Provider credentialing and privileging are essential for patient safety and healthcare quality. Improper credentialing and privileging can lead to patient harm and lawsuits, as in this example:
A surgeon in Wisconsin was granted privileges and had a bad outcome following a hip surgery, which caused patient paralysis. The patient sued the physician and the hospital, alleging it failed to properly investigate the physician’s credentials. While the physician settled, the hospital lawsuit went on. It finally came out that no one at the hospital had verified any of the information provided by the physician. If they had checked, they would have found:
- The physician’s privileges were restricted–and then revoked–at other hospitals due to “flagrant bad practices”
- He was never on staff at some of the hospitals listed in his application
- He was not board certified or board eligible as an orthopedic surgeon (despite stating he was board certified)
- There were 10 malpractice suits filed against him, seven of which occurred prior to his appointment to the hospital’s medical staff
- The majority of his peer references stated he was not qualified to practice orthopedic surgery
To protect patients, hospitals must adhere to complex and lengthy credentialing and privileging processes to screen providers, verify their ability to practice, and determine which procedures and services they’re competent to perform and deliver. Credentialing professionals collect volumes of data about each applicant, often from multiple primary sources, verify each piece of data for accuracy and veracity, and carefully and holistically analyze the credentials to assess the applicant’s training, experience, competence, and abilities.
But despite the importance of getting this process right, there’s no federal law mandating how to perform credentialing and privileging. A provider is prohibited by law from practicing without possessing a clearly defined scope of practice and a set of certifications and licenses. Yet, how a hospital goes about verifying those credentials is primarily left up to them.
The evolution of credentialing and privileging
Until the mid-20th century, hospitals viewed themselves as healthcare facilitators rather than providers. They were typically operated by community organizations that provided facilities and equipment so that practitioners could care for their own patients. Hospitals made little or no effort to evaluate the competency of medical providers, with the exception of requiring a medical license.
Hospitals were historically granted immunity from negligence and malpractice claims with a two-pronged legal defense:
- Since hospitals provided equipment and facilities to practitioners, they were therefore immune from responsibility for patient injury or death resulting from medical malpractice.
- Hospitals used the doctrine of charitable immunity to argue that a judgement against them would do more harm to the public than good.
Two landmark cases changed everything
The 1957 case Bing v. Thunig firmly established that hospitals do have a responsibility for the medical care received by patients. The 1965 Darling v Charleston Community Memorial Hospital case—in which a staff practitioner so severely erred in the setting of a broken leg that it eventually had to be amputated—set the legal precedent that a hospital could be held negligent for failing to assess or monitor the competency of their medical staff.
Hospitals recognized that strong and transparent credentialing and privileging processes provide the greatest assurance of a qualified and competent medical staff and the best defense against legal risks.
Hospitals undertake these processes to:
- Protect patient safety
- Mitigate and manage risk
- Comply with accreditors and regulators
The legal framework
Hospitals generally follow a basic credentialing and privileging framework established within the section of the U.S. Code of Federal Regulations (CFR) comprising the Public Health Service Act. However, these CFR Title 42 regulations Conditions of Participation (CoPs) specify credentialing and privileging requirements for hospitals to gain or maintain accreditation to participate in Medicare and Medicaid. While not a federal mandate, CMS compliance is vital to hospitals.
Federal regulations outlined in 42 CFR 482.22 and 482.12 cite credentialing and privileging practices that hospitals must implement as CoPs in CMS programs. These include:
42 CFR 482.22 (a)(2)
“The medical staff must examine the credentials of all eligible candidates for medical staff membership and make recommendations to the governing body on the appointment of these candidates in accordance with State law, including scope-of-practice laws, and the medical staff bylaws, rules, and regulations.”
And that medical staff must:
42 CFR 482.22 (c)(4)
“Describe the qualifications to be met by a candidate in order for the medical staff to recommend that the candidate be appointed by the governing body.”
42 CFR 482.22 (c)(6)
“Include criteria for determining the privileges to be granted to individual practitioners and a procedure for applying the criteria to individuals requesting privileges.”
Thus, 42 CFR 482.22 requires an individual’s credentials must include:
- A request for clinical privileges
- Evidence of current licensure
- Evidence of training and professional education
- Documented experience
- Supporting references of competence
- Credentialing criteria
This section sets the requirement for hospitals to create governing bodies to assess candidates and outlines the minimum evaluation criteria to be used.
42 CFR 482.12 (a)(6)
The governing body must “ensure the criteria for selection are individual character, competence, training, experience, and judgment.”
A Framework for accurate and efficient credentialing
The National Committee for Quality Assurance (NCQA) provides standards for best practices and recognitions of organizations that meet these, including an Accreditation. Best practices for Credentialing Verification Organization (CVO) and healthcare organizations that credential providers include:
- Have an internal quality improvement process
- Protect provider credentialing information (i.e., data security)
- Verify provider credentials consistently and effectively
- Maintain appropriate agreements and collaboration with clients
- Have documented credentialing policies (to ensure integrity)
- Provide a peer-review process (i.e., credentialing committee)
- Re-evaluate providers in a timely manner (recredentialing)
- Monitor providers’ performance (complaints, adverse events, and Medicare/Medicaid sanctions)
- Notify authorities of safety/quality issues and notify practitioners of their appeal rights
- Evaluate organizational providers, including behavioral health providers
Ultimate responsibility
Even though federal regulations are intended for CMS accreditation purposes, courts have maintained that hospitals are ultimately responsible for the competence of their medical staff members by following thorough credentialing and privileging practices. With that in mind, and lacking a single set of standards, hospitals consistently turn to Title 42 CoPs to guide the management of their medical providers. By outsourcing credentialing to a CVO that has NCQA CVO Certification, hospital leaders can be confident that credentialing is conducted in accordance with the strictest quality standards.
