits in the workflow around the report, not in the report itself.
When a third-party company prepares the report, that report is generally a consumer report under the FCRA, and you need a clear written disclosure plus the candidate's written authorization before ordering it. Most practices run screening after a conditional offer, which keeps the process clean in jurisdictions that restrict when criminal history can be considered. A straightforward domestic screen often returns within a few business days. Education verification and international components routinely take longer, because you're waiting on a registrar's office or a foreign institution, not a database. Build that lag into your start-date promises or you'll pressure yourself into letting someone access patient systems before results land.
If a report contains information that might lead you not to hire, you can't just move on to the next candidate. If potentially disqualifying information appears, the employer must provide the applicant with the report and an FCRA rights summary before taking adverse action, allowing an opportunity to identify inaccurate, incomplete, or mismatched records. That's the pre-adverse action step. You wait a reasonable period, consider anything the candidate submits, and only then send the final adverse action notice if your decision stands.
This sequence isn't bureaucracy for its own sake. Picture a remote medical receptionist flagged on a preliminary criminal match. The pause lets you discover the record belongs to someone with the same first and last name but a different middle name and date of birth. Without the pause, you've rejected a qualified candidate on another person's record and created exactly the kind of error the process exists to catch.
A standard commercial report doesn't substitute for exclusion screening. The HHS Office of Inspector General's List of Excluded Individuals/Entities identifies people and entities excluded from federally funded healthcare programs, including for Medicare or Medicaid fraud, and hiring someone on that list can bring civil monetary penalties. Screen every remote hire and contractor against the LEIE before they start, then recheck on a defined recurring cadence, since exclusion status can change after hire. Document each check with a date and the name searched, and investigate possible matches before acting on them.
The uncomfortable truth from running these screens repeatedly is that a returned report is a research product, not a fact sheet. Treating it as either perfect or useless will burn you in opposite directions.
More than three-quarters of businesses in a 2025 global survey of 1,114 HR, risk, and talent professionals reported finding candidate discrepancies during screening in the prior 12 months, with the most common involving undisclosed criminal convictions, education, and employment history. Read that carefully. It means screening finds a lot, and it also means a discrepancy flag is routine rather than damning. Some flags are deliberate misrepresentation. Many are a former employer recording a start date as the offer date instead of the first working day, or a university listing a degree under a maiden name.
False matches cluster around predictable causes. Common names collide across databases. Records sealed or expunged locally may linger in commercial databases that haven't refreshed. Foreign credentials follow naming and date conventions that U.S. systems misread, and translation introduces its own errors. A candidate with two surnames, standard in much of Latin America, can be split into two partial identities or merged with a stranger depending on how a system parses the name.
Accuracy protocol: Never let a database match alone end a candidacy. Verify sensitive findings against a primary source first.
AI-assisted screening sharpens this concern rather than resolving it. Automation can flag and match faster, but speed doesn't explain itself. You still need criteria a human can articulate, a person who reviews flagged results against the actual role, and a correction path the candidate can use. A stricter automated screen that rejects on more signals isn't a better screen if half those signals are noise. It's a faster way to make the same mistakes at scale.
That protocol costs a few days on flagged files. It costs far less than a negligent hiring claim on one end or a discrimination complaint on the other.
Compliance in screening isn't a separate workstream you bolt on after choosing a vendor. It's the set of guardrails that decides what you're allowed to collect, when, and what you may do with it.
The FCRA governs third-party reports, covering disclosure, authorization, and the adverse action sequence described earlier. EEOC guidance shapes how criminal history gets evaluated. Ban-the-box and fair chance laws in many states and cities control when you may ask about criminal history and what you may consider, so a process that's compliant in one state can violate the rules in another where your remote employee lives. For a deeper map of how these rules interact, this overview of background check regulations lays out the federal and jurisdictional layers side by side.
Privacy law draws an equally firm line around medical and genetic information. Except in rare circumstances, employers should not seek genetic information, including family medical history, or use it in employment decisions, and generally should not ask disability-related or medical questions before a conditional offer. For a remote healthcare role, that means your screen focuses on identity, authorization, relevant convictions, credentials, licenses, employment history, and exclusion status. Diagnoses, family history, and unrelated personal data don't belong in the file, and collecting them creates risk without informing any legitimate decision.
One clarification practices often get wrong: screening supports your HIPAA safeguards, but no vendor or workflow is "HIPAA certified," because HHS doesn't recognize an official HIPAA certification. Background checks reduce workforce risk. Your access controls, training, and audit practices still have to do the rest of the work.
What do background checks check? Whatever bundle you deliberately assemble. The practices that get this right treat screening as a set of proportionate, role-specific investigations rather than a single pass or fail stamp, and they never skip the healthcare-specific LEIE exclusion check that ordinary commercial reports don't replace. A clear result means the sources searched returned nothing adverse. It doesn't certify trustworthiness, and a flagged result doesn't decide the hire for you.
Your next steps are concrete. Write a screening scope for each remote role based on actual system and data access. Document your FCRA disclosure and adverse action workflow. Localize consent and record sources for LATAM hires instead of forcing a U.S. template. Put LEIE rechecks on a recurring calendar, and verify any sensitive match against a primary source before you act on it.
If you're hiring remote medical receptionists, schedulers, insurance verification specialists, or billing support and want screening handled as part of the process, Medical Virtual Assistants provides pre-vetted, bilingual LATAM professionals aligned with U.S. working hours, with interview-before-hire and a shortlist within 24 hours. Request your shortlist and review candidates whose verification is already underway.