Department of Health and Human Servces

OFFICE OF

INSPECTOR GENERAL

CONTROLS OVER AUTHORIZED AGENTS

NATIONAL PRACTITIONER DATA BANK

MANAGEMENT ADVISORY REPORT

Vl=.

Richard P. Kusserow

INSPECTOR GENERA

"0 

03a AUGUST 1991
Department of Health and Human Servces

OFFICE OF

INSPECTOR GENERAL

CONTROLS OVER AUTHORIZED AGENTS

NATIONAL PRACTITIONER DATA BANK

MANAGEMENT ADWSORY REPORT

v..

Richard P. Kusserow

INSPECTOR GENERA

"0 

~03a

_

OEI-12-90-00530
EXECUTIVE SUMMAR Y

PUROSE

The purpose of this management advisory report is to recommend that the Public

Health Servce (PHS) strengthen controls over authoried agents to assure t1':t

information provided by the National Practitioner Data Bank (Data Bank) is not

misused.

BACKGROUN

Information maintained by the Data Bank is considered confdential and cannot be

disclosed outside the Department of Health and Human Servces as specifed in the

Data Bank regulations, 42 CPR 60.

During planning for the Data Bank staff from the Bureau of Health Professions

PHS, expressed concern to us regarding the confidentiality of the Data Bank

information that was provided to "authoried agents." Specifcally, there was concern

that the apparent growth of tlrs industry could lead to "authoried agents" that did

not always follow appropriate procedures or standards involving the handlig of Data

Bank information.

FIINGS

We determined that controls- over authorized agents are insuffcient. Procedural

guidelines and forms relating to agents do not adequately address the issue of

confidentiaIIy.

RECOMMATIONS

We recommended that PHS implement policies to assure that authorized agents are

reputable and that such agents utile appropriate security measures to assure the

confidentiality of Data Bank information. We also recommended that Data Bank

forms be modified to describe the confidentiality requirement.

COMMENTS

PHS concurred with most of the recommendations in our draft report. PHS did not

agree to the recommendation that, if the agent is a company or organization, it must

be incorporated, licensed or otherwse legaIIy permitted to do business. Based on

the PHS response, we have modified our recommendation.

Because the PHS response to our recommendation that they modify the Data Bank

response form is not clear, we are asking for clarification.
TABLE CONTENTS

EXECU SUMY

INODUCTON. . . 

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

. . . . . . . . I

Purpose

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

. . . . . . . . . . . . . . . I

Background. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I

FIINGS. . 

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

. . . . . . . . . . . . . . 3

RECOMMNDATIONS

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

. . . . . . 5

APPENDIX A

............................................. 
INTRODUCTION

PUROSE

The purpose of tlrs management advisory repon IS to recommend that the Public

Health Servce (PHS) strengthen controls over authoried agents to assure that

information provided by the Data Bank is not misused.

BACKGROUN

Information maintained by the Data Ban is considered confdential and cannot be

disclosed outside the Department except as specifed in the Data Bank regulations

42 CFR 60. According to Section 60. I3 "

...

Personsor entities wlrch receive

information from the Data Bank either directly or from another part must use 

solely with respect to the purpose for wlrch it was provided." For each violation of

confidentiality, civi money penalty of up to $10 000 can be levied.

During planning for the Data Bank, staff form the Bureau of Health Professions

PHS, expressed concern to us regarding the confdentiality of Data Bank information

that was provided to "authoried agents" who queried the Data Bank on behalf of

health care entities. Specifcally, there was concern that the apparent growth of the

credential verification industry could lead to "authoried agents" that did not always

foIIow appropriate procedures or standards involvig the handling of Data Bank

information.

Authori Agents

Sections 60. 10 and 60.11 of the Data Bank regulations aIIow access to the Data Bank

by certain persons or entities, or their authoried agents. According to the Data

Bank Guidebook, an authoried agent is " an individual or organization (e.g. county

medical society, State hospital association), which the health care entity or individual

designates to request information from the Data Bank on its behalf.." However

since the term "authorized agent" is not restricted by the Guidebook or defied in

the statute or regulation, it is possible that an authoried agent could be a credential

verification business or individual engaged in activities completely unrelated to

credential verification.

Concerns regarding the integrty of authorized agents were expressed in comments

that the PHS received in response to the March 21, 1988 Notice of Proposed

Rulemaking (NPRM), National Practitioner Data Bank. These concerns were set

forth in the October I7, I989 final regulation as foIIows:
Numerous respondents questioned what information would be given in response to

authorized agents' requests concerning physicians, dentists or other health care

practitioners...The majority of the respondents expressed concern over verification of

the identity of individuals and entities who request information from the Data

Bank..The Secretary shares these concerns about maintaining the confidentiality of

the information in the Data Bank and wi take measures to insure the proper

release of this information. Since the Data Bank has not been established at this

time, it is impossible to detail the precise procedures wlrch wiII be used for the

verification of the identity of the requesters. At the time of the operation of the

Data Bank, the Department intends to provide tlrs information to the public in the

form of guidelines...
FINDINGS

Conlls Over autri Agen Ar Ins

The only guidelines concerning the use of authoried agents are found on page I5 of

the Data Bank Guin book, as follows:

An entity or individual that is eligible to request inormation

from the Data Bank, may, at its discretion, use an agent to

represent it for purposes of requesting information..Before an

agent may submit request for inormation; the entity or

individual must register the agent with the Data Bank at any

time by wrting to the Data Bank...

The "registration" information required by the Guidebook for any authoried agent 

limited to basic inormation relating to their name, address, telephone number

authorized signature and effective date of registration. Tls inormation is provided

by letter to the Data Bank by the entity or individual who wiII be using the

authoried agent.

The registration procedure does not fuIIy address the concern over the identity of

authorized agents that was expressed by respondents to the Data Bank regulation.

The policy for "registration" does not assure that an authoried' agent is responsible

or reputable. While hospitals or other established entities may not warrant such

concern, the PHS wi have no assurances that an authoried agent, for which there

is no restrictive definition, wil be accountable.

In addition, the current Data Bank forms do not address the issue of keeping

information confdential. According to the Guidebook, when an entity, individual or

authoried agent requests inormation for the Data Ban it must use Offce of

Management and Budget (OMB) Form #09I5-0126, Request For Information

Disclosure. This form contains a certification, s follows:

I certify that the requesting entity identified in Section A of

this form is authoried, under the provisions of P.L. 99-660, as

amended, as specified in 42 CFR Part 60, to request and

receive information from the Data Ban. I further certify that

the information provided on this form is true and complete

and that the requesting entity identified in Section A of tlrs

form has authoried me to request this inormation.

The certification is foIIowed by a ''warning '' that "Any person who knowing makes a

false statement or misrepresentation to the Data Bank is subject to a fine and

imprisonment 'mnei' Feckral tatute.

 ,,
The form entitled "Response To Inormation Disclosure Request" does not mention

the confidentiality requirements of the law. Tls form of course, is used to transmit

Data Bank information to both authoried agents and health care entities.
RECOMMENDATIONS

In order to strengthen controls over the use of authoried agents, the PHS should

consider requirng such agents to meet certain conditions. We have the following

suggestions:

If the agent is incorporated, licensed or otherwse legaIIy permtted by a State to

do business, require that the health care entity determine whether any complaints

or lawsuits have been fied or if any investigations or sanctions have been

instituted against the prospective agent.

2. The proposed agent must possess adequate, i.e. secure, storage facilties and

have procedures in place to insure meeting confdentiality practices (e.g.

background checks on employees).

3. There should be a certifcation from the health cae entity that it has supplied

the authorized agent with a copy of the regulation and guidelines relating the

disclosure of Data Bank information.

As an added protection to the confdentiality of DatI; Ban inormation, we

recommend that the form currently used by the Data Bank for responding to queries

be modified to include language describing the confidentiality requirement and the

penalty provision for violating the requirement. Also, PHS may wish to add a

statement to the Data Bank query form (OMB # 0915-0126) indicating that the

authorized agent and entity understand that the inormation must be used solely with

respect to the purpose it is being provided, and for each violation of confdentiality,

a civi money penalty of up to $IO,OOO can be levied.

PHS Resoonse

The PHS concurred with most of our recommendations. According to PHS, the next

time the Guidebook is revised, it wiII require that health care entities assure, in their

agreements with authorized agents, that there be physical, technical and

administrative safeguards to assure the confidential and safe treatment of information

received in behalf of entities. The Guidebook wiII also be revised to require that the

registration letter from a health care entity to the Data Bank include a statement

that the health care entity has supplied the agent with a copy of the regulation and

guidelines relating to the disclosure of Data Bank information. In addition, during

the next revision of the form "Request for Information Disclosure " PHS wiII include

a statement concerning confidentiality and the penalty for disclosing information in

violation of the law.

::,:
The PHS response to another recommendation is not clear. We recommended that

as an added protection to the confidentiality of Data Bank information, the form

currently used for responding to queries be modified to include language describing

the confidentiality requirement. The second paragraph of the PHS transmittal

memorandum suggests agreement with the recommendation. However, the third

paragraph of the transmittal memorandum outlies the PHS corrective action on

those recommendations to which they have concurred; yet no specifc corrective

action is mentioned for the form used to respond to queries. Furthermore, on page

3 (three) of the PHS detailed response to our recommendations, PHS indicates that

they have "

...

already covered the handlig of information when it is disclosed. Each

response...includes a cover sheet notifyng the recipient that the information is

confidential and warning of penalties.

If PHS is disagreeing with our recommendation, we wish to point out that a cover

sheet can be easily separated from the response form and that if the statements are

printed on the response form itself, then anyone who receives a copy of the response

form wiII be on notice that the inormation is confdential and may not be used for

non-Data Bank purposes.

FinaIIy, PHS disagreed with our earlier recommendation that if an authoried agent

was a company or organiztion, it should be incorporated, licensed or otherwse

legaIIy permitted by a State to do business. We agree with PHS that licensure

incorporation or other approval, per se, would not assure that the agent is reputable.

However, what licensure, etc. might do is provide an additional source of information

for checking up on a particular business, i.e. have any complaints been fied or any

investigations been conducted and how have they been resolved. Therefore, we

suggest that PHS should consider revising the Handbook guidelies to indicate that if

a prospective agent is licensed, etc. the health care entity determine if any

complaints or lawsuits have been filed or if any investigations or sanctions have been

instituted. We have modified our recommendation accordingly.

A copy of the PHS response is attached as Appendix A

. . .._ .__._.
APPENDIX A

eale

MA 2 9 1991 .n -

From Assistant Secretary for Health

Sub,eC1

PRS Comments on Office of Inspector General

Advisory Report " National Practitioner Data

Authorized Agents , OEI-12-90-00530

(OIG) Management

Bank - Use of

Inspector General, OS

Attached are the PHS comments on the subject OIG management

advisory report.

We concur with the report s recommendations that in order to

strengthen controls over the use of authorized agents, PRS should

require them to meet the following conditions: 

(1) the agent

must possess adequate and secure storage facilities and have

procedures in place to meet confidentiality practices, (2) there

should be a certification from the health care entity that 

it, has

supplied the authorized agent with a copy of the regulation ' and

ide1i es relating to the disclosure of Data Bank information,

and (3) that the Data Bank form for responding to queries be

modified to include language describlng the confidentiality

requirement and the penalty for viulating the requirement.

We will update the National Practitioner Data Bank User s Guide

to provide additional guidance and direction in the selection and

monitoring of authorized agents engaged by health care entities,

as recommended under (1) and (2) above. Regarding the third

recommendation cited above, during the next revision of the form

Request for Information Disclosures , we will include a statement

concerning confidentiality and the penalty for disclosing

information in violation of the law.

We disagree with the recommendation that an agent must be

incorporated, licensed or otherwise legally permitted by a State

to do business. Existing procedures' already require that the

agents must be identifiable, locatable. accountable, and sua 

ble.

We believe these goals are served by the current arrange

ents

which require the registratio of agents.

(). 

Iv 

mes O. Mason D., Dr.

A .
PUBLIC HEATH SERVICE PHS COMMENTS ON

OFFICE OF INSPECTOR GENERA OIG MAAGEMNT

ADVISORY REPORT " NATIONAL PRACTITIONER DATA BA -

USE OF AUTORIZED AGENTS"

(OEI-12-90-00530)

General Comments

While our overall concerns regarding confidentiality are covered

in the existing National Practitioner Data Bank User s Guide

(Guidebook) the Public Health Service agrees that a health care

enti ty ' s election to use an authorized agent raises particular

concerns. Accordingly, we intend to address these issues in

subsequent editions of the Guidebook to provide additional

guidance and direction in the selection and monitoring of

authorized agents engaged by health care entities.

OIG Recommendation

In order to strengthen controls over the

agents, the Public Health Service should

such agents to meet certain conditions.

following suggestions.

use of authorized

consider requiring

We have the

If a company or organization, the agent must be incorporated, licensed or otherwise legally permtted

State to do business.

by a

PHS Comment

It is difficult to see what additional measure of protection will

be provided by such a requirement. We appreciate the point of 

the recommendation: the agents must be identifiable, locatable,

accountable, a d, indeed, suable. As a matter of fact, we

believe that these goals are served by the present arrangements.

Existing procedures require the registration of agents. Any

querying entity using an agent must advise the Data Bank of the

complete name, address, and telephone numr of the agent. The

agents are formally accountable to the institutions that engage

them, and are clearly identified to the Data Bank. The technical

status of incorporation or licensure would seem to add little in

the way of accountability. Such requirements as those suggested

would not assure that the agent is " reputable.

OIG Recommendation

The proposed agent must possess adequate, i. e., secure,

storage facilities and have procedures in place to insure

meeting confidentiality practices (e. g., background checks

on employees).
PHS Comment

We agree that agents should possess such facilities and have

other procedures in place to insure their meeting confidentiality

practices. While we believe it is not necessary to impose these

requirements formally by regulation, we will include in our next

edition of the Guidebook technical guidance for those entities

executing agreements with agents.

Specifically, we will recommend that the entities require, in

their agreements with agents, that there be physical, technical

nd administrative safeguards to assure the confidential and safe

treatment of information received on behalf of the entities. 

will also recommend that these agreements (1) explicitly prohibit

the agent from using the information obtained in Data Bank transactions for any other purpose, (2) require that this information

be segregated from the agent' s other information, and (3) permt

immediate revocation of the agreement for non-compliance with these conf identiali ty provisions.

OIG Recommendation

There should be a certification from the health care

entity that it has supplied the authorized agent with a

copy of the regulation and guidelines relating to the

disclosure of Data Bank information.

PHS Comment

en we revise our Guidebook we will add instructions for

registering an agent with the Data Bank. We will include a

requirement that the registration letter from a health care

entity to the Data Bank include a statement that the health care

entity has supplied the agent with a copy of the regulation and

guidelines relating to the disclosure of Data Bank informtion.

We expect to complete the revision of the Guidebook

March 1992.

OIG Recommendation

As an added protection to the confidentiality of Data Bank

information, we recommend that the form currently used by

the Data Bank for responding to queries be modified to

include language describing the confidentiality requirement

and the penalty provision for violating the requirement.

Also, you may wish to add a statement to the Data Bank query

form indicating that the authorized agent and entity

understand that the information must be used solely with

respect to the purpose it is being provided, and for each

violation of confidentiality, a civil money penalty of up to

$10, 000 can be levied.
PHS Comment

This is effectively being done, although the relevant material is

not actually printed on the forms.

The instructions which must be used in completing the Request for

Information Disclosure form c1ea ly address the issue of

confidentiality and describe the penalty for disclosing

information in violation of the law. When we next revise the

form, we will include an explicit statement on the form regarding

his, although there are form size constraints that may limit us in this regard. 

More importantly, we have already covered the handling of 

information when it is disclosed. Each response by the Data Bank

to a request for informtion includes a cover sheet notifying the

recipient that the informtion is confidential and warning of

penal ties to be imposed.

We believe these notices effectively serve the purose intended

by the recommended actions.