Department of Health and Human Servces
OFFICE OF
INSPECTOR GENERAL
CONTROLS OVER AUTHORIZED AGENTS
NATIONAL PRACTITIONER DATA BANK
MANAGEMENT ADVISORY REPORT
Vl=.
Richard P. Kusserow
INSPECTOR GENERA
"0 
AUGUST 1991
03a _- 
Department of Health and Human Servces
OFFICE OF
INSPECTOR GENERAL
CONTROLS OVER AUTHORIZED AGENTS
NATIONAL PRACTITIONER DATA BANK
MANAGEMENT ADWSORY REPORT
v..
Richard P. Kusserow
INSPECTOR GENERA
"0 
~03a OEI-12-90-00530 EXECUTIVE SUMMAR Y
PUROSE
The purpose of this management advisory report is to recommend that the Public
Health Servce (PHS) strengthen controls over authoried agents to assure t1':t
information provided by the National Practitioner Data Bank (Data Bank) is not
misused.
BACKGROUN
Information maintained by the Data Bank is considered confdential and cannot be
in the
disclosed outside the Department of Health and Human Servces as specifed 
Data Bank regulations, 42 CPR 60.
During planning for the Data Bank staff from the Bureau of Health Professions
PHS, expressed concern to us regarding the confidentiality of the Data Bank
information that was provided to "authoried agents." Specifcally, there was concern
that the apparent growth of tlrs industry could lead to "authoried agents" that did
not always follow appropriate procedures or standards involving the handlig of Data
Bank information.
FIINGS
We determined that controls- over authorized agents are insuffcient. Procedural
guidelines and forms relating to agents do not adequately address the issue of
confidentiaIIy.
RECOMMATIONS
We recommended that PHS implement policies to assure that authorized agents are
security measures to assure the
reputable and that such agents utile appropriate 
confidentiality of Data Bank information. We also recommended that Data Bank
forms be modified to describe the confidentiality requirement.
COMMENTS
PHS concurred with most of the recommendations in our draft report. PHS did not
agree to the recommendation that, if the agent is a company or organization, it must
be incorporated, licensed or otherwse legaIIy permitted to do business. Based on
the PHS response, we have modified our recommendation.
Because the PHS response to our recommendation that they modify the Data Bank
response form is not clear, we are asking for clarification. ............................................. 
. ..  ..  ..  ..  ..  ..  ...   ...   ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ....    ...   ..  ..  ..  ..  ..  ..  . . 
TABLE CONTENTS
EXECU SUMY
INODUCTON. . .  . . . . . . . . I
. . . . . . . . . . . . . . . I
Purpose
. . . . . . . . . . . . . . I
Background. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
FIINGS. . 
. . . . . . . . . . . . . . 3
RECOMMNDATIONS
. . . . . . 5
APPENDIX A ...
INTRODUCTION
PUROSE
The purpose of tlrs management advisory repon IS to recommend that the Public
Health Servce (PHS) strengthen controls over authoried agents to assure that
information provided by the Data Bank is not misused.
BACKGROUN
Information maintained by the Data Ban is considered confdential and cannot be
disclosed outside the Department except as specifed in the Data Bank regulations
42 CFR 60. According to Section 60.I3 " Personsor entities wlrch receive
information from the Data Bank either directly or from another part must use 
solely with respect to the purpose for wlrch it was provided." For each violation of
confidentiality, civi money penalty of up to $10 000 can be levied.
During planning for the Data Bank, staff form the Bureau of Health Professions
PHS, expressed concern to us regarding the confdentiality of Data Bank information
that was provided to "authoried agents" who queried the Data Bank on behalf of
health care entities. Specifcally, there was concern that the apparent growth of the
credential verification industry could lead to "authoried agents" that did not always
Data Bank
foIIow appropriate procedures or standards involvig the handling of 
information.
Authori 
Agents
Sections 60.10 and 60.11 of the Data Bank regulations aIIow access to the Data Bank
by certain persons or entities, or their authoried agents. According to the Data
Bank Guidebook, an authoried agent is " an individual or organization (e.g. county
medical society, State hospital association), which the health care entity or individual
designates to request information from the Data Bank on its behalf.." However
authorized agent" is not restricted by the Guidebook or defied in
since the term "
, it is possible that an authoried agent could be a credential
the statute or regulation
verification business or individual engaged in activities completely unrelated to
credential verification.
Concerns regarding the integrty of authorized agents were expressed in comments
that the PHS received in response to the March 21, 1988 Notice of Proposed
Rulemaking (NPRM), National Practitioner Data Bank. These concerns were set
forth in the October I7
, I989 final regulation as foIIows: Numerous respondents questioned what information would be given in response to
authorized agents' requests concerning physicians, dentists or other health care
practitioners...The majority of the respondents expressed concern over verification of
the identity of individuals and entities who request information from the Data
Bank..The Secretary shares these concerns about maintaining the confidentiality of
the information in the Data Bank and wi take measures to insure the proper
release of this information. Since the Data Bank has not been established at this
time, it is impossible to detail the precise procedures wlrch wiII be used for the
verification of the identity of the requesters. At the time of the operation of the
Data Bank, the Department intends to provide tlrs information to the public in the
form of guidelines... " -
",,-
FINDINGS
Ins
autri Agen 
Conlls Over 
Ar 
The only guidelines concerning the use of authoried agents are found on page I5 of
the Data Bank Guin book, as follows:
An entity or individual that is eligible to request inormation
from the Data Bank, may, at its discretion, use an agent to
represent it for purposes of requesting information..Before an
agent may submit request for inormation; the entity or
individual must register the agent with the Data Bank at any
time by wrting to the Data Bank...
The "registration" information required by the Guidebook for any authoried agent 
limited to basic inormation relating to their name, address, telephone number
authorized signature and effective date of registration. Tls inormation is provided
by letter to the Data Bank by the entity or individual who wiII be using the
authoried agent.
The registration procedure does not fuIIy address the concern over the identity of
authorized agents that was expressed by respondents to the Data Bank regulation.
The policy for "registration" does not assure that an authoried' agent is responsible
or reputable. While hospitals or other established entities may not warrant such
concern, the PHS wi have no assurances that an authoried agent, for which there
is no restrictive definition, wil be accountable.
, the current Data Bank forms do not address the issue of keeping
In addition
information confdential. According to the Guidebook, when an entity, individual or
authoried agent requests inormation for the Data Ban it must use Offce of
Management and Budget (OMB) Form #09I5-0126, Request For Information
Disclosure. This form contains a certification, s follows:
I certify that the requesting entity identified in Section A of
this form is authoried, under the provisions of P.L. 99-660, as
amended, as specified in 42 CFR Part 60, to request and
receive information from the Data Ban. I further certify that
the information provided on this form is true and complete
and that the requesting entity identified in Section A of tlrs
form has authoried me to request this inormation.
The certification is foIIowed by a ''warning'' that "Any person who knowing makes a
false statement or misrepresentation to the Data Bank is subject to a fine and
tatute.
imprisonment 'mnei' Feckral  The form entitled "Response To Inormation Disclosure Request" does not mention
the confidentiality requirements of the law. Tls form of course, is used to transmit
Data Bank information to both authoried agents and health care entities. ':-:',:'
RECOMMENDATIONS
In order to strengthen controls over the use of authoried agents, the PHS should
consider requirng such agents to meet certain conditions. We have the following
suggestions:
If the agent is incorporated, licensed or otherwse legaIIy permtted by a State to
do business, require that the health care entity determine whether any complaints
or lawsuits have been fied or if any investigations or sanctions have been
instituted against the prospective agent.
2. The proposed agent must possess adequate, i.e. secure, storage facilties and
have procedures in place to insure meeting confdentiality practices (e.g.
background checks on employees).
3. There should be a certifcation from the health cae entity that it has supplied
the authorized agent with a copy of the regulation and guidelines relating the
disclosure of Data Bank information.
As an added protection to the confdentiality of DatI; Ban inormation, we
recommend that the form currently used by the Data Bank for responding to queries
be modified to include language describing the confidentiality requirement and the
penalty provision for violating the requirement. Also, PHS may wish to add a
statement to the Data Bank query form (OMB # 0915-0126) indicating that the
authorized agent and entity understand that the inormation must be used solely with
respect to the purpose it is being provided, and for each violation of confdentiality,
a civi money penalty of up to $IO,OOO can be levied.
PHS Resoonse
The PHS concurred with most of our recommendations. According to PHS, the next
time the Guidebook is revised, it wiII require that health care entities assure, in their
agreements with authorized agents, that there be physical, technical and
administrative safeguards to assure the confidential and safe treatment of information
received in behalf of entities. The Guidebook wiII also be revised to require that the
registration letter from a health care entity to the Data Bank include a statement
that the health care entity has supplied the agent with a copy of the regulation and
, during
guidelines relating to the disclosure of Data Bank information. In addition
the next revision of the form "Request for Information Disclosure " PHS wiII include
a statement concerning confidentiality and the penalty for disclosing information in
violation of the law. --- _._.-
... --'.-- . .._ ._--
The PHS response to another recommendation is not clear. We recommended that
as an added protection to the confidentiality of Data Bank information, the form
currently used for responding to queries be modified to include language describing
the confidentiality requirement. The second paragraph of the PHS transmittal
memorandum suggests agreement with the recommendation. However, the third
paragraph of the transmittal memorandum outlies the PHS corrective action on
those recommendations to which they have concurred; yet no specifc corrective
action is mentioned for the form used to respond to queries. Furthermore, on page
3 (three) of the PHS detailed response to our recommendations, PHS indicates that
they have " already covered the handlig of information when it is disclosed. Each
response...includes a cover sheet notifyng the recipient that the information is
confidential and warning of penalties.
If PHS is disagreeing with our recommendation, we wish to point out that a cover
sheet can be easily separated from the response form and that if the statements are
printed on the response form itself, then anyone who receives a copy of the response
form wiII be on notice that the inormation is confdential and may not be used for
non-Data Bank purposes.
FinaIIy, PHS disagreed with our earlier recommendation that if an authoried agent
was a company or organiztion, it should be incorporated, licensed or otherwse
legaIIy permitted by a State to do business. We agree with PHS that licensure
, per se, would not assure that the agent is reputable.
incorporation or other approval
However, what licensure, etc. might do is provide an additional source of information
for checking up on a particular business, i.e. have any complaints been fied or any
investigations been conducted and how have they been resolved. Therefore, we
suggest that PHS should consider revising the Handbook guidelies to indicate that if
a prospective agent is licensed, etc. the health care entity determine if any
complaints or lawsuits have been filed or if any investigations or sanctions have been
instituted. We have modified our recommendation accordingly.
A copy of the PHS response is attached as Appendix A (). 
APPENDIX A
.n -
MA 2 9 1991
eale
From Assistant Secretary for Health
(OIG) Management
PRS Comments on Office of Inspector General
Bank - Use of
Advisory Report "National Practitioner Data
Sub,eC1
OEI-12-90-00530
Authorized Agents ,
Inspector General, OS
Attached are the PHS comments on the subject OIG management
advisory report.
s recommendations that in order to
We concur with the report
strengthen controls over the use of authorized agents, PRS should
(1) the agent
require them to meet the following conditions: 
must possess adequate and secure storage facilities and have
procedures in place to meet confidentiality practices, (2) there
it, has
should be a certification from the health care entity that  and
supplied the authorized agent with a copy of the regulation '
ide1i es relating to the disclosure of Data Bank information,
and (3) that the Data Bank form for responding to queries be
modified to include language describlng the confidentiality
requirement and the penalty for viulating the requirement.
s Guide
National Practitioner Data Bank User
We will update the 
to provide additional guidance and direction in the selection and
monitoring of authorized agents engaged by health catrhee  etnhtiirdties,
(2) above. Regarding 
as recommended under (1) and 
recommendation cited above, during the next revision of the form
, we will include a statement
Request for Information Disclosures
concerning confidentiality and the penalty for disclosing
information in violation of the law.
We disagree with the recommendation that an agent must be
incorporated, licensed or otherwise l' eaglarellayd yp erremqitutireed  tbhya at  tShteate
ble.
to do business. Existing procedures
agents must be identifiable, locatable. accountable, and suena ts
We believe these goals are served by the current arrange
of agents.
which require the registratio
Iv 
mes O. Mason D., Dr.
A . PUBLIC HEATH SERVICE PHS COMMENTS ON
OFFICE OF INSPECTOR GENERA OIG MAAGEMNT
BA -
ADVISORY REPORT "NATIONAL PRACTITIONER DATA 
USE OF AUTORIZED AGENTS"
(OEI-12-90-00530)
General Comments
While our overall concerns regarding confidentiality are covered
National Practitioner Data Bank User s Guide
in the existing 
(Guidebook) the Public Health Service agrees that a health care
enti ty' s election to use an authorized agent raises particular
concerns. 
Accordingly, we intend to address these issues in
Guidebook to provide additional
subsequent editions of the 
guidance and direction in the selection and monitoring of
authorized agents engaged by health care entities.
OIG Recommendation
In order to strengthen controls over the use of authorized
agents, the Public Health Service should consider requiring
such agents to meet certain conditions. We have the
following suggestions.
If a company or organization, the agent must be
incorporated, licensed or otherwise legally permtted
by a
State to do business.
PHS Comment
It is difficult to see what additional measure of protection will
be provided by such a requirement. We appreciate the point of 
the recommendation: the agents must be identifiable, locatable,
accountable, a d, indeed, suable. As a matter of fact, we
believe that these goals are served by the present arrangements.
Existing procedures require the registration of agents. Any
querying entity using an agent must advise the Data Bank of the
numr of the 
complete name, address, and telephone  agent. The
agents are formally accountable to the institutions that engage
them, and are clearly identified to the Data Bank. The technical
status of incorporation or licensure would seem to add little in
the way of accountability. Such requirements as those suggested
reputable.
would not assure that the agent is "
OIG Recommendation
The proposed agent must possess adequate, i. e., secure,
insure
storage facilities and have procedures in place to 
meeting confidentiality practices (e. g., background checks
on employees). PHS Comment
We agree that agents should possess such facilities and have
other procedures in place to insure their meeting confidentiality
practices. While we believe it is not necessary to impose these
requirements formally by regulation, we will include in our next
Guidebook technical guidance for those entities
eedixtioen ocf tuhe ting agreements with agents.
Specifically, we will recommend that the entities require, in
their agreements with agents, that there be physical, technical
nd administrative safeguards to assure the confidential and safe
treatment of information received on behalf of the entities. 
will also recommend that these agreements (1) explicitly prohibit
the agent from using the information obtained in Data Bank trans-
actions for any other purpose, (2) require that this information
(3) permt
be segregated from the agent' s other information, and 
immediate revocation of the agreement for non-compliance with
these conf identiali 
ty provisions.
OIG Recommendation
There should be a certification from the health care
entity that it has supplied the authorized agent with a
copy of the regulation and guidelines relating to the
disclosure of Data Bank information.
PHS Comment
Guidebook we will add instructions for
reegn wie sretviese rouir ng an agent with the Data Bank. We will include a
requirement that the registration letter from a health care
entity to the Data Bank include a statement that the health care
entity has supplied the agent with a copy of the regulation and
guidelines relating to the disclosure of Data Bank informtion.
Guidebook
We expect to complete the revision of the 
March 1992.
OIG Recommendation
As an added protection to the confidentiality of Data Bank
information, we recommend that the form currently used by
the Data Bank for responding to queries be modified to
include language describing the confidentiality requirement
and the penalty provision for violating the requirement.
Also, you may wish to add a statement to the Data Bank query
form indicating that the authorized agent and entity
understand that the information must be used solely with
respect to the purpose it is being provided, and for each
violation of confidentiality, a civil money penalty of up to
$10, 000 can be levied. PHS Comment
This is effectively being done, although the relevant material is
not actually printed on the forms.
The instructions which must be used in completing the Request for
ly address the issue of
Information Disclosure form c1ea
confidentiality and describe the penalty for disclosing
When we next revise the
information in violation of the law. 
fionrm,  wte hwilil sinc lurdee ang expalicritd sta.t ement on the form regarding
his, although there are form size constraints that may limit us
More importantly, we have already covered the handling of 
Bank
information when it is disclosed. Each response by the Data 
informtion 
to a request for  includes a cover sheet notifying the
warning of
recipient that the informtion is confidential and 
penal ties to be imposed.
purose intended
We believe these notices effectively serve the 
by the recommended actions.