8.3 Policy Development, Clinical Credentialing & Staff Oversight

Policy Development, Clinical Credentialing & Staff Oversight

Operational risk management relies heavily on robust administrative controls, standardized clinical policy governance, and rigorous oversight of healthcare practitioners. Risk managers must navigate the legal frameworks surrounding policy creation, medical staff credentialing, clinical privileging, peer review immunity, and federal reporting requirements under the Health Care Quality Improvement Act (HCQIA) and the National Practitioner Data Bank (NPDB).

---

Policy Development & Document Governance

Policies and procedures form the internal standard of care for a healthcare facility. In medical malpractice litigation, an organization's internal policies are frequently admitted into evidence to establish whether healthcare providers breached institutional standards.

The Healthcare Document Hierarchy

To prevent confusion and clinical ambiguity, organizations must maintain a clear document hierarchy:

Policy Lifecycle & Legal Considerations

• Development & Approval: Policies must be drafted by multidisciplinary subject matter experts, reviewed by legal/risk management, and approved by authorized bodies (e.g., Medical Executive Committee or Policy Committee).
• Version Control & Archival: Historical versions of every policy must be archived with exact effective and sunset dates. In litigation occurring years after an incident, defense counsel must establish which policy was active on the exact date of service.
• Feasibility & Compliance: Establishing an overly stringent policy that cannot be realistically followed by frontline staff creates severe legal exposure. Plaintiffs' attorneys will argue that staff violated the hospital's own internal rules.

---

Clinical Credentialing vs. Privileging

A primary responsibility of healthcare risk management and medical staff services is ensuring that only qualified, competent practitioners provide patient care.

+-----------------------------------------------------------------------------------+
|                        CREDENTIALING VS. PRIVILEGING                              |
+------------------------------------+----------------------------------------------+
| CREDENTIALING                      | PRIVILEGING                                  |
+------------------------------------+----------------------------------------------+
| Verification of professional       | Authorization to perform specific clinical    |
| qualifications, license, education,| procedures (e.g., laparoscopic cholecystectomy|
| training, & background.            | or robotic prostatectomy).                   |
+------------------------------------+----------------------------------------------+
| Focuses on "Who the provider is."   | Focuses on "What the provider can do."       |
+------------------------------------+----------------------------------------------+
| Conducted via Primary Source       | Based on demonstrated current clinical       |
| Verification (PSV).                | competence & specialty training.             |
+------------------------------------+----------------------------------------------+

Primary Source Verification (PSV)

Accreditation standards (The Joint Commission, NCQA) require Primary Source Verification (PSV) for all credentialing elements. The hospital must verify documentation directly from the original issuing source rather than relying on copies provided by the applicant:

• State Medical/Nursing Board (active license & disciplinary history)
• Medical school & residency program (diploma & completion verification)
• Educational Commission for Foreign Medical Graduates (ECFMG) if applicable
• Specialty Board Certification (e.g., American Board of Surgery)
• National Practitioner Data Bank (NPDB) query
• Hospital affiliations & peer references

Focused and Ongoing Professional Practice Evaluation (FPPE & OPPE)

The Joint Commission mandates two performance evaluation mechanisms to continuously monitor physician competence:

• Focused Professional Practice Evaluation (FPPE): A time-limited, intense evaluation applied under two conditions:
  1. For all newly hired or newly privileged practitioners granting initial privileges.
  2. Whenever a performance concern or trigger is identified regarding an existing practitioner. Methods include direct proctoring, chart review, simulation, or external peer review.
• Ongoing Professional Practice Evaluation (OPPE): A continuous, routine data collection process evaluated at intervals set by the medical staff — commonly every six months, and in no case exceeding 12 months — to assess ongoing competence. Metrics include operative complication rates, blood utilization, readmission rates, length of stay, medical record documentation timeliness, and patient satisfaction.

---

Legal Foundation: Negligent Credentialing & Corporate Liability

The historical legal doctrine of charitable immunity protected hospitals from liability for physician negligence. However, the landmark ruling in Darling v. Charleston Community Memorial Hospital (IL 1965) established the doctrine of Corporate Negligence.

Legal Precedent: Under corporate negligence, hospitals owe an independent, non-delegable duty directly to patients to ensure that medical staff members are competent. If a hospital credentials or re-privileges a physician despite knowing (or failing to discover through reasonable due diligence) that the physician is incompetent or impaired, the hospital can be held liable for Negligent Credentialing.

---

Health Care Quality Improvement Act (HCQIA) of 1986

To encourage meaningful professional peer review and protect physicians who participate in peer review from costly antitrust lawsuits by disciplined colleagues, Congress enacted the Health Care Quality Improvement Act (HCQIA) of 1986 (42 U.S.C. § 11101 et seq.).

HCQIA Standards for Peer Review Immunity

For a healthcare entity and its peer review committee members to qualify for legal immunity from monetary damages under HCQIA, the peer review action must meet four statutory standards:

1. Action taken in the reasonable belief that it was in furtherance of quality health care.
2. Action taken after a reasonable effort to obtain the facts of the matter.
3. Action taken after adequate notice and hearing procedures are afforded to the physician (procedural due process).
4. Action taken in the reasonable belief that the action was warranted by the facts known.

---

National Practitioner Data Bank (NPDB) Compliance

Created under HCQIA, the National Practitioner Data Bank (NPDB) is a confidential electronic repository of information on medical malpractice payments and adverse actions taken against healthcare practitioners.

Mandatory NPDB Querying Triggers

Healthcare entities (hospitals) MUST query the NPDB under the following mandatory circumstances:

1. When a practitioner submits an application for initial medical staff appointment or clinical privileges.
2. Every two years during the formal recredentialing / reappointment process.
3. Whenever a practitioner requests new, expanded, or modified clinical privileges.

Mandatory NPDB Reporting Triggers & Timelines

Healthcare entities must submit reports to the NPDB within 30 days of the triggering action:

---

Real Healthcare Scenario: Credentialing Failure & NPDB Non-Query

Real Clinical Scenario: A community hospital recruits an orthopedic surgeon. The Medical Staff Office collects the application but fails to execute a mandatory primary source verification query to the NPDB, relying instead on a copy of a state medical license provided by the physician. The surgeon is granted full surgical privileges. Over the next 14 months, the surgeon performs three spinal fusion procedures resulting in permanent paralysis. Subsequent litigation reveals that the surgeon had their clinical privileges revoked at an out-of-state hospital due to severe substance impairment and surgical negligence, an action reported to the NPDB two years prior. In the resulting lawsuit, the plaintiffs sue the surgeon for medical malpractice and sue the hospital for Negligent Credentialing. Because the hospital failed to conduct mandatory NPDB querying and primary source verification, the hospital is held directly liable under corporate negligence, resulting in a multi-million-dollar non-insurable judgment and mandatory reporting of the hospital to regulatory authorities.