The Double Diagnosis, Applied to Paperwork
I-9 compliance doesn't feel like a clinical risk. It feels like paperwork, the kind that gets handed to a new hire on day one along with a stack of other onboarding forms and then filed away and forgotten. That's exactly why it's dangerous. Your credentialing files, your license verifications, your background checks, all of that lives on the clinical side of the Double Diagnosis and tends to get real attention. Form I-9 lives on the employer side, and in a lot of small healthcare practices, nobody has looked at the I-9 file since it was completed.
That gap matters more this year than it has in a long time. Enforcement around Form I-9 has tightened meaningfully in 2026, and the margin for "we'll fix it if they ever ask" has gotten a lot smaller.
What Form I-9 Actually Requires
Federal law generally requires an employer to complete Form I-9 for each employee hired after November 6, 1986, to perform labor or services for pay in the United States, subject to limited exceptions. Properly classified independent contractors and certain individuals performing casual domestic services are not employees for Form I-9 purposes.
The employee must complete Section 1 after accepting the job offer and no later than the first day of work. The employer generally must complete Section 2 within three business days after the employee's first day of work. If the employee will work for fewer than three business days, however, Section 2 must be completed no later than the first day of work. Missing this window is one of the more common and avoidable errors small practices make, especially when onboarding happens informally or a new hire's paperwork gets delayed behind orientation and credentialing tasks.
Retention has its own clock. Federal rules require you to keep a completed Form I-9 for each person you hire for three years after the date of hire, or one year after employment ends, whichever is later. You only need to retain the pages that were actually filled in, not the blank instruction pages or the List of Acceptable Documents reference page. And you need to be able to produce those forms within three business days if DHS, the Department of Labor, or another authorized agency requests an inspection.
Who This Applies To, and Florida's Added Layer
Because Form I-9 has no employer-size threshold, every healthcare practice that hires at least one covered employee must comply, from a dental office with one employee to a fifty-employee home health agency. What varies is whether E-Verify applies on top of the I-9 requirement.
Florida Statutes § 448.095 requires public agencies and private employers with 25 or more employees, as defined by the statute, to use E-Verify for covered new hires. A covered employer must create the E-Verify case within three business days after the employee begins working for pay, retain the required documentation and verification record for at least three years, and certify compliance on its first reemployment-assistance tax return filed each calendar year. Public agencies are covered regardless of size.
Separate E-Verify requirements apply to contractors and subcontractors performing work under covered Florida public contracts. Employers subject to the federal E-Verify contractor rule may also have obligations regardless of their Florida private-employer headcount.
During the 2026 legislative session, Florida HB 197 would have expanded the E-Verify mandate to all private employers beginning July 1, 2026. The bill passed the House but died in the Senate Rules Committee on March 13, 2026, and did not change current law. Future legislative sessions may revisit the issue, but Florida's existing 25-employee threshold remains in effect.
Florida's law also carries state enforcement consequences. If Florida Commerce determines that an employer failed to use E-Verify as required, the employer generally has 30 days to cure the violation. If Florida Commerce determines that an employer failed to use E-Verify as required three times within a 24-month period, the department must impose a $1,000-per-day fine until the violation is cured, and the noncompliance also constitutes grounds for suspension of applicable state-issued licenses until the employer demonstrates compliance.
Where Healthcare Practices Actually Get This Wrong
A few patterns show up again and again in small healthcare practices:
Confusing I-9 verification with credentialing verification. These are two entirely separate processes that check two entirely different things. Credentialing confirms a clinician is licensed and qualified to practice. Form I-9 confirms an employee is authorized to work in the U.S. A practice can have airtight credentialing files and a completely broken I-9 process, because nobody treats them as connected, and they aren't.
Getting confused about who completes the I-9 for contract and agency staff. When a bona fide staffing agency is the worker's employer, the agency generally completes and retains the worker's Form I-9. The healthcare practice ordinarily should not complete a duplicate form merely because the individual works at its facility.
The answer depends on the actual relationship, however, not simply the contract's label. The practice should document which entity hires, pays, supervises, disciplines, and terminates the worker, and should assess whether the facts create direct- or joint-employer status. A healthcare organization also may not knowingly use a contractor's labor if it knows the workers are not authorized to work.
Inconsistent retention across locations. Multi-location practices, and this is especially common in home care and home health where staff are hired regionally, often end up with I-9s stored differently at each site, some retained too long, some destroyed too early, some missing entirely for staff who transferred between locations. There should be one retention system, not one per site.
Remote hire verification done incorrectly. Since August 1, 2023, qualifying employers participating in E-Verify in good standing may use DHS's authorized alternative procedure instead of physically examining documents in person. The employee must transmit copies of the documents before the examination, the employer must examine the copies, conduct a live video interaction with the employee, retain clear copies of the documents presented, and check the alternative-procedure box in Section 2 or Supplement B.
The hiring site at which the employee completes Form I-9 must participate in E-Verify before the employer may use the alternative procedure. A participating hiring site must create an E-Verify case for every newly hired employee at that site, not only for employees whose documents are examined remotely.
An employer that is not eligible for the alternative procedure may use an authorized representative to conduct an in-person examination, but it may not create its own informal video-only process. Failure to check the alternative-procedure box when the procedure was used is identified in ICE's March 2026 fact sheet as a substantive violation.
Requesting specific or extra documents. The employee, not the employer, chooses which acceptable documents to present: either one List A document or a combination of one List B and one List C document. Do not request a particular document, demand additional documents, reject reasonably genuine documents because of citizenship or national origin, or apply E-Verify inconsistently. Those practices can constitute unlawful document abuse or immigration-related discrimination under the Immigration and Nationality Act's anti-discrimination provision. This is particularly important in healthcare workplaces with internationally trained clinicians and employees in temporary visa classifications.
ICE's 2026 Enforcement-Guidance Change
This is the part of the picture that changed recently enough that it's worth calling out directly. On March 16, 2026, ICE revised its Form I-9 inspection fact sheet and identified additional errors that the agency intends to treat as substantive rather than technical or procedural. Substantive violations may be cited without providing the employer the 10-business-day correction period that applies to technical or procedural failures.
The revision reflects ICE's current enforcement position, but it was issued as agency guidance rather than through notice-and-comment rulemaking. Employers should therefore take the revised classifications seriously while recognizing that their legal effect may be tested in administrative proceedings or litigation.
As of August 1, 2026, civil penalties for substantive or uncorrected technical Form I-9 paperwork violations range from $288 to $2,861 per affected individual. Factors such as the employer's size, good faith, seriousness of the violation, unauthorized-worker involvement, and prior violation history may affect the amount assessed within that range.
Separate and substantially higher tiered penalties apply to knowingly hiring or continuing to employ unauthorized workers: $716 to $5,724 for a first offense, $5,724 to $14,308 for a second offense, and $8,586 to $28,619 for a third or subsequent offense. These amounts are subject to future inflation adjustments.
I'd treat this as a genuine trigger to check your files now, not after an inspection notice arrives. If it's been longer than a year since anyone reviewed your I-9 binder, that review is overdue.
Documentation That Actually Holds Up
Although federal law does not require I-9s to be stored separately from other personnel records, separate storage is a strong compliance practice because it limits access to sensitive information and allows the employer to respond to an inspection without turning over unrelated personnel documents.
A defensible file also includes a documented retention schedule that someone actually follows, tracking the later of three years from hire or one year from termination, and copies of both sides of any documents examined under the remote alternative procedure, with the alternative-procedure box checked every time it's used. For contractors, agency workers, and travel personnel, retain contracts and classification records identifying the employing entity and allocating responsibility for Form I-9 compliance. This is a risk-management practice rather than a substitute for analyzing the actual employment relationship.
If the practice has 25 or more employees under Florida's statutory definition, or is otherwise subject to a state or federal E-Verify mandate, it should have a documented process for creating an E-Verify case for every covered new hire. Practices approaching the threshold should monitor headcount and prepare to implement the process before the mandate applies.
Reverification and Supplement B
Reverification requires its own tracking process. When an employee's temporary employment authorization expires, complete Supplement B before the authorization expiration date. Reverification generally concerns employment authorization, not the expiration of an identity document. Do not reverify a lawful permanent resident merely because the individual's Permanent Resident Card expires, and do not impose additional documentation demands based on citizenship or immigration status.
This is a material operational issue for healthcare employers that sponsor or employ clinicians and staff with temporary work authorization. A missed reverification deadline can leave the employer without timely documentation of continued authorization and, in some cases, result in employment continuing after the employee's authorization has expired.
Building a Defensible I-9 System
Start with a self-audit. Pull your I-9 files and check three things: was Section 2 completed within three business days of each employee's start date (or by the first day of work for anyone hired for fewer than three business days), is retention consistent across every employee and every location, and is there documentation for every non-employee (contractor, agency, or travel worker) explaining why your practice doesn't hold their I-9. Most practices find at least a few gaps the first time they actually look.
From there, standardize the process. One person or one small team should own I-9 completion for every new hire. As of August 1, 2026, employers should use the current Form I-9 edition dated 01/20/25, which expires May 31, 2027. Employers should not use a Form I-9 bearing the July 31, 2026 expiration date. Employers using electronic I-9 systems should confirm that their systems display the current form and the May 31, 2027 expiration date. Build a checklist that includes the retention date calculation up front so nobody has to remember it later, and if you use the remote alternative procedure, build the alternative-procedure checkbox step into your onboarding checklist so it's never optional.
We built the HR Triage Assessment because most practice owners are managing this alongside patient care, staffing, and everything else that actually keeps the practice running. It's a fast way to see where your I-9 documentation stands next to the rest of your compliance picture, before an inspection request makes that question urgent.
Sources Referenced for Verification
- Immigration and Nationality Act § 274A, 8 U.S.C. § 1324a
- Immigration and Nationality Act § 274B, 8 U.S.C. § 1324b
- 8 C.F.R. §§ 274a.1, 274a.2, and 274a.10
- 28 C.F.R. Part 44
- USCIS Form I-9, current edition 01/20/25, expiring May 31, 2027, and USCIS Form I-9 update guidance
- USCIS and E-Verify guidance on the DHS alternative procedure for remote document examination, including hiring-site enrollment requirements
- Florida Statutes § 448.095
- Florida HB 197 legislative history (died in the Senate Rules Committee on March 13, 2026)
- ICE's March 16, 2026 Form I-9 inspection fact sheet revision, described as agency enforcement guidance rather than rulemaking