7.4 National Practitioner Data Bank Reporting and Querying

Why the NPDB Is Tested So Heavily

Domain 3 task H.4 names the National Practitioner Data Bank (NPDB) directly. It earns its exam weight because the reporting decision is one of the very few places where the risk manager's judgment has an immediate, permanent, career-level consequence for a practitioner and a direct effect on the organization's negligent-credentialing exposure. Items test three things repeatedly: what must be reported, what must not, and whether you will take the shortcut that makes a report disappear.

What the NPDB Is, and Is Not

The NPDB was created by the Health Care Quality Improvement Act of 1986 (HCQIA) and is operated by the Health Resources and Services Administration within the Department of Health and Human Services. It is a confidential flagging system. It is not an investigative body, not a disciplinary body, and not a public record. A Data Bank report contains no adjudication of guilt; it is a flag telling an eligible querier to look further before granting privileges or a license. Information in the NPDB is not available to the general public, to employers outside health care, or to the media, and improper disclosure carries civil money penalties.

HCQIA's other half is peer review immunity, and the two halves are a bargain. Participants in a professional review action receive immunity from damages under federal law if the action was taken:

1. in the reasonable belief that it was in furtherance of quality health care;
2. after a reasonable effort to obtain the facts of the matter;
3. after adequate notice and hearing procedures were afforded to the physician, or after other procedures fair to the physician under the circumstances; and
4. in the reasonable belief that the action was warranted by the facts known after that effort.

A professional review action is presumed to have met these standards unless the presumption is rebutted, which is why a well-documented, procedurally regular peer review record is itself a risk control. Congress gave peer reviewers this protection in exchange for feeding the Data Bank. An entity that substantially fails to report reportable privileges actions may, after notice and an opportunity for a hearing, lose those HCQIA immunity protections for a period and be publicly identified. Immunity and reporting are not severable, and a hospital cannot keep one while quietly abandoning the other.

What Is Reportable

1. Medical malpractice payments. Reported by the entity that makes the payment, meaning a liability insurer, a self-insured hospital, or a trust, never by the practitioner and never by the plaintiff. A payment is reportable when it is made for the benefit of a named practitioner in settlement of, or in satisfaction of a judgment in, a written claim or demand for payment based on that practitioner's provision of or failure to provide health care. There is no minimum dollar amount. A written claim or demand is required, so a courtesy waiver or write-off of a bill with no written claim behind it is not a reportable payment. Reports are due within 30 days of the payment. A payment is not an admission; the regulation states that a payment in settlement shall not be construed as creating a presumption that malpractice occurred, but that principle does not excuse the report.

2. Adverse clinical privileges actions. A professional review action based on professional competence or professional conduct that adversely affects clinical privileges for a period of more than 30 days: suspension, restriction, reduction, revocation, or denial. Also reportable is the surrender or restriction of privileges while under investigation relating to possible incompetence or improper professional conduct, or in return for the entity not conducting or not proceeding with an investigation. The NPDB also treats failure to renew an application for reappointment while under investigation as a surrender.

3. Professional society membership actions based on professional competence or conduct.

4. State licensure and certification actions, reported by the boards themselves. Following the Section 1921 expansion these include a broad range of adverse licensure and certification actions, not only those based on competence.

5. Federal actions and exclusions, including Drug Enforcement Administration controlled substance registration actions, exclusions from federal or state health care programs, health care-related criminal convictions and civil judgments, and negative actions or findings by peer review organizations and private accreditation organizations.

The Two Nuances That Decide Exam Items

The corporate shield. A payment made solely on behalf of the entity, in a matter where no individual practitioner is named or identified and the payment is not for a practitioner's benefit, is not reportable. That is the legitimate corporate shield, and it is a real and appropriate outcome in many institutional liability cases.

What is not legitimate is engineering the shield. The NPDB position is that if dismissal of the practitioner is a condition of the settlement, the payment can only be construed as a payment for that practitioner's benefit and must be reported, whether or not the practitioner is named in the release. Structuring a release so the physician's name disappears in exchange for the settlement is precisely the maneuver the rules foreclose. On the exam, a risk manager who proposes it is always wrong, and in practice the payer exposes itself to penalties and the risk manager to a credibility problem that will not survive a deposition.

Resignation timing. A physician who resigns for retirement, relocation, or any reason unconnected to an investigation is not reportable. The same physician who resigns after an investigation has begun, or who is told an investigation is coming and resigns to head it off, is reportable. Everything turns on whether an "investigation" existed and when it began, which is why the medical staff bylaws must define what constitutes an investigation, who can open one, and how its start is documented. A routine focused professional practice evaluation is not automatically an investigation; a targeted inquiry into a specific competence or conduct concern usually is. Making sure that line is defined in the bylaws, and that the record shows the date, is squarely risk management work.

Reportable versus Not Reportable

Who Queries, and When

Mandatory hospital queries. A hospital must query the NPDB when a practitioner applies for medical staff appointment, courtesy or otherwise, or for clinical privileges, and every two years thereafter for each practitioner on the medical staff or holding privileges. Note the mismatch that catches candidates: accreditation reappointment cycles may run three years, but the statutory query obligation is still every two years, so a hospital on a three-year reappointment cycle must build an off-cycle query. Continuous Query, a year-long enrollment that returns an initial response and then notifies the organization of new or updated reports on enrolled practitioners, typically within a day of receipt, is the practical way to meet the biennial obligation and to catch a report that lands in the middle of a credentialing cycle rather than at reappointment.

Other eligible queriers include other health care entities that conduct formal peer review, state licensing and certification boards, professional societies with formal peer review, health plans, and quality improvement organizations. Practitioners may self-query and should be encouraged to do so before an application. Not eligible: the general public, the media, and employers outside health care.

The narrow plaintiff-attorney exception. A plaintiff's attorney, or a plaintiff proceeding without counsel, may obtain NPDB information only when all of the following are true: a medical malpractice action or claim has been filed against a hospital; the practitioner about whom information is sought is named in that action or claim; and the requester submits evidence that the hospital failed to perform a required query on that practitioner. Even then the disclosure is one-time only and is limited to the information the NPDB held at the time the hospital should have queried.

The failure-to-query penalty. Under HCQIA, a hospital that does not query when required is presumed to have knowledge of any information the Data Bank held about that practitioner. In a negligent credentialing case that presumption is devastating, because the plaintiff no longer has to prove the hospital knew about the prior payments or the prior restriction. That single provision is the strongest argument for treating query compliance as a monitored risk management control rather than a medical staff office clerical task.

Practitioner Rights

The NPDB sends the subject practitioner a copy of every report filed about them. The practitioner may then:

• add a Subject Statement, a permanent explanatory statement that is attached to the report and disclosed every time the report is released, giving the practitioner the last word in the file;
• dispute the report, which is limited to two grounds: the factual accuracy of the report and whether the report was required to be submitted. The merits of the underlying action, meaning whether the peer review committee reached the right conclusion or whether the malpractice claim had substance, are not disputable through the Data Bank;
• if the reporting entity will not correct or void the report, request Dispute Resolution, also called Secretarial review, in which the Secretary of Health and Human Services may correct the report, void it, or leave it in place. While the dispute is pending, the report is flagged as disputed and is still disclosed.

The risk manager's role at this stage is procedural integrity, not advocacy. Report accurately, report on time, notify the practitioner so they are not ambushed by their own file, and keep the report's narrative factual and free of conclusions the record cannot support. An inaccurate report is a defamation and Data Bank dispute problem; a suppressed report is a federal compliance and immunity problem.

Scenario

A claim naming your hospital and Dr. K is set to settle for $150,000. Defense counsel suggests the plaintiff dismiss Dr. K first so there is no report. Your response has several parts. First, the report follows the substance, not the caption: if dismissal is a term of the settlement and the payment resolves exposure attributable to Dr. K, the payment is for her benefit and must be reported within 30 days. Second, ask counsel whether there is an independent, unconditional basis to dismiss Dr. K on the merits; if there is, document that analysis contemporaneously, because the reasoning is what defends the decision later. Third, make the payment decision on the merits of the claim rather than on the reporting consequence. Fourth, notify Dr. K that a report will be filed so she can prepare a Subject Statement and, if she believes the report is inaccurate, use the dispute process. Finally, route the underlying clinical issue to peer review on its own track. A payment does not create a presumption that malpractice occurred, and a Data Bank report is not a substitute for a competence evaluation.

Exam Traps

• "The NPDB is public." It is confidential, and improper disclosure carries civil money penalties. The public cannot query it.
• Looking for a dollar threshold. There is none. A four-figure payment for a named practitioner is as reportable as a seven-figure one.
• Confusing the two 30-day rules. A report is due within 30 days of the payment or action; a privileges action is reportable if it lasts more than 30 days. Different clocks, same number.
• Removing the practitioner from the settlement to avoid the report. Always the wrong answer, and specifically foreclosed when the dismissal is a settlement condition.
• Assuming resignation is safe. The trigger is whether an investigation was open or was being avoided, not what the resignation letter says.
• Querying on the accreditation cycle. The statutory obligation is every two years even where reappointment runs three; Continuous Query is the clean fix.
• Overstepping the role. The risk manager does not determine competence. The risk manager ensures the correct reporter files an accurate, timely report, that mandatory queries actually happen and are documented, and that the practitioner receives notice and their dispute rights.