GAO 

United States Government Accountability Office

Report to Congressional Addressees

VA HEALTH CARE

Improved Oversight 

and Compliance 

Needed for Physician 

Credentialing and 

Privileging Processes 

January 2010 

GAO-10-26 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

January 2010

VA HEALTH CARE

Improved Oversight and Compliance Needed for 

Physician Credentialing and Privileging Processes

Highlights of GAO-10-26, a report to 

congressional addressees 

VA has policies to ensure that 

physicians have appropriate 

qualifications and clinical abilities 

through the processes of 

credentialing, privileging, and 

continuous monitoring of 

performance. Results of a VA 

investigatory report in 2008 cited 

deficiencies in the Marion, Illinois, 

VA medical center’s (VAMC) 

credentialing and privileging 

processes and oversight of its 

surgical program. This report 

examines VA’s policies and 

guidance to help ensure that 

information about physician 

qualifications and performance is 

accurate and complete, VAMCs’ 

compliance with selected VA 

credentialing and privileging 

policies, and their implementation 

of VA policies to continuously 

monitor performance. GAO 

reviewed VA’s policies, interviewed 

VA officials, and reviewed a 

judgmental sample of 30 

credentialing and privileging files at 

each of six VAMCs that GAO 

visited. GAO selected the files to 

ensure inclusion of highly paid 

specialties, newly hired physicians, 

and other physician characteristics. 

GAO selected the judgmental 

sample of six VAMCs based on 

geographic balance and other 

factors. 

What GAO Recommends

GAO recommends that VA develop 

a formal mechanism to 

systematically review VAMC 

credentialing and privileging files 

and performance monitoring for 

compliance with VA policies. VA 

agreed with GAO’s findings and 

recommendations. 

VA’s policies and guidance on credentialing, privileging, and continuous 

monitoring help ensure the collection of accurate and complete information 

about physician professional qualifications, clinical abilities, and clinical 

performance. These policies and guidance address or exceed relevant 

accreditation standards. Following events at the Marion VAMC, VA made 

policy changes to allow VAMCs to collect more complete and timely 

information on physician licensure, malpractice, and disciplinary actions. 

GAO did not find problems at the six VAMCs visited that mirrored the extent 

of those reported by investigators at the Marion VAMC. However, GAO found 

that VAMC staff did not consistently follow VA’s credentialing and privileging 

policy requirements selected for review. GAO selected requirements that must 

be verified each time a physician goes through the credentialing process and 

must be recorded in VA’s Web-based credentialing database. For example, 29 

of the 180 credentialing and privileging files reviewed lacked proper 

verification of state medical licensure. In addition, the VAMCs did not identify 

instances when physicians appeared to have omitted required information on 

their applications. For example, GAO identified 21 files where required 

malpractice information was not disclosed by physicians and was not 

detected by VAMCs. GAO identified several of these cases in an external 

database of malpractice settlements and judgments that VAMCs should 

review. Finally, VA policies lacked sufficient internal controls, such as 

specifying how compliance should be assessed, to identify and correct 

problems with VAMCs’ noncompliance with credentialing and privileging 

policies. 

Compliance with Credentialing and Privileging Requirements at Six VAMCs

Proper verification of information provided by physicians

Type of information 

Files with 

proper verification

Files lacking

proper verification Total files reviewed

State medical licenses 151 29 180

Malpractice 52 38 90

Identification of nondisclosures on physician applications 

Type of information Apparent disclosure

Evidence of 

nondisclosure Total files reviewed

State medical licenses 168 12 180

Malpractice 159 21 180

Source: GAO analysis of documentation in VAMCs’ credentialing and privileging files. 

Note: Only 90 of 180 physicians reported a malpractice allegation or claim. 

The six VAMCs GAO visited also exhibited gaps in implementing VA policies 

and guidance to continuously monitor physician performance. All six VAMCs 

either failed to document the collection of physician performance information 

or collected data that were insufficient to adequately gauge performance. In 

addition, despite VA guidance, confusion over the proper usage of protected 

physician performance information persisted at the VAMCs GAO visited. Four 

of the six VAMCs inappropriately used protected information in privileging 

decisions—a violation of VA policy that may result in public disclosure and 

render some privileging decisions subject to challenge.

View GAO-10-26 or key components.

For more information, contact Randall B. 

Williamson at (202) 512-7114 or 

williamsonr@gao.gov. 
Page i GAO-10-26 VA Credentialing and Privileging 

Contents 

Letter 1

Background 6 

VA’s Policies and Guidance Help Ensure Accurate Information on 

Physician Qualifications, but One Policy May Not Be an 

Effective Use of Resources 11 

Credentialing and Privileging at Selected VAMCs Lacks Consistent 

Compliance with VA Policy, Clear Documentation in VetPro, and 

Comprehensive Oversight by VISN Officials 17 

Gaps in Continuous Monitoring of Physician Performance Existed 

at Selected VAMCs and Officials Continued to Use Performance 

Information Inappropriately 27 

VA Has Begun to Implement Its Plan to Improve Oversight for 

VAMC Surgical Programs by Creating Resource Standards for 

Surgical Procedures 32 

Conclusions 37 

Recommendations for Executive Action 38 

Agency Comments 38 

Appendix I Scope and Methodology 41 

Appendix II Comments from the Department of Veterans 

Affairs 47 

Appendix III GAO Contact and Staff Acknowledgments 50 

Tables 

Table 1: Selected Joint Commission Standards, and Corresponding 

VA Policies, for Physician Credentialing 12 

Table 2: Selected Joint Commission Standards and Corresponding 

VA Policy and Guidance for Continuous Monitoring of 

Physician Performance 14 

Table 3: Compliance with Selected VA Documentation 

Requirements Used for Physician Credentialing and 

Privileging at Six VA Medical Centers (VAMC) 18 
Table 4: Identification of Compliance with VA Policy Regarding 

Physician Disclosure of Information Prior to Service Chief 

Recommendation at Six VA Medical Centers (VAMC) 20 

Table 5: Service Chief Compliance with VA Documentation Policies 

for Reprivileging Recommendations at Six VA Medical 

Centers (VAMC) 22 

Table 6: Service Documentation of Compliance with Continuous 

Monitoring of Physician Performance at Six VA Medical 

Centers (VAMC) 28 

Table 7: Factors of Clinical Performance Included in Continuous 

Monitoring at Six VA Medical Centers (VAMC), by Service 29 

Table 8: Steps in VA’s Plan to Implement the Operative Complexity 

and Infrastructure Standards Workgroup’s 

Recommendations Regarding Surgical Resource Standards 34 

Figures 

Figure 1: Select VA Organization, Roles, and Responsibilities 7 

Figure 2: Illustration of How VetPro Displays Summary 

Information 23 

Abbreviations 

ACOS associate chief of staff 

CMO chief medical officer 

FPPE Focused Professional Practice Evaluation 

FSMB Federation of State Medical Boards 

NPDB National Practitioner Data Bank 

NSQIP National Surgical Quality Improvement Program 

OIG Office of Inspector General 

OPPE On-Going Professional Practice Evaluation 

VA Department of Veterans Affairs 

VAMC Department of Veterans Affairs medical center 

VISN Veterans Integrated Service Network 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-10-26 VA Credentialing and Privileging 
Page 1 GAO-10-26 VA Credentialing and Privileging 

 

United States Government Accountability Office

Washington, DC 20548 

 

January 6, 2010 

Congressional Addressees 

To help ensure the quality of care provided by its approximately 36,000 

physicians, the Department of Veterans Affairs (VA) requires each VA 

medical center (VAMC) to take specific steps to determine whether 

physicians have the appropriate professional qualifications and clinical 

abilities to care for VA’s patients. This begins with the processes of 

credentialing and privileging before physicians are appointed to a VAMC’s 

medical staff. During the credentialing process, VAMC staff collect and 

review information such as a physician’s professional training, malpractice 

history, peer references, and other components of professional 

background to determine whether physicians have suitable abilities and 

experience for appointment to a VAMC’s medical staff. During the 

privileging process, VAMCs determine which health care services—known 

as clinical privileges—the physician should be allowed to provide. After a 

physician is hired, the credentialing and privileging processes are repeated 

at least every 2 years.1

 VA also requires that VAMCs monitor physicians’ 

clinical performance through the collection and analysis of physicianspecific clinical performance information. VA requires that VAMCs assess 

this clinical performance information to evaluate physicians’ clinical 

competence as they reevaluate physicians’ lists of privileges during the 

reprivileging process. 

Patient deaths between October 2006 and March 2007 at the VAMC in 

Marion, Illinois, prompted an investigation by the VA Office of Inspector 

General (OIG) into the VAMC’s processes for monitoring physician quality. 

The Marion VAMC had experienced a number of deaths after surgical 

procedures; specifically, VA’s surgical quality monitoring program 

reported that seven patients died out of 180 surgical cases between 

October and December 2006. This mortality rate was more than four times 

greater than expected when considering the patients’ physical conditions 

prior to surgery. The VA OIG issued a report in January 2008 that identified 

deficiencies at the facility related to credentialing and privileging of 

1

Physicians must reapply for a position on a facility’s medical staff at least every 2 years, a 

process known as reappointment. After the initial privileging process, each successive 

episode is known as “reprivileging.” 
 

physicians and the process of monitoring surgical care.2 For example, the 

VA OIG found multiple instances where physicians had privileges to 

perform procedures without evidence of competence to perform the 

procedures, and that the surgical program was expanded to include 

complex surgical procedures even though sufficient clinical support 

services, such as 24-hour respiratory therapy, pharmacy, and radiology, 

were not available at the VAMC. Marion VAMC officials also failed to 

adequately address information that a surgeon entered into a voluntary 

agreement with one state medical board to stop practicing medicine in 

that state.3

 The VA OIG recommended that VA make several improvements 

to its credentialing and privileging processes, and implement an oversight 

mechanism to ensure that appropriate clinical support services are 

available for all surgical procedures performed at VAMCs. 

We have also reported on problems with VA’s process for evaluating 

physician performance. In May 2006, we found that six of seven VAMCs we 

visited had problems complying with a privileging requirement4

 because 

officials inappropriately used protected physician performance 

information collected through the facility’s quality management program 

when renewing clinical privileges.5

 This is prohibited under VA policy 

because information collected as part of a facility’s quality management 

program is protected to encourage physicians to report and discuss 

adverse events without fear of punitive action. We recommended that VA 

provide guidance to its VAMCs on how to collect physician performance 

 

2

Department of Veterans Affairs, Office of Inspector General, Healthcare Inspection: 

Quality of Care Issues VA Medical Center, Marion, Illinois, 07-03386-65 (Washington, 

D.C., Jan. 28, 2008). 

3

VA policy requires physicians to possess at least one full, active, current, and unrestricted 

license. 

4

GAO, VA Health Care: Selected Credentialing Requirements at Seven Medical Facilities 

Met, but an Aspect of Privileging Process Needs Improvement, GAO-06-648 (Washington, 

D.C.: May 25, 2006). The other four privileging requirements we reviewed were: (1) verify 

that physicians’ state medical licenses are valid; (2) verify physicians’ training and 

experience; (3) assess physicians’ clinical competence and health status; and (4) consider 

any information provided by a physician related to malpractice allegations or paid claims, 

loss of medical staff membership, loss or reduction of privileges, or any challenges to state 

medical licenses. 

5

While VA requires that VAMCs collect and analyze physician performance information for 

use in the reprivileging process, this performance information must be collected outside of 

a VAMC’s quality management program. VAMCs’ quality management programs consist of 

specified systematic health care reviews carried out in order to improve the quality of 

medical care or the utilization of health care resources at VAMCs. 

Page 2 GAO-10-26 VA Credentialing and Privileging 
 

information that can be used to renew clinical privileges in accordance 

with VA’s policy. In November 2007, we testified that VA had implemented 

our recommendation to provide VAMCs with additional guidance on how 

to collect performance information, but that we did not know the extent of 

compliance at VAMCs.6

Based on events at the Marion VAMC, questions have been raised about 

physician credentialing and privileging processes at VAMCs and whether 

VAMCs are performing surgical procedures that are adequately supported 

by the capabilities of the clinical support services. Explanatory material 

accompanying the fiscal year 2008 appropriation directed that we assess 

VA facilities’ compliance with credentialing and privileging standards.7

 In 

this report we assess (1) the policies and guidance VA has in place to help 

ensure that information about physician professional qualifications, 

clinical abilities, and clinical performance is accurate and complete; 

(2) the extent to which selected VAMCs comply with selected VA 

credentialing and privileging policies for physicians, and the extent to 

which VA helps ensure compliance; (3) the extent to which selected 

VAMCs have implemented VA policies and guidance to continuously 

monitor physician performance; and (4) the extent to which VA has 

oversight mechanisms in place to track that VAMCs are performing 

surgical procedures that match their capabilities. 

To determine the policies and guidance VA has in place to help ensure that 

information about physician professional qualifications, clinical abilities, 

and clinical performance is accurate and complete, we reviewed VA 

policies and guidance on credentialing and privileging and monitoring of 

physician performance, and interviewed VA headquarters officials, 

including the Director, Credentialing and Privileging, who is responsible 

for VA credentialing and privileging policy. We reviewed 2008 

credentialing and privileging accreditation standards issued by The Joint 

Commission (“Joint Commission”), a nonprofit organization that evaluates 

and accredits more than 16,000 health care organizations in the United 

 

6

GAO, VA Health Care: Improvements Made in Physician Privileging Policies, but 

Medical Facility Compliance Has Not Been Assessed, GAO-08-271T (Washington, D.C.: 

Nov. 6, 2007). 

7

H. Committee on Appropriations, 110th Cong., Committee Print on H.R. 2764 / Public 

Law 110-161, Division I, p. 1956 (2008) (Pub. L. No. 110-161, § 4, directed that the 

explanatory statement printed in the Congressional Record on or about December 17, 2007 

shall have the same effect as if it were a joint explanatory statement of a committee of 

conference. See 153 Cong. Rec. H15479 (daily ed. Dec. 17, 2007)). 

Page 3 GAO-10-26 VA Credentialing and Privileging 
 

States, including hospitals. Because state medical boards are responsible 

for the licensure and discipline of physicians, we also conducted a Webbased survey of medical boards in all 50 states and the District of 

Columbia in order to obtain information on the policy of each medical 

board related to the disclosure of physician licensure information.8

 We 

opened the survey on March 19, 2009, and closed it on April 9, 2009, with a 

final response rate of 76 percent. 

To determine the extent to which selected VAMCs comply with selected 

VA credentialing and privileging policies, we visited six VAMCs and 

reviewed credentialing and privileging files for a judgmental sample of 30 

physicians at each VAMC, a total of 180 physician files. For each physician 

file, we examined credentialing and privileging documentation for 

compliance with selected VA policies. We reviewed four credentialing and 

privileging requirements about proper documentation: verification of all 

state medical licenses ever held by a physician, verification of malpractice 

claims, receipt of the minimum number of references, and queries to an 

external database about disciplinary actions taken against physician 

licenses. We also reviewed whether VAMCs reprivileged physicians within 

2 years of the previous privileging process, as required by VA policy. We 

looked for evidence of omissions by physician applicants related to 

medical licenses and malpractice, as well as gaps in background greater 

than 30 days. We also looked for documentation by physician service 

chiefs—officials responsible for physicians providing particular clinical 

services—of the rationale for credentialing and privileging 

recommendations for physicians as is required by VA policy. In addition, 

we interviewed staff responsible for verifying physician-supplied 

information and staff responsible for recommending physician 

appointments or privileges. 

We visited the following VAMCs: Alexandria VAMC (Pineville, Louisiana); 

Edward Hines, Jr. VA Hospital (Hines, Illinois); Lebanon VAMC (Lebanon, 

Pennsylvania); Hunter Holmes McGuire VAMC (Richmond, Virginia); 

Togus VAMC (Augusta, Maine); and VA Montana Health Care System (Fort 

Harrison, Montana). We chose these VAMCs based on a variety of factors, 

including location in metropolitan and nonmetropolitan areas and 

geographic balance. We conducted the site visits between August 2008 and 

February 2009. On the basis of the sample of credentialing and privileging 

files we reviewed at each of the six VAMCs, we can discuss a facility’s 

 

8

We did not survey state boards of osteopathic medicine. 

Page 4 GAO-10-26 VA Credentialing and Privileging 
 

documented compliance for the physician files we reviewed; we cannot 

draw conclusions about the remaining physician files at the VAMCs we 

visited or about the compliance of other VAMCs. 

To determine the extent to which VA helps ensure compliance with its 

credentialing and privileging policies, we reviewed VA policies and GAO 

internal control standards to determine criteria for management 

oversight.9

 To obtain information about the processes in place to oversee 

compliance, we interviewed officials at each of the six Veterans Integrated 

Service Networks (VISN) where we conducted a VAMC site visit.10 We also 

reviewed documents describing the criteria VISNs use to evaluate 

facilities’ credentialing and privileging processes. We analyzed how 

VetPro, VA’s Web-based credentialing database, displays information for 

users and analyzed the information that physicians are asked to input 

directly into VetPro. The information from our site visits cannot be used to 

make generalizations about practices at all VAMCs, and the information 

from our interviews with VISN officials cannot be used to generalize about 

VISN-level oversight. Because our credentialing and privileging file review 

included reviewing information in VetPro, we also assessed the database’s 

reliability. To do this, we examined relevant documentation and 

interviewed VA headquarters officials about measures VA takes to ensure 

the reliability of information in VetPro. On the basis of our review, we 

determined that the information in VetPro was sufficiently reliable for the 

purposes of our report. 

To determine the extent to which selected VAMCs implemented VA 

policies and guidance to continuously monitor physician performance, we 

reviewed VA policies and guidance relating to credentialing and 

privileging. We interviewed VA headquarters officials and officials in the 

six VISNs that include the VAMCs we visited. To evaluate VAMC 

implementation of VA policies and guidance pertaining to physician 

performance monitoring, we interviewed physician service chiefs at each 

VAMC we visited about efforts to monitor physician performance. Finally, 

at each VAMC we collected documents demonstrating how continuous 

monitoring of physician performance was conducted. To determine the 

 

9

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

10VA’s health care system is organized into 21 geographically defined regions, or VISNs, 

which have budget and management responsibilities for VA facilities located within their 

region. 

Page 5 GAO-10-26 VA Credentialing and Privileging 
 

possible effects of the inappropriate use of physician performance 

information, we reviewed federal law and interviewed VA general counsel 

staff. The information from our site visits cannot be used to generalize 

about all monitoring practices at the selected VAMCs, or about the 

practices at all VAMCs. 

To examine the extent to which VA has oversight mechanisms in place to 

track that VAMCs are performing surgical procedures that match their 

capabilities, we reviewed VA policies. To obtain information on VA’s plans 

for implementing an oversight mechanism for VAMCs’ surgical programs, 

we reviewed the work of VA’s Operative Complexity and Infrastructure 

Standards Workgroup and conducted a series of interviews with VA 

headquarters officials. While on site visits at the selected VAMCs, we 

conducted interviews with chiefs of surgery, and after the site visits, we 

conducted follow-up interviews to obtain information on the facility-level 

implementation of the National Surgical Quality Improvement Program 

(NSQIP)—which is VA’s noncardiac surgical quality monitoring program—

and other VAMC reviews of surgical program quality. We also reviewed 

copies of facility-level NSQIP reports, NSQIP training materials, and 

articles on NSQIP in peer-reviewed journals. The information we obtained 

through our site visits and interviews with chiefs of surgery cannot be 

generalized to all VAMCs. 

Further details on our scope and methodology can be found in appendix I. 

We conducted this performance audit from July 2008 through January 

2010 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

Background 

VA Organization, Roles, 

and Responsibilities 

VA provides health care services at 153 VAMCs, which are grouped by 

region into 21 VISNs. Responsibilities for physician credentialing, 

privileging, and continuous monitoring of physician performance exist in 

all three levels of VA: VA headquarters, VISNs, and VAMCs. (See fig. 1.) 

Page 6 GAO-10-26 VA Credentialing and Privileging 
 

Figure 1: Select VA Organization, Roles, and Responsibilities 

Source: GAO analysis of VA documents and interviews with VAMC officials.

Veterans Integrated Service 

Networks (VISN)

There are 21 VISNs, organized 

by region, and each VISN is 

responsible for managing and 

overseeing facilities located 

within its region.

VA headquarters

Headquarters offices are 

responsible for efforts to ensure 

quality of care, for Veterans 

Integrated Service Network 

(VISN) oversight, and for the 

creation of policy.

Under Secretary for Health

Deputy Under 

Secretary for Health 

for Operations and 

Management

Office of Quality 

and Performance

VISN 

Director

VISN Chief 

Medical Officer

VA medical centers (VAMC)

Each VAMC is responsible for 

implementing the credentialing, 

privileging, and physician monitoring 

processes consistent with VA policy. 

This figure generally describes 

the organization of the six VAMCs 

we visited.

VAMC

Director

Credentialer

Chief of 

Mental Health

Chief of

Medicine

Other Physician 

Service Chiefs

Chief of 

Staff

Chief of 

Surgery

VA headquarters develops VA-wide policies and oversight approaches for 

the VISNs to execute. The Office of Quality and Performance is 

responsible, at the direction of the Under Secretary for Health, for 

overseeing VA-wide credentialing and privileging policy, which includes 

requirements for the continuous monitoring of physician performance. 

The Deputy Under Secretary for Health for Operations and Management is 

responsible for assuring that all 21 VISNs implement a credentialing and 

privileging process at each VAMC consistent with VA policy. Each VISN 

has a VISN director, who reports to the Deputy Under Secretary for Health 

Page 7 GAO-10-26 VA Credentialing and Privileging 
 

for Operations and Management, and a VISN chief medical officer (CMO

who reports to the VISN director. The VISN CMO is responsible for the 

oversight of the credentialing and privileging process of VAMC

VISN. Within each VAMC, the VAMC director has the ultimate 

responsibility for physician credentialing and privileging at the facility. 

The chief of staff is the highest ranking medical officer in the VAM

responsible for the quality of clinical care provided at the facility, 

including maintaining the credentialing and privileging process. VAMCs 

are generally organized by clinical service. The six VAMCs that we 

were divided into services—such as medicine, mental health, and 

surgery—which provide specialized health care services.

), 

s in the 

C, and is 

visited 

in 

ysicians in the service. Generally, service chiefs report to the 

chief of staff. 

y 

Pro. 

e 

 factual 

ce 

information about physicians’ scope of practice and clinical performance.12

nces, 

 

11 Services are led

by physician service chiefs, who are responsible for the physicians with

the service, including monitoring the quality of care being delivered to 

patients by ph

Initial credentialing and privileging for physicians occurs before 

physicians are permitted to practice medicine at a VAMC. VA polic

requires physician applicants to enter information about medical 

licensure, board certification, and other relevant credentials into Vet

Applicants also complete requests for privileges which describe the 

specific health care services that they would like to provide. Once th

required credentialing information is provided by the physician, an 

employee of the VAMC—usually a credentialer—collects documentation 

from the original source for each credential, in order to confirm the

accuracy of the physician-provided information. For example, the 

credentialer would typically contact medical schools and medical 

residency programs to confirm dates of participation and program 

completion by the physician. This is referred to as primary sour

verification. New physician applicants must also provide three 

professional references. These references must provide specific 

Service chiefs must review this information about a physician’s 

professional training and experience, as well as input from refere

before determining whether to recommend both the physician’s 

Privileging Processes 

Credentialing and 

11Examples of other services at VAMCs we visited included primary care, geriatrics, and 

radiology. 

12Physicians applying for reprivileging are expected to provide two references. 

Page 8 GAO-10-26 VA Credentialing and Privileging 
 

appointment to the VAMC medical staff and the appropriate clinical 

privileges. VA requires its physicians to possess at least one full, active, 

current, and unrestricted license to practice medicine. VA also prohib

the employment of physicians who have or have had more than one 

license and had any license terminated, or voluntarily relinquished any 

license after written notification by the state of possible termination, fo

reasons of substandard care, professional misconduct, or professional 

incompetence, unless such license is fully restored. Service chiefs

expected to review applicants’ files to identify inconsistencies or 

omissions in information and then require physicians to enter the o

information. For physicians going through the reappointment and 

reprivileging processes, service chiefs also must review and consider

physician-specific clinical information collected at the VAMC that is 

related to prof

its 

r 

 are 

mitted 

essional performance, judgment, or clinical or technical 

competence. 

d 

 reappoint 

physicians and renew their privileges at least every 2 years. 

ntation of 

y 

y to document 

and evaluate physician performance using available data. 

al 

not 

f 

Physician Performance 

Service chiefs’ recommendations for both new applicants and 

reappointments are considered by a committee of VAMC physicians who

forward medical staff appointment and privileging recommendations to 

the VAMC director, who is the final approving official. Appointments an

privileges are typically granted for 2 years, and VAMCs must

VA requires VAMCs to continuously monitor the performance of 

physicians providing care at VAMCs. Continuous monitoring allows 

VAMCs to identify professional practice trends that impact the provision 

of high-quality patient care. While continuous monitoring can take many

forms, VA requires that during the reprivileging process, service chiefs 

consider such factors as procedure volume, complication rates, and 

comparison of physician-specific data with aggregate data of physicians 

holding comparable privileges when available. Service docume

continuous monitoring is kept in individual physician-specific 

performance profiles. A physician’s performance profile can be used b

the service chief to assess the physician’s performance at the time of 

reprivileging. Monitoring of physician performance includes On-Going 

Professional Practice Evaluations (OPPE), which are a wa

Continuous Monitoring o

One other specific type of continuous monitoring is Focused Profession

Practice Evaluations (FPPE). The FPPE is a process where the VAMC 

evaluates the privilege-specific competence of a physician who does 

have documented evidence of competently performing the privilege 

Page 9 GAO-10-26 VA Credentialing and Privileging 
 

requested at the VAMC. VAMCs must consider performing FPPEs at initial 

appointment or when granting new privileges. FPPEs may also be used

question arises about a physician’s ability to provide safe, high-qua

patient care. FPPEs can take a number of forms, including direct 

observation of physician skills or periodic chart reviews. VAMC official

must sp

 if a 

lity 

s 

ecify the evaluation criteria to be used prior to performing the 

FPPE. 

that 

ust 

een 

 decreased by 37 percent, and complications decreased 

by 42 percent.15

 

NSQIP collects data on selected surgical procedures performed by each

VA facility and the outcomes within 30 days of those procedures.13 The 

NSQIP analysis uses risk adjustment to control for patient risk factors 

might affect surgical outcomes by estimating the expected number of 

deaths and complications. By comparing these estimates to the actual 

number of deaths and complications the facilities experienced, VA can 

assess the quality of surgical care at each VAMC. NSQIP uses statistical 

estimates to determine if facilities are outliers when they have higher than 

expected numbers of deaths and complications within 30 days of a sample

of surgeries, given known patient risk factors. These outlier VAMCs m

evaluate all deaths that occurred during the reporting period.14 If the 

VAMC is an outlier for two consecutive reporting periods, a VA surgical 

site visit team is sent to evaluate the VAMC’s surgical program. Betw

1991 and the end of fiscal year 2004, deaths within 30 days of major 

surgery in the VA

y 

ent Program 

(NSQIP) 

National Surgical Qualit

Improvem

13In 1991, VA began a study in 44 VAMCs to validate the methodology of NSQIP. In 1994, VA 

established NSQIP as a monitoring mechanism in all VAMCs. 

14VHA Directive 2007-008, Quality Reviews of Surgical Programs and Outcomes, states 

that any facility that is an outlier during the 6-month reporting period must perform a 

written assessment of all mortalities, and that two consecutive 6-month periods would 

prompt a site visit. A VA headquarters official told us that this directive is currently under 

revision, and that the current practice includes a quarterly reporting period. 

15Shukri F. Khuri, “The NSQIP: A New Frontier in Surgery,” Surgery 138(5) (2005): 839. 

Page 10 GAO-10-26 VA Credentialing and Privileging 
 

VA’s Policies and 

Guidance Help 

Ensure Accurate 

Information on 

Physician 

Qualifications, but 

One Policy May Not 

Be an Effective Use of 

Resources 

VA’s policies and guidance on credentialing, privileging, and continuous 

monitoring help ensure the collection of accurate and complete 

information about physician professional qualifications, clinical abilities, 

and clinical performance. Following events at the Marion VAMC, VA made 

several policy changes to allow VAMCs to collect more complete and 

timely information on physician licensure, malpractice, and disciplinary 

actions. However, VA’s new policy requiring facilities to obtain written 

verification of licensure information from state medical boards—which 

previously could be obtained by telephone or through a state medical 

board’s Web site—may not be an effective use of VA resources. 

VA Policies and Guidance 

on Credentialing, 

Privileging, and 

Continuous Monitoring 

Address or Exceed Joint 

Commission’s 

Accreditation Standards 

VA’s policies on credentialing address relevant Joint Commission 

standards. (See table 1.) For example, the Joint Commission requires that 

facilities verify a physician’s education and relevant training. 

Correspondingly, VA’s policy states that each VAMC must verify 

information about medical school graduation, residencies, and 

fellowships. 

Page 11 GAO-10-26 VA Credentialing and Privileging 
 

Table 1: Selected Joint Commission Standards, and Corresponding VA Policies, for Physician Credentialing 

Joint Commission standarda

VA policy 

Licensure 

Verify current physician licensure with the relevant 

state medical board(s) at specified times, including 

when the license expires. 

Verify with the state medical board(s) all licenses currently or previously held 

that are disclosed by the physician at appointment, reappointment, and upon 

lapsing. 

Education, training, and experience 

Verify education and relevant training. Verify information about medical school graduation, residencies, fellowships, 

and board certification. Physician must disclose information on all education, 

training, and employment experience, including all gaps greater than 30 days. 

Malpractice history and adverse actions against licensure, medical staff membership, and clinical privileges 

Evaluate any evidence of an unusual pattern or 

number of malpractice judgments. 

Efforts must be made to obtain primary source verification of the issues and 

facts related to physician involvement in any administrative, professional, or 

judicial proceedings in which malpractice is or was alleged. Documentation 

must include a statement of adjudication by an insurance company, court of 

jurisdiction, or attorney’s statement of claim status. Unsuccessful good faith 

efforts to obtain this information must be documented. The facility must 

document evaluation of the facts of malpractice case resolution. VA policy 

sets specific thresholds for additional review. A VA chief medical officer, who 

is responsible for oversight of the credentialing and privileging processes of 

the facilities within the region, must review, to ensure the appointment is 

appropriate, of each physician with (1) three payments made, (2) two 

payments totaling $1 million or more, or (3) one payment of at least $550,000.

Query the National Practitioner Data Bank (NPDB)b at 

specified times, including before granting new 

privileges. 

Enroll the physician in NPDB’s Proactive Disclosure Service through VetPro, 

VA’s Web-based credentialing database, before initial appointment, and 

renew enrollment annually. This service provides alerts to the facility any time 

new information about a physician is entered into NPDB. Reports from the 

service are to be verified, and VA medical centers (VAMC) must document 

evaluation of the facts of the report. 

Evaluate challenges to, and voluntary and involuntary 

relinquishment of, licensure. 

Obtain disciplinary information prior to initial appointment through screening 

the physician, using VetPro, through the Federation of State Medical Boards 

(FSMB)c

 Disciplinary Alerts Service that provides alerts to VA headquarters 

when a state medical board reports an action against a license. Within 

30 days after receiving notice of an alert from VA headquarters, VAMC 

officials must document primary source verification of the action and review of 

this information to determine the impact on the physician’s continued ability to 

practice within the scope of granted clinical privileges. 

Evaluate voluntary or involuntary termination of 

medical staff membership and reductions, limitations, 

or loss of privileges. 

Verify any voluntary or involuntary termination of medical staff membership 

and loss of, or adverse action against, privileges. 

Sources: GAO analysis of 2008 Joint Commission standards and 2008 VA policy. 

a

Joint Commission standards related to malpractice history and adverse actions against licensure, 

medical staff membership, and clinical privileges are privileging standards. VA policy, however, 

classifies them as credentialing standards. 

b

The NPDB is administered by the U.S. Department of Health and Human Services and includes 

information on physicians who either have been disciplined by a state medical board, professional 

society, or health care provider or have been named in a medical malpractice settlement or judgment. 

Page 12 GAO-10-26 VA Credentialing and Privileging 
 

c

The FSMB is a national organization representing U.S. state and territory medical boards, as well as 

the District of Columbia, and 14 state boards of osteopathic medicine. The FSMB maintains a central 

repository which includes board-reported information on disciplinary actions taken against medical 

licenses. 

In addition, VA’s credentialing policies include requirements that are not 

included in the Joint Commission’s standards. For example, Joint 

Commission standards require verification of a physician’s current state 

medical licenses, while VA policy requires verification of both current and 

past licenses. VA also requires physicians to disclose and explain gaps in 

education, training, and employment greater than 30 days, while the Joint 

Commission standards contain no such requirement. 

VA’s privileging policies and guidance also address Joint Commission’s 

standards. The Joint Commission requires facilities to consider, during the 

privileging process, a physician’s credentials, such as licensure and 

training. The standards also require consideration of peer references that 

include information related to clinical performance, as well as 

information, when available, on a physician’s clinical performance 

compared to aggregate data. Correspondingly, for privileging, VA policy 

states that VAMCs must consider physician credentials, attempt to obtain 

verification of the privileges the physician currently holds or most recently 

held at other institutions, and review three professional references. 

References need to contain information about the applicant’s medical 

knowledge, technical skills, and clinical judgment. For reprivileging, VA 

requires that VAMCs review two peer references and consider the 

physician’s clinical performance at the VAMC, using data such as 

complication rates. Each physician’s performance must be compared to 

aggregate data for physicians with the same or comparable privileges, if 

available. In December 2008, VA provided guidance to VAMCs that 

included specific types of information that may be used in reprivileging, 

such as infection rates. 

Finally, VA’s policies and guidance on continuous monitoring of clinical 

performance also address the Joint Commission’s standards, as described 

in table 2. In particular, the Joint Commission described in its 2008 

standards how facilities should collect data for OPPEs and FPPEs. VA’s 

2008 guidance described how VAMCs should implement these processes. 

Page 13 GAO-10-26 VA Credentialing and Privileging 
 

Table 2: Selected Joint Commission Standards and Corresponding VA Policy and Guidance for Continuous Monitoring of 

Physician Performance 

Joint Commission standard VA policy and guidance 

On-going Professional Practice Evaluations (OPPE) 

Facilities must have a clearly defined process in place for OPPEs. 

Facilities may evaluate performance using data such as 

procedures, outcomes, and length of patient stay in the facility. 

VA guidance states that OPPEs should be conducted twice a year 

to comply with Joint Commission standards. 

Focused Professional Practice Evaluations (FPPE) 

Facilities must implement a process to evaluate the privilegespecific competence of physicians who do not have documented 

evidence of competently performing a requested privilege at the 

facility. This process may also be used when a question arises 

regarding a currently privileged physician’s ability to provide safe, 

high-quality, patient care. Facilities must develop criteria, such as 

evidence of a clinical performance trend that would trigger an 

FPPE of a physician. 

VA policy states that VA medical centers must have a process in 

place to evaluate the privilege-specific competence of a physician 

who does not have documented evidence of competently 

performing a requested privilege. Consideration for FPPEs is to 

occur at the time of initial appointment or when granting new 

privileges. FPPEs may also be used if a question arises regarding 

a physician’s ability to provide safe, high-quality patient care. 

Sources: GAO analysis of 2008 Joint Commission standards and 2008 VA policy and guidance. 

When implemented by VAMCs, VA policies for credentialing, privileging, 

and continuous monitoring help ensure that facilities can identify 

physicians with insufficient or falsified credentials or questionable clinical 

performance. The VA OIG report on the events at the Marion VAMC 

identified several deficiencies in the facility’s credentialing and privileging 

processes that were related to failures—largely on the part of the VAMC’s 

medical leadership—to comply with VA policies for credentialing and 

privileging physicians. 

VA Has Changed Policies 

to Obtain More Complete 

and Timely Information 

about Physician Licensure, 

Malpractice, and 

Disciplinary Actions 

Since events at the Marion VAMC, VA has made two changes to its policies 

for verifying information about physician credentials. First, for licensure, 

VA began using a new service from FSMB that reports all states where a 

physician has ever held a license.16 When VAMCs screen a physician 

through FSMB, the VAMCs will receive this report, which they can use to 

identify state medical licenses not disclosed by the physician. VA began 

receiving this service in summer 2008, according to a VA official. VA told 

us that it has verbally instructed facilities to verify any discrepancies 

between the FSMB report and what the physician has disclosed, and VA 

policy requires follow up of any discrepancies found during the 

verification process. Second, also included in VA’s 2008 policy is a 

requirement for facilities to enroll physicians, through VetPro, at initial 

 

16This information is provided to FSMB by state medical boards. 

Page 14 GAO-10-26 VA Credentialing and Privileging 
 

appointment in the National Practitioner Data Bank’s (NPDB) Proactive 

Disclosure Service, and renew enrollment annually.17 This service provides 

alerts to VA headquarters any time new information about a physician is 

entered into NPDB. Previously, VAMCs obtained new information from 

NPDB only when the database was queried every 2 years after initial 

appointment or when a physician requested new privileges. This policy 

allows VAMCs to obtain more timely information about malpractice and 

disciplinary actions than under the previous policy. 

According to VA headquarters officials, in response to events at Marion 

VAMC, the November 2008 policy included a new requirement for VISN 

oversight of physicians who have unusually high numbers or amounts of 

malpractice payments. In cases where a physician has three malpractice 

payments, two payments that total $1 million or more, or one payment 

equal to or over $550,000, the VISN CMO must review the physician’s 

appointment to ensure that the appointment is appropriate. 

VA Issued a New 

Requirement for Written 

Licensure Verification, but 

It May Not Be an Effective 

Use of Resources 

VA’s November 2008 policy included a new requirement for VAMCs to 

request written verification of state medical licensure, but we found that 

this may not be an effective use of facility resources. Previously, other 

means of verification—such as telephone verification or using a state 

medical board’s Web site—were permitted without a requirement for 

written verification.18 According to VA’s Director, Credentialing and 

Privileging, the policy change is intended to enhance VA’s ability to obtain 

information from state medical boards about pending board actions 

against a physician’s license, disciplinary actions under consideration, or 

open investigations. VA has implemented this policy to require that 

VAMCs’ requests to the state medical boards include a waiver, signed by 

the physician as a condition of appointment, authorizing the boards to 

release this information about pending or ongoing actions. However, 

FSMB officials told us that state medical boards, citing state laws or 

policies, may not disclose this information even with a waiver. 

 

17The NPDB is administered by the U.S. Department of Health and Human Services and 

includes information on physicians who either have been disciplined by a state medical 

board, professional society, or health care provider or have been named in a medical 

malpractice settlement or judgment. 

18Under the new policy, VAMCs may initially obtain licensure verification by Web site or 

telephone, but must request written verification within 5 days. 

Page 15 GAO-10-26 VA Credentialing and Privileging 
 

The results of our state medical board survey confirmed that state medical 

boards frequently will not provide information on pending or ongoing 

actions, even with a signed waiver. Of the 50 states and District of 

Columbia that received the survey, 39 responded (76 percent). Twenty-six 

states (66 percent of those that responded) reported that they would not 

provide information about pending board actions against a physician’s 

license, disciplinary actions under investigation, or open investigations. Of 

the 26 states that said that they would not provide this information, most 

(22) cited state law as the reason. While 13 of the 26 states would provide 

written verification of licensure and final actions against licensure, they 

would charge a fee for VA to obtain this information. Of the 12 states that 

listed a specific fee, the average fee was $20, with 1 state charging $50. 

Thirteen of the 39 states responded that they would provide information 

about pending board actions against a physician’s license, disciplinary 

actions under investigation, or open investigations. However, 2 of these 

states reported that they would provide only information that is already 

publicly available, and 1 state’s response was not clear as to whether it 

would actually disclose the relevant information. Therefore, VA’s current 

policy may require VAMCs to expend resources to obtain information 

about final actions taken against licensure that is not likely to exceed what 

is currently available at no cost. A VA headquarters official told us that VA 

is aware that state medical boards may not disclose this information. VA 

planned in October 2009 to send each board a letter asking them whether 

they will release the information if provided a signed waiver by the 

physician. 

Page 16 GAO-10-26 VA Credentialing and Privileging 
 

At the six VAMCs we visited, we found that VAMC staff did not 

consistently follow VA’s credentialing and privileging policies. 

Credentialers sometimes did not comply with requirements to verify 

physician information such as state medical licenses and prior malpractice 

claims. Service chiefs did not always adequately review the information 

submitted by physicians in order to identify whether required information 

had been omitted by physicians. In addition, we found weaknesses in 

VetPro’s display of summary information and the wording of questions for 

physicians, which could inhibit service chiefs’ ability to evaluate physician 

qualifications. Finally, VA policies lacked specificity in describing the 

monitoring activities that are expected to oversee VAMCs’ compliance 

with credentialing and privileging policies. 

Credentialing and 

Privileging at Selected 

VAMCs Lacks 

Consistent 

Compliance with VA 

Policy, Clear 

Documentation in 

VetPro, and 

Comprehensive 

Oversight by VISN 

Officials 

Some VAMC Credentialing 

and Privileging Files Were 

Missing Information 

Necessary to Determine 

Whether Physicians Were 

Adequately Qualified 

Across the six VAMCs we visited, we found inconsistent compliance by 

credentialers with verifying required credentialing and privileging 

information we selected for review.19 This credentialing information is 

necessary to evaluate the qualifications and credentials of physicians, and 

the privileging information is necessary to determine which health care 

services physicians should be permitted to independently practice within 

the facility. The four credentialing and privileging documentation 

requirements we reviewed for compliance were: (1) verification of all state 

medical licenses ever held by a physician; (2) verification of malpractice 

claims; (3) queries to FSMB about disciplinary actions taken against a 

physician’s license; and (4) receipt of the required number of references. 

Noncompliance with documentation of medical license verification and 

malpractice verification accounted for most of the instances where VA 

policy was not followed. Table 3 summarizes compliance with VA policies 

of the 30 physician files we reviewed at each VAMC. 

 

19We based this review on VA’s 2007 credentialing and privileging policies, which were the 

policies in place when we began visiting the six VAMCs. 

Page 17 GAO-10-26 VA Credentialing and Privileging 
 

Table 3: Compliance with Selected VA Documentation Requirements Used for Physician Credentialing and Privileging at Six 

VA Medical Centers (VAMC) 

State medical licenses Malpractice 

Federation of State 

Medical Boards database 

query Physician references 

VAMC 

Complied 

with VA 

policy 

Did not 

comply 

with VA 

policy 

Complied 

with VA 

policy 

Did not 

comply 

with VA 

policy 

Complied 

with VA 

policy 

Did not 

comply 

with VA 

policy 

Complied 

with VA 

policy 

Did not 

comply 

with VA 

policy 

A 28 2 8 8 30 0 30 0

B 24 6 12 8 30 0 29 1

C 28 2 10 2 30 0 29 1

D 21 9 6 10 25 5 28 2

E 30 0 13 0 30 0 29 1

F 20 10 3 10 30 0 29 1

Total 151 29 52 38 175 5 174 6

Sources: GAO analysis of documentation in VAMCs’ credentialing and privileging files. 

Notes: We reviewed 30 files at each VAMC. However, results for one category do not total 30 at each 

facility because the requirement did not apply to all physician files. Site visits to these six VAMCs 

were conducted from August 2008 through February 2009. 

At the six VAMCs, medical licenses were properly verified in 151 out of 180 

files, with five of six VAMCs having 2 or more physician files that lacked 

proper verification of medical licenses. 

VAMC staff at the six VAMCs properly verified malpractice allegations or 

claims for 52 of 90 files in which physicians reported at least one past 

allegation of malpractice. However, at three VAMCs malpractice 

verification was not completed properly at least half of the time. 

We found that VA documentation requirements were followed for querying 

the FSMB and collecting physician references in all but a limited number 

of instances. Specifically, we found: 

• documentation that the FSMB had been queried in 175 out of 180 

physician files, and 

• documentation that the required number of references had been obtained 

in 174 out of 180 physician files. 

Page 18 GAO-10-26 VA Credentialing and Privileging 
 

In addition to the four credentialing and privileging requirements, we also 

examined whether credentialers ensured that reprivileging took place no 

more than 2 years after the previous privileging process. Reprivileging 

took place no more than 2 years after the previous privileging process in 

123 out of 128 files that had reprivileging data. 

Medical Staff Leadership 

Did Not Adequately 

Scrutinize Information or 

Document Credentialing 

and Privileging Decisions 

at Selected VAMCs 

Although credentialers are generally responsible for collecting primarysource documentation at the VAMCs we visited, it is service chiefs who 

are responsible for reviewing physicians’ credentials to recommend 

medical staff appointments and privileges and, therefore, best positioned 

to identify instances where physicians did not provide required 

information. However, some service chiefs at the VAMCs we visited did 

not identify those instances when physicians omitted required information 

in the 180 files we reviewed—even when evidence of the omissions was 

available elsewhere in the physician file.20 An example would be if a 

physician disclosed employment in Pennsylvania but did not list a 

Pennsylvania medical license. 

As part of our review of the 180 physician files at the six VAMCs, we 

looked for evidence of omissions by physician applicants related to 

medical licenses, malpractice, and gaps in background greater than 

30 days. (See table 4 for a summary of our findings related to instances 

when service chiefs did not identify omissions made by physicians in 

submitted credentialing and privileging information at the six VAMCs we 

visited.) 

 

20We cannot be certain our review reflects all instances in which omissions by physicians 

occurred. The data we collected during physician file reviews captures detail about 

instances in which evidence elsewhere in the physician file demonstrated that required 

information was missing. 

Page 19 GAO-10-26 VA Credentialing and Privileging 
 

Table 4: Identification of Compliance with VA Policy Regarding Physician Disclosure of Information Prior to Service Chief 

Recommendation at Six VA Medical Centers (VAMC) 

State medical licenses Malpractice Background 

VAMC 

Evidence of 

unreported 

licenses 

No evidence of 

unreported 

licenses 

Evidence of 

unreported or 

underreported 

malpractice

No evidence of 

unreported or 

underreported 

malpractice

Unexplained 

gaps greater 

than 30 days 

No unexplained 

gaps greater 

than 30 days

A 2 28 2 28 3 27

B 4 26 5 25 1 29

C 2 28 5 25 0 30

D 2 28 4 26 1 29

E 0 30 1 29 — —

F 2 28 4 26 1 29

Total 12 168 21 159 6 144

Sources: GAO analysis of documentation in VAMCs’ credentialing and privileging files. 

Notes: Site visits to these six VAMCs were conducted from August 2008 through February 2009. We 

did not analyze the background requirement at VAMC E. 

During our file review at the six VAMCs, we found that 168 of 180 

physician files showed no evidence that physicians had omitted any state 

medical licenses currently or previously held. However, 12 of the 180 files 

contained evidence that not all medical licenses were disclosed by the 

physician. Without full disclosure of medical licenses, credentialers would 

not know which states need to be contacted to obtain primary source 

verification that would indicate whether disciplinary action had been 

taken against a physician’s license. The VA OIG found weakness in the 

disclosure of medical licenses by physicians at the Marion VAMC. Its 

review uncovered evidence that one physician did not disclose a medical 

license in which disciplinary action had been taken. As a result of the VA 

OIG’s scrutiny, the provider was placed on authorized absence pending an 

investigation. 

VAMC File Review: Inadequate review of 

licensure and an inadequate reference

An experienced primary care physician at 

one VAMC we visited was hired in 2007. The 

physician’s file showed that the only medical 

license he reported holding was issued 6 

years after he started in private practice. The 

VAMC never documented investigating this. 

Further, records from one hospital where the 

physician worked show the physician held 

privileges at that facility for just 3 months in 

the 1990s—not the 31 years he disclosed to 

the VAMC. Finally, one of the three required 

references was an attorney who answered 

“no information” to questions about the 

applying physician’s clinical competency and 

medical practice. 

We also found during our review that 159 of 180 physician credentialing 

files contained detailed written information about all malpractice 

complaints made against physicians as required by VA policy.21 Several of 

the 21 cases where the malpractice disclosure policy was not followed 

 

21VA policy states: “VA application forms, or supplemental forms, require applicants to give 

detailed written explanations of any involvement in administrative, professional, or judicial 

proceedings, including Federal tort claims proceedings, in which malpractice is, or was, 

alleged.” 

Page 20 GAO-10-26 VA Credentialing and Privileging 
 

were identified through NPDB reports in the physician file. These NPDB 

reports—which VAMCs are required to collect on each physician during 

each appointment or reappointment process—showed malpractice 

payments had been made on claims that physicians never disclosed. For 

example, a surgeon at one VAMC disclosed no malpractice allegations 

against him, yet NPDB showed that two claims, totaling $160,000, had 

been paid based on care provided by the physician. This physician’s 

credentialing file documented that the physician was reappointed in part 

based on “no pending or actual malpractice judgments.” 

VAMC File Review: A restricted license 

without documented review

A VAMC we visited violated VA policy in 2002 

by hiring a surgeon and keeping him on the 

medical staff for 3 years without documenting 

an investigation about why one of his medical 

licenses had been restricted. The restrictions

stemmed from an incident—according to a

state medical board finding—in which the 

physician operated on the wrong joint of a

patient, did not tell the patient’s family about 

the error, and did not record the result on the 

operative report until colleagues pressured 

him to do so. This state’s medical board 

revoked the physician’s license in 1989. Nine 

months later the license was restored to a

restricted status, which lasted until April 2006 

when the restrictions were lifted.

We found no evidence in the physician’s file 

that an investigation by VA into the details of 

the medical license restriction ever took 

place, as VA policy required at the time. (The 

policy has since been updated to prohibit 

hiring physicians with restricted licenses.) 

This physician resigned from the VAMC in 

April 2005—and was rehired in June 2006, 

shortly after the medical license restrictions

were lifted. Prior to rehiring the physician, the 

VAMC documented a review of the 

circumstances surrounding the licensure 

restrictions.

VA policy requires that physicians with gaps of greater than 30 days in 

their backgrounds and experience document the reasons for these gaps 

because this information can be compared with licensure data to make 

sure physicians reported all licenses held. We found that 144 of 150 

physician files either documented no gaps or contained explanations for 

the gaps of greater than 30 days. In the remaining 6 files, gaps were found 

with no documentation that an explanation was provided. 

Although VA policy requires physician service chiefs—officials responsible 

for physicians providing particular clinical services—to document their 

rationale for credentialing and privileging recommendations for 

physicians, we found such documentation only about one-third of the 

time. VA requires service chiefs to document in VetPro what quality-ofcare information they reviewed during the reprivileging process. Service 

chiefs must then explain their rationale for recommending the physicians’ 

privileges. Of the 130 physicians who went through the reprivileging 

process at least once, we found that only 45 files—about a third—

contained required service chief documentation in their most recent 

reprivileging cycle. (See table 5 for a breakdown of our findings by VAMC 

visited.) 

Page 21 GAO-10-26 VA Credentialing and Privileging 
 

Table 5: Service Chief Compliance with VA Documentation Policies for 

Reprivileging Recommendations at Six VA Medical Centers (VAMC) 

VAMC File Review: Inaccurate review of 

malpractice data

One VAMC hired a physician in 2003 using a

special, abbreviated privileging process

designed for emergency situations. The order 

granting privileges was signed by the acting 

facility director and acting chief of staff and 

stated that a query of the National 

Practitioner Data Bank (NPDB) showed “no 

derogatory information has been discovered.” 

However, NPDB data we reviewed showed at 

least four paid malpractice claims before he 

was hired—including one involving medical 

equipment left inside a patient’s body. 

Rationale for reprivileging documented by service chief 

VAMC Complied with VA policy Did not comply with VA policy

A 6 12 

B 2 21

C 17 5

D 6 17 

E 8 11

F 6 19

Total 45 85

Sources: GAO analysis of documentation in VAMCs’ credentialing and privileging files. 

Notes: We reviewed 30 files at each VAMC. However, results do not total 30 at each facility because 

the requirement did not apply to all physician files. Site visits to these six VAMCs were conducted 

from August 2008 through February 2009. 

Of the 85 files that did not contain required documentation, some 

contained no service chief comments at all. Others contained comments 

that did not meet VA requirements for service chiefs to explain the 

rationale for their decisions and the quality-of-care activities that were 

considered. For example, one service chief wrote “outstanding surgeon,” 

but did not explain what quality data, if any, were used to reach that 

conclusion. 

Display of VetPro 

Information May Inhibit 

VAMCs’ Ability to 

Accurately Collect and 

Scrutinize Data 

We identified two VetPro weaknesses—in the display of summary 

information and in the wording of questions for physicians—that could 

inhibit service chief review of physician qualifications during the 

credentialing and privileging process. 

We found weaknesses in the way VetPro displayed credentialers’ 

corrections to physician-supplied information. VetPro displays information 

by category, and each category of information—such as medical training, 

medical licensure, and references—is available on separate VetPro 

screens. Some of the screens have a table with summary information at 

the top of the screen and detailed information about a single entry at the 

lower portion of the screen. However, when information has been 

corrected by credentialers based on primary source verification, the 

corrections do not appear in these summary tables and there is no 

notification within these summary tables that alerts service chiefs that 

VetPro’s Information Display 

May Limit Identification of 

Inaccurate Information 

Page 22 GAO-10-26 VA Credentialing and Privileging 
 

physicians’ self-reported information was found by credentialers to be 

inaccurate. This corrected information was available in VetPro, but 

accessing it required an extra step. In one instance, we found a 

discrepancy of 14 months between the dates when the physician reported 

obtaining privileges at one hospital and the privileging information 

provided directly by the hospital. (See fig. 2, which illustrates a 

hypothetical example of VetPro’s display of summary information.) 

Figure 2: Illustration of How VetPro Displays Summary Information 

Source: GAO analysis of VetPro Web-based credentialing database.

File Edit View Links Help

Home Logout

Search

Messages

Enrollment

Provider File

 Personal Profile

Supplemental Info

 Education

 Training

 ECEMG

State CDS

 Federal DEA

 Certification

 Licenses

 References/

 Peer Review

 Pers. History

Licenses

SSN: 999-99-9999 Click on State to view the details for a record.

Detail Information for Record: 4

State License No. Orig. Issue Date Expiration Date Status

1 IOWA 123456 Sep 01 1984 Sep 30 1987 V

2 MAINE 789101 Aug 01 1986 Jul 31 1991 V

3 IDAHO 111112 Jan 01 1990 Dec 31 2009 V

4 OHIO 432101 Feb 12 2000 Feb 28 2010 V

State: OHIO

License Number: 432101

License Type: STATE MED. LICENSE

Original Issue: Feb. 12 2000

Expiration: Feb. 28 2010

Current? Yes No

Explanation:

Verified Data

OHIO

432101

STATE MED. LICENSE

Feb. 12 2000

Feb. 28 2010

 Yes No

4 OH 101 Feb 12 2000 Feb 28 2010 V

 Information

AHO 111

HIO 432

Name: Jane Doe

File Edit View Links Help

Home Logout

Search

Messages

Enrollment

Provider File

 Personal Profile

Supplemental Info

 Education

 Training

 ECEMG

State CDS

 Federal DEA

 Certification

 Licenses

 References/

 Peer Review

 Pers. History

Licenses

SSN: 999-99-9999 Name: Jane Doe Click on State to view the details for a record.

Detail Information for Record: 2

State License No. Orig. Issue Date Expiration Date Status

1 IOWA 123456 Sep 01 1984 Sep 30 1987 V

2 MAINE 789101 Aug 01 1986 Jul 31 1991 V

3 IDAHO 111112 Jan 01 1990 Dec 31 2009 V

4 OHIO 432101 Feb 12 2000 Feb 28 2010 V

State: MAINE

License Number: 789101

License Type: STATE MED. LICENSE

Original Issue: Aug. 01 1986

Expiration: Jul. 31 1991

Current? Yes No

Explanation:

 Documents for QC View Documents for Record: 2 View

Verified Data

MAINE

789101

STATE MED. LICENSE

Aug. 01 1986

May 10 1989

 Yes No

2 MA 101 Aug 01 1986 Jul 31 1991 V

HIO 432

AHO 111

WA 1234

AINE 789

 

1

2

4

3

1. The “Status” box on the summary table receives a label “V,” 

for verified, once credentialers enter information into the 

“Verified Data” section. However, other information in the 

summary table is based on what the physician applicant 

enters, not the information collected by credentialers–even 

when there are discrepancies with the primary source 

information that credentialers collect.

2. Detail information is only visible for one record at a time. 

Those reviewing the VetPro file must click on the other state 

names to view details of the primary source information for 

medical licenses in those states.

3. There is a discrepancy between the Maine license 

expiration reported by the physician and primary source 

information collected by the VAMC credentialer. Information 

from the credentialer shows a 7 month gap between the 

expiration of the Maine license and the start of the Idaho 

license. However, no gap is observable from the summary 

table. VA policy requires VAMCs to follow up when discrepancies are found during the verification process.

4. This area contains links to electronic copies of the primary

source documents collected by the credentialer. Reviewers

such as service chiefs can examine these images to obtain 

additional detail about the circumstances of when and why 

the physician surrendered a medical license.

1

2

3

4

Page 23 GAO-10-26 VA Credentialing and Privileging 
 

One service chief told us that he looked at information in VetPro with his 

credentialer, who helped him navigate the process; another told us that the 

credentialer would identify any information in the physician’s file that 

needed special attention. A third said that if the credentialer corrected 

physician-supplied information in VetPro he was not aware of it. Such a 

process—in which service chiefs rely on credentialers to identify 

information in the VetPro file that requires extra attention—requires 

credentialers, who typically do not have medical backgrounds, to conduct 

substantive review of physicians’ credentialing information. One service 

chief suggested that an alert, or “flag,” would make the review process 

more useful by drawing attention to places in VetPro where there were 

discrepancies between physician-reported information and verified 

documentation. Once discrepancies are identified, service chiefs would 

need to investigate further to determine whether these discrepancies 

should be taken into account when recommending medical staff 

appointment or privileges. 

In addition, some physicians may have been confused about the wording 

of VetPro questions related to medical licensure and experience with 

malpractice allegations. For example, physicians are asked a series of 

questions after the following introduction: 

Wording of Questions in VetPro 

May Have Been Confusing to 

Physicians 

“For disciplinary reasons, have any of the following ever been, or are they in the process of 

being either on a voluntary or involuntary basis—conditional, denied, revoked, suspended, 

reduced, limited, placed on probation, not renewed, withdrawn, or relinquished while 

under investigation or after being notified that investigation would be conducted?” 

What follows is a series of yes-or-no questions including, for licensure, 

“Medical License in any State?” and, for malpractice claims, “Have you 

ever been involved or notified that the quality of care you provided is 

being reviewed as part of an administrative (e.g. Administrative Tort 

Claim), or judicial proceeding in which professional malpractice has been 

alleged?” (emphasis in original)22

During our file reviews, we noted that several physicians answered “yes” 

to the question about licensure even though some stated the licenses were 

voluntarily surrendered for nondisciplinary reasons. These cases suggest 

 

22VA does not provide a definition in VetPro. A claim against a federal agency under the 

Federal Tort Claims Act may be referred to as an administrative tort claim. See 28 C.F.R. 

Part 14. Such a claim could result from injury or death alleged to have been caused by a 

physician working for the VA or another federal agency. 

Page 24 GAO-10-26 VA Credentialing and Privileging 
 

physician confusion about the meaning of this question, since the loss of a 

medical license for disciplinary reasons could render the physician 

ineligible to work at a VAMC. Further, one physician, whose file was 

among the 21 instances where files contained evidence of either 

undisclosed or inadequate disclosure of malpractice allegations or claims, 

responded to the question about malpractice, in part, that the question was 

too vague and that more specificity was needed.23 Confusion about the 

wording of the malpractice question may have been a factor in some of 

these 21 instances. This confusion with respect to VetPro questions related 

to licensure and malpractice suggests weaknesses in processes that are 

intended to help VAMCs collect complete and accurate credentialing 

information. 

VA Oversight Policies Lack 

Detail Necessary to 

Implement Proper 

Controls over VAMCs’ 

Credentialing and 

Privileging Processes 

The oversight policies for credentialing and privileging processes that 

were issued by VA in 2008 assign responsibility for oversight to VISN chief 

medical officers (CMO) but lack specificity in describing the monitoring 

activities that are expected.24 Internal control standards state that agencies 

should clearly define key areas of authority and responsibility, establish 

appropriate lines of reporting, assess the quality of performance over time, 

and include policies and procedures for ensuring that the findings of 

audits and other reviews are promptly resolved.25 VA’s 2008 oversight 

policies do not specify how CMOs should assess compliance with 

credentialing and privileging policies, nor do they specify how CMOs 

should follow up to ensure that identified weaknesses have been promptly 

resolved. VA also provided guidance in August 2009 that details specific 

oversight activities that can be used to evaluate a VAMC’s credentialing 

and privileging processes; however, the guidance does not describe a 

process for follow up to ensure that findings are resolved. 

VISN officials we spoke with described participating in oversight activities 

or planning oversight activities that addressed at least some elements of 

 

23We did not find documentation that the facility addressed the physician’s confusion by 

following up to explain what information was required. 

24CMOs were given responsibility for “ensuring a sound process for granting and renewing 

clinical privileges” in an October 2008 policy. They were assigned to oversee credentialing 

and privileging processes of VAMCs in their respective VISNs according to the November 

2008 revision of VA’s credentialing and privileging policy. 

25GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

Page 25 GAO-10-26 VA Credentialing and Privileging 
 

internal control standards. We interviewed CMOs and other officials in the 

six VISNs that were responsible for oversight of the six VAMCs we visited. 

The VISN officials described past and current oversight practices, as well 

as changes that were planned as a result of VA’s new oversight policies. 

Activities that VISN officials described included participating in 

credentialers’ e-mail discussion groups to track questions that come up 

about recredentialing and reviewing three to five credentialing files per 

site visit for completeness. Officials at two VISNs said the VA oversight 

policies would lead to more frequent site visits. One of these officials also 

said the policies led him to become more hands-on during site visits, and 

making direct observation of processes and engaging in direct questioning 

of VAMC staff about credentialing and privileging. 

Some of the practices VISN officials described were insufficient for 

identifying key areas of authority and responsibility, assessing the quality 

of performance over time, and conducting adequate follow-up to see that 

findings had been promptly resolved. For example, one VISN official we 

interviewed could not say whether the VISN had staff assigned to review 

VAMC credentialing and privileging files, and a second VISN reported that 

sometimes the credentialing and privileging file review process was not 

conducted if VISN officials determined it was not warranted. A third VISN 

official reported that he reviewed 20 to 30 credentialing and privileging 

files per hour—a pace, at 2 to 3 minutes per file, that provides only a 

limited ability to assess all aspects of compliance.26 Officials at a fourth 

VISN reported using criteria from the Joint Commission and the VA OIG to 

review credentialing and privileging files in preparation for reviews by 

these entities. However, these criteria do not fully overlap with VA’s 

credentialing and privileging policies.27 Of the four VISNs that 

systematically conducted file reviews, only one described engaging in a 

follow-up process after reviewing credentialing and privileging files to 

ensure that findings were resolved. 

 

26The VA headquarters official responsible for credentialing and privileging estimated that a 

thorough review of a physician file should take at least 30 minutes. 

27The Joint Commission standards do not include some VA policy requirements related to 

credentialing. For example, the Joint Commission does not require facilities to collect 

information about all medical licenses that have ever been held by a physician, as VA does. 

The VA OIG inspection protocol that was in place when we interviewed VISN officials did 

not include review of any elements of credentialing. The OIG revised its review protocol 

starting in July 2009, and this revised protocol contains some elements for reviewing 

credentialing information. However, the revised protocol does not ask inspectors to look 

for evidence of required information that physician applicants have not provided in their 

credentialing file. 

Page 26 GAO-10-26 VA Credentialing and Privileging 
 

VA provided guidance in August 2009—after our interviews were 

conducted—for evaluating a VAMC’s credentialing and privileging process. 

The guidance includes provisions for reviewing verification of state 

medical licensure and malpractice, completion of an FSMB query, gaps in 

work history greater than 30 days, possible omissions of state medical 

licenses through reviewing discrepancies between physicians’ work 

history and state medical licenses reported, and whether service chiefs 

documented physician competency and recommended privileges. 

However, VA’s guidance does not include a process for ensuring that the 

findings of the review are promptly resolved by the VAMC. 

The six selected VAMCs we visited varied in their implementation of VA 

policies and guidance to continuously monitor physician performance. 

Some VAMCs exhibited gaps in this monitoring by either failing to 

document the collection of physician performance information, or by 

collecting data that were insufficient to adequately gauge performance. In 

addition, despite VA guidance issued after our 2006 report, confusion 

about the proper use of protected physician performance information 

persisted in the VAMCs we visited: four of the six used this information 

inappropriately in privileging decisions. 

Gaps in Continuous 

Monitoring of 

Physician 

Performance Existed 

at Selected VAMCs 

and Officials 

Continued to Use 

Performance 

Information 

Inappropriately 

Selected VAMCs Varied in 

Their Implementation of 

VA Policies to 

Continuously Monitor 

Physician Performance 

and Gaps in Monitoring 

Processes Existed 

VA policy requires service chiefs to continuously monitor physician 

performance. Continuous monitoring of physician performance is 

important because VA requires service chiefs to assess all available 

information addressing physician performance when recommending 

privileges for the physicians in their services. However, all of the VAMCs 

we visited exhibited gaps in their efforts to conduct this monitoring. We 

reviewed the surgery, mental health, and medicine services at all six 

VAMCs visited and found that 6 of these 18 services failed to document 

compliance with VA policy regarding continuous monitoring of physician 

performance. These 6 services could not provide us with any 

documentation of continuous monitoring, such as data collection 

spreadsheets, standardized forms for assessing performance, or checklists 

of performance criteria. Table 6 describes the documentation of 

compliance, by service and facility, with VA policy. 

Page 27 GAO-10-26 VA Credentialing and Privileging 
 

Table 6: Service Documentation of Compliance with Continuous Monitoring of 

Physician Performance at Six VA Medical Centers (VAMC) 

Service 

VAMC Surgery Mental Health Medicine 

A z z z

B z z z

C z  

D z  

E z z 

F z  z

Sources: GAO analysis of physician performance information obtained from VAMCs. 

Legend: 

z The service was able to provide us with documentation of continuous monitoring, such as data 

 collection spreadsheets, standardized forms for assessing performance, or checklists of 

 performance criteria. 

 The service was unable to provide us with any documentation of continuous monitoring of 

 physician performance. 

Note: Site visits to these six VAMCs were conducted from August 2008 through February 2009. 

In the reprivileging process, VA requires consideration of such factors as 

the number of procedures performed and complication rates, when 

available. It also requires the comparison of physician-specific data to 

aggregate data of physicians with the same or comparable privileges, when 

available. The VA official responsible for credentialing and privileging 

policy told us that some mental health services may not have physicians 

that perform procedures. Consistent with this official’s statement, one of 

the three mental health services that produced documentation of 

continuous monitoring did not have information on procedures in its 

documentation. 

While 9 of the 12 services reviewed in surgery and medicine provided us 

with documentation of continuous monitoring, 1 of these 9 services did 

not include information on procedures or complication rates. Additionally, 

4 of these 9 services did not compare physician-specific data to aggregate 

data as required by VA policy. Table 7 summarizes whether surgery and 

medicine service documentation of continuous monitoring included 

information on these three factors. 

Page 28 GAO-10-26 VA Credentialing and Privileging 
 

Table 7: Factors of Clinical Performance Included in Continuous Monitoring at Six 

VA Medical Centers (VAMC), by Service 

Service 

Factor of clinical performance Surgery Medicine 

VAMC A 

Procedure volume data z z

Complication rates z z

Data are compared to aggregate data  za

VAMC B 

Procedure volume data z z

Complication rates z z

Data are compared to aggregate data  

VAMC C 

Procedure volume data z 

Complication rates z 

Data are compared to aggregate data z 

VAMC D 

Procedure volume data z 

Complication rates  

Data are compared to aggregate data za

VAMC E 

Procedure volume data z 

Complication rates z 

Data are compared to aggregate data za

VAMC F 

Procedure volume data z z

Complication rates z z

Data are compared to aggregate data  z

Sources: GAO analysis of physician performance information obtained from VAMCs. 

Legend: 

z The service efforts to document continuous performance monitoring included this factor of clinical 

performance. 

 The service efforts to document continuous performance monitoring did not include this factor of 

clinical performance. 

Note: Site visits to these six VAMCs were conducted from August 2008 through February 2009. 

a

These services compared physician-specific data to benchmark criteria. 

Page 29 GAO-10-26 VA Credentialing and Privileging 
 

Continuous monitoring varied by service as well as by facility. Surgical 

services consistently exhibited efforts to conduct continuous monitoring 

of physician performance. All six surgical services produced 

documentation of continuous monitoring. Further, all six surgical services 

collected information on at least one of the three factors of clinical 

practice, with two of the six services collecting information on all three 

factors. VA’s Acting Chief Quality and Performance Officer told us that 

there are areas of clinical practice that are procedure based, such as 

surgery, where the types of procedures performed allow for more 

opportunities to collect procedure based data on physician performance 

than those clinical care areas that are not procedure based. The variation 

also existed across facilities. At VAMC B both services we reviewed—

surgery and medicine—produced documentation of efforts to conduct 

continuous monitoring of physician performance, and the documentation 

produced contained at least one of the three factors of clinical 

performance. In contrast, only one service reviewed at VAMC D provided 

us with documentation of continuous monitoring efforts. 

In the absence of documentation of continuous monitoring processes, it is 

unclear what specific criteria services use to monitor physician 

performance on an ongoing basis. Further, if services’ continuous 

monitoring efforts do not include collection of physician volume and 

complication rate data, and comparison of these data with aggregated data 

from comparably privileged physicians, service chiefs are less able to 

make a meaningful assessment of a physician’s clinical competence and 

identify negative trends in a physician’s care. As a result, VAMCs and VA 

cannot ensure that these services are adequately monitoring the 

performance of their physicians. 

VA has recently issued new policies and guidance on physician 

performance monitoring processes in an effort to clarify how services can 

monitor physician performance. In December 2008, VA issued guidance to 

VAMCs on how to perform On-Going Professional Practice Evaluations 

(OPPE), a type of continuous monitoring that involves formally 

documenting and evaluating physician performance using available data.28

The guidance provides suggestions on how facilities should conduct 

 

28The OPPE process allows clinical leadership to identify professional practice trends that 

affect the quality of care and patient safety. Because this December 2008 guidance was 

issued in the middle of our site visits, which occurred from August 2008 to February 2009, 

we did not evaluate the extent to which the six VAMCs we visited had implemented the 

OPPE process. 

Page 30 GAO-10-26 VA Credentialing and Privileging 
 

OPPEs, how often OPPEs should be conducted, and suggests specific 

criteria service chiefs can use in assessing physician performance. 

Selected Facilities 

Continued to Use 

Protected Physician 

Performance Information 

Inappropriately Despite VA 

Guidance 

Four of the six VAMCs visited used protected peer review information in 

privileging decisions, despite VA guidance and training about the legal 

protections granted to certain types of performance information and 

appropriate ways to use this information.29 In 2006 we found that six of 

seven VAMCs visited used protected quality management program 

information in reprivileging, which is prohibited under VA policy. We 

recommended that VA issue guidance to facilities about this topic.30 In 

October 2007, VA issued additional guidance, and subsequently provided 

training to facilities, including two presentations addressing the proper 

usage of protected information. VA requires that during reprivileging, 

service chiefs use information on a physician’s performance to support, 

reduce, or revoke the clinical privileges the physician requested. The 

performance information a service chief uses cannot be collected as part 

of a VAMC’s quality management program. Protected peer review is a 

quality management process and information contained in documents 

created in the course of a quality management process is protected under 

VA policy. The policy explicitly states that information generated by these 

peer reviews cannot be used to take personnel actions, such as changes in 

privileges. Despite this guidance, our physician file reviews showed four of 

the six VAMCs we visited used protected peer review information in 

privileging decisions. In one such case, the physician’s VetPro file included 

a document with brief notes relating to a protected peer review along with 

the final outcome of this peer review. Similar information was found in 

physician performance profiles used by service chiefs in their reprivileging 

decisions. 

 

29Peer review is a nonpunitive, critical review of a physician’s clinical interventions 

performed by a peer or group of peers. The purpose of peer review is to improve the quality 

of care or utilization of resources at a VAMC. A peer is a practitioner of similar education, 

training, licensure, and privileges or scope of practice. A typical peer review involves a 

single reviewer making a judgment about the quality of decisions associated with another 

physician’s clinical intervention. Peer reviews ultimately result in the case receiving a 

rating based on whether other experienced, competent practitioners would have managed 

the case in a similar manner. 

30See GAO-06-648.

Page 31 GAO-10-26 VA Credentialing and Privileging 
 

VAMC officials we interviewed expressed and demonstrated confusion as 

to the appropriate use of protected peer review information. At one VAMC 

one official told us he thought it was permissible to aggregate physicianspecific peer review information and use this information in privileging, 

while another attested to directly using this type of information in 

privileging. However, the VA official responsible for credentialing and 

privileging policy confirmed that aggregate physician-specific peer review 

information was protected and should not be used in privileging. Another 

VAMC had policies which clearly outlined processes generating protected 

and unprotected physician performance information and stated that 

protected information was not to be used in privileging. However, we 

found protected peer review information in materials used for privileging 

at this facility. 

VA officials confirmed that the use of protected information in the 

privileging process in violation of VA policy may result in the information 

becoming public or in legal challenges to privileging decisions. According 

to VA’s Director, Credentialing and Privileging, privileging is considered a 

human resources function, and therefore the information used in the 

privileging process is subject to less stringent legal protections than 

information generated as part of a VAMC quality management program. If 

protected physician performance information generated by a VAMC 

quality management program serves as the basis for a privileging decision, 

the decision itself could be subject to challenge. Further, a physician 

making such a challenge may be able to obtain the release of 

inappropriately used information, thereby raising the possibility that the 

information could become public. 

In response to a recommendation to improve oversight of VAMC surgical 

programs made by the VA OIG in its report on events at Marion VAMC, VA 

has created a plan to set resource standards for surgical procedures and 

has taken steps towards the implementation of this plan. In addition to 

these new oversight plans, VA also uses surgical quality data to monitor 

the quality of its surgical programs through NSQIP, which is an oversight 

mechanism used to monitor noncardiac surgical program quality. 

VA Has Begun to 

Implement Its Plan to 

Improve Oversight for 

VAMC Surgical 

Programs by Creating 

Resource Standards 

for Surgical 

Procedures 

Page 32 GAO-10-26 VA Credentialing and Privileging 
 

In response to the VA OIG recommendation from the report on the Marion 

VAMC that VA develop a mechanism to ensure that diagnostic and 

therapeutic interventions are appropriate to the capabilities of each 

facility, VA chartered an Operative Complexity and Infrastructure 

Standards Workgroup in December 2007.31 The Workgroup took several 

steps. First, it determined, based on a literature review, that there were no 

existing surgical resource standards.32 Second, it identified the clinical 

support services and resources needed before, during, and after the 

surgeries and procedures performed at VAMCs and classified each support 

service as standard, intermediate, or complex. Third, the Workgroup 

classified surgeries or procedures as requiring standard, intermediate, or 

complex clinical support services or resources. 

VA Has Developed Surgical 

Resource Standards for 

VAMCs and Created a Plan 

for Implementing These 

Standards 

A VA headquarters official said that when VA’s resource standards are 

implemented, each VA facility will be classified as having standard, 

intermediate, or complex operative complexity—that is, the ability to 

perform standard, intermediate, or complex surgeries and procedures 

based on the availability of clinical support services or resources at the 

facility. VA conducted a survey of all VAMCs on the clinical support 

services and resources available at each facility, and the VISNs used the 

results to determine VAMCs’ initial operative complexity designation in 

February 2009. VA also used the survey to identify any VAMC that needed 

additional resources. Facilities with resource deficiencies were instructed 

to establish an action plan to resolve deficiencies and to provide VA with 

status reports by September 1, 2009, and December 1, 2009. According to 

VA headquarters officials, VA plans to issue the final policy containing 

these standards in January 2010. 

The Workgroup’s final report, signed by the Under Secretary for Health in 

October 2008, describes the resource standards and the Workgroup’s 

recommended steps to implement the standards, including the release of 

the policy containing the standards. The steps and VA’s anticipated 

completion dates are outlined in table 8 below. 

 

31The Workgroup included clinicians from VA headquarters, VISN, and VAMC levels. 

32According to a 2008 Joint Commission standard on determination of organizational 

resource ability (MS.4.00), medical staff must determine before granting privileges that the 

resources necessary to support the privileges granted are currently available or available 

within a specified time frame. The standard does not specify the resources needed for 

specific procedures. 

Page 33 GAO-10-26 VA Credentialing and Privileging 
 

Table 8: Steps in VA’s Plan to Implement the Operative Complexity and Infrastructure Standards Workgroup’s 

Recommendations Regarding Surgical Resource Standards 

Steps Status 

Identification of Veterans Integrated Service Network (VISN) chief surgical 

consultant: The Workgroup recommended that each VISN develop an 

identified Lead Network Director of Surgical Service, responsible to the 

VISN chief medical officer, to facilitate communication. According to VA 

officials, a chief surgical consultant for each VISN was established in 

February 2009 to help facilities analyze their capabilities. 

Complete 

Monitoring of compliance through the National Surgical Quality 

Improvement Program (NSQIP): The Workgroup recommended the 

development of a monitoring method through NSQIP. According to VA 

officials, in order to monitor compliance, a facility will be flagged through 

NSQIP software if it records a procedure that is more complex than those 

procedures in the facility’s operative complexity designation. 

Complete 

Response to facility designation: The Workgroup recommended that VA 

permit the development of a plan to achieve compliance with an initial 

operative complexity designation, and that the VISN address funding for all 

facilities that need to achieve compliance. Each facility was given an initial 

classification of standard, intermediate, or complex. VISNs were instructed 

to develop a plan for each VAMC to either concur with the designation or 

identify and justify an alternative designation. According to VA officials, this 

should include the procurement of additional resources if necessary to fill 

any resource gaps. All VISNs have submitted an action plan. 

Complete 

Creation of VISN model for surgical services: The Workgroup 

recommended that VA facilitate a VISN model for the delivery of surgical 

services within the VISN, including an inventory of available surgical 

services at each facility within each VISN. According to VA officials, this 

model will be finished before the release of the policy. 

Completion anticipated before January 1, 2010 

Creation of VISN plan to address transfer of patients: The Workgroup 

recommended that VA require each VISN to develop a plan for the transfer 

of patients to another facility when the initial treating facility does not have 

the appropriate resources to handle the surgical condition. According to VA 

officials, this is a part of the VISN model for surgical services, and will be 

finalized before the release of the policy. 

Completion anticipated before January 1, 2010 

Release of policy: The Workgroup recommended that VA accept the 

resource standards and mandate their use by policy. According to VA 

officials, this policy will be effective January 1, 2010. 

Completion anticipated before January 1, 2010 

Sources: GAO analysis of VA documents and interviews with VA headquarters officials. 

According to VA headquarters officials, as of July 2009, three of the six 

steps in VA’s plan to implement resource standards have been completed. 

First, in February 2009, a chief surgical consultant was identified for each 

VISN. According to these officials, each chief surgical consultant is 

responsible for helping facilities analyze their capabilities, and will receive 

facility-level information from within the VISN. Second, these officials said 

that NSQIP software can also be used to track VAMC procedures and 

identify VAMCs that are performing procedures outside their classification 

Page 34 GAO-10-26 VA Credentialing and Privileging 
 

level through codes recorded in NSQIP. Third, VISNs have responded to 

the operative complexity designations. VA headquarters officials told us 

that the VISN models for surgical services and patient transfer plans would 

be completed by the time the policy is issued, in January 2010. 

To further improve surgical program oversight, VA issued a policy in 

January 2009 on future restructuring, reduction or augmentation of 

VAMCs’ clinical programs. The policy would require that a VAMC obtain 

approval from the VISN and the Under Secretary for Health before 

undertaking any major expansion of a surgical program.33 When requesting 

an expansion, the VAMC’s chief of staff and VISN CMO must ensure that a 

thorough clinical evaluation has been conducted at the facility to ensure 

that providers have the required competency and that an assessment of 

clinical support services and resources has been made. The chief of staff 

and VISN CMO must also ensure that a site visit, which may include 

experts in the relevant surgical specialty, is conducted when applicable by 

the responsible VA headquarters program staff.34 Finally, the chief of staff 

must ensure processes are in place to provide ongoing review and 

evaluation of the quality of care provided for all clinical services. The 

facility director must submit a formal business plan to the VISN director 

for approval. VA’s new policy also provides a mechanism for facilities to 

change their operative complexity designation. VA headquarters officials 

told us that a facility’s formal business plan will also be used to approve a 

change in designation. For example, these officials told us that if a facility 

is designated as intermediate, but wants to expand to perform complex 

surgeries, VA must approve a formal business plan describing planned 

clinical and support services. 

 

33Major expansion includes the introduction of a new surgical procedure which would 

significantly increase the complexity of procedures done at the facility, or the introduction 

of thoracic or vascular surgery, transplant services, cardiac surgery, bariatric surgery, 

neurosurgery, or total joint replacement. This policy also prohibits any elimination of major 

clinical programs without approval. 

34A panel of experts is specifically required when new programs are desired in robotic 

surgery, bariatric surgery, transplant surgery, cardiac surgery, or neurosurgery. 

Page 35 GAO-10-26 VA Credentialing and Privileging 
 

In addition to the oversight activities under development related to facility 

capabilities, VA and VAMCs conduct other activities for oversight of 

surgical program quality. VA uses NSQIP to monitor surgical program 

quality.35 While NSQIP does not directly consider facility capabilities, VA 

uses NSQIP to detect problems within surgical programs and further 

investigate the potential causes of those problems, as it did at Marion 

VAMC when NSQIP identified a mortality rate over four times higher than 

the expected rate. 

VA Monitors Surgical 

Outcome Data and Has 

Policies Related to 

Oversight of VAMC 

Surgical Programs 

In addition to NSQIP reports, surgery chiefs at all six VAMCs we visited 

told us that they also monitor their surgical programs using other types of 

facility-level surgical quality oversight. Specifically, five of six surgery 

chiefs identified morbidity and mortality reviews as a mechanism for 

monitoring their surgical programs.36 VA policy requires that VAMCs 

ensure the trending of mortality data by location, time, and provider37 is 

implemented, and that VAMCs conduct a review of the data to identify and 

address any problematic trends. These data are to be discussed in a 

regular forum, such as within quality management or morbidity and 

mortality committee meetings. Furthermore, all major complications and 

deaths that are related to a surgical procedure at a VA facility must be peer 

reviewed within 30 days of the original surgical procedure.38

VA policy also provides for VISN and headquarters oversight for all peer 

reviews, including those related to patient morbidity and mortality.39 The 

VISN director must ensure an annual inspection of all VAMCs to ensure 

compliance with peer review requirements, adequate review of peer 

review results, and implementation of follow-up actions. VA policy also 

requires that facilities collect and report quarterly to the VISN certain data 

related to peer review such as the number and results of reviews. The 

VISN must analyze these data and identify any difference in facility data 

 

35NSQIP oversees the quality of certain noncardiac surgeries; the Continuous Improvement 

in Cardiac Surgery Program similarly oversees cardiac surgical programs, and the 

Neurologic Surgery Consultants Work Group oversees neurosurgical programs. 

36Other types of quality monitoring mechanisms mentioned include infection control 

reviews and surgical and other invasive procedure review. 

37The policy requires trending data by provider when the provider can be linked to the care 

of a specific patient. 

38VHA Directive 2005-056, Mortality Assessment (Dec. 1, 2005). 

39VHA Directive 2008-004, Peer Review for Quality Management (Jan. 28, 2008). 

Page 36 GAO-10-26 VA Credentialing and Privileging 
 

resulting from the peer review process. The VISN must report on a 

quarterly basis its data and analysis to VA headquarters. 

Following events at the VAMC in Marion, Illinois, which identified 

weaknesses in the monitoring of physician quality of care, VA has 

strengthened several of its credentialing and privileging policies and 

guidance and has taken steps to implement a mechanism to help ensure 

that VAMCs are not performing surgical procedures beyond their 

capabilities. With the exception of the new policy requiring written 

verification of licensure—which potentially wastes VA resources—these 

policies, if implemented correctly by VAMCs, appear sufficient to help 

facilities identify physicians who should not be providing care to veterans, 

as well as surgical programs that may be endangering veterans by 

authorizing the performance of complex procedures that are not 

adequately supported. 

Conclusions 

We did not find problems at the six VAMCs we visited that mirrored the 

extent of those reported by the VA OIG in 2008 at the Marion VAMC. 

However, we identified deficiencies in credentialing, privileging, and 

continuous monitoring of physicians that suggest a lack of scrutiny in 

critical areas, such as awareness of physicians’ experience with 

malpractice and experience in all states where physicians have practiced. 

Activities such as these are the responsibility of VAMCs’ service chiefs, 

who are the individuals best positioned to scrutinize the background 

information provided by physicians seeking appointment and to identify 

inconsistencies or missing information. However, the lack of compliance 

we found related to service chiefs’ responsibilities suggests that service 

chief attention to these activities needs to be made a higher priority. We 

also found weaknesses in VetPro which, if corrected, would make it easier 

for service chiefs to scrutinize the backgrounds of physicians and allow 

them to make decisions based on complete and accurate information. 

Absent complete and accurate information, service chiefs may recommend 

physicians with inappropriate backgrounds for appointment to VAMC 

medical staffs. 

The lack of compliance we found at the six VAMCs indicates that oversight 

of these activities needs heightened scrutiny at all levels—VA, VISN, and 

VAMC. Because credentialing, privileging, and continuous monitoring are 

facility-level processes, vigorous VISN oversight is needed for VA to have 

reasonable assurance that VAMCs are implementing these processes 

adequately. However, oversight of VAMCs’ credentialing and privileging 

activities was insufficient. VISN officials described cursory activities, such 

Page 37 GAO-10-26 VA Credentialing and Privileging 
 

as spending just 2 to 3 minutes per credentialing and privileging file. 

Further, VA’s policy for oversight lacks internal controls, such as a followup mechanism to confirm that identified problems have been properly 

addressed. In addition, while VA has provided guidance on continuous 

monitoring that may be helpful to facilities, we found gaps in monitoring 

efforts and that some facilities continued to use protected information to 

make privileging decisions. 

In order to improve oversight of credentialing, privileging, and continuous 

monitoring processes at VAMCs, we are making three recommendations. 

We recommend that the Secretary of Veterans Affairs direct the Under 

Secretary for Health to take the following 3 actions: 

Recommendations for 

Executive Action 

• Require VISN directors to develop a formal oversight process to 

systematically review credentialing and privileging files and the 

information used to support reprivileging of physicians for compliance 

with VA policies and document results of reviews and corrective actions at 

least annually. The oversight process should include feedback to VAMC 

officials about the proper use of legally protected performance 

information, if necessary. In order to close the feedback loop, the 

oversight process should describe a method of follow up to measure 

whether VAMCs corrected identified weaknesses. 

• Update VetPro to more effectively display physician credentialing 

information. Specifically, VA should improve the display of verified 

information on VetPro’s summary tables and simplify and clarify questions 

related to malpractice and licensure. 

• Collect more information about state medical boards’ policies on the 

release of information, and consider amending VA policy to not require 

written verification for states that do not provide additional information in 

addition to what is available by phone or on the state boards’ Web sites. 

VA provided us with comments on a draft of this report, which we have 

reprinted in appendix II. In its comments, VA agreed with our 

recommendations and described the agency’s planned actions to 

implement them. Specifically, VA said that a workgroup representing VISN 

and VAMC leadership would develop a system of formal oversight for the 

credentialing and privileging process. The system will include 

documentation of results and corrective actions, with follow up at least 

annually. The oversight framework is to be incorporated into a revision to 

VA’s credentialing and privileging policy, which will be completed by June 

Agency Comments 

Page 38 GAO-10-26 VA Credentialing and Privileging 
 

2010. VA also plans revisions to VetPro which are scheduled to be 

completed by September 2012. VA noted that these revisions will include 

easier VetPro usage and will clarify VetPro’s display. Finally, VA said that 

its survey of state medical boards to seek their willingness to provide 

additional information, initiated in October 2009, will be analyzed and 

results considered for inclusion into the current revision of VA’s 

credentialing and privileging policy. VA also provided technical comments, 

which we have incorporated as appropriate. 

We are sending copies of this report to the Secretary of Veterans Affairs, 

appropriate congressional committees, and other interested parties. In 

addition, the report is available at no charge on the GAO Web site at 

http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 

me at (202) 512-7114 or williamsonr@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on the 

last page of this report. GAO staff who made major contributions to this 

Randall B. Williamson 

report are listed in appendix III. 

Director, Health Care 

Page 39 GAO-10-26 VA Credentialing and Privileging 
Page 40 GAO-10-26 VA Credentialing and Privileging 

List of Congressional Addressees 

The Honorable Tim Johnson 

Chairman 

The Honorable Kay Bailey Hutchison 

Ranking Member 

Subcommittee on Military Construction, Veterans Affairs, 

 and Related Agencies 

Committee on Appropriations 

United States Senate 

The Honorable Chet Edwards 

Chair 

The Honorable Zach Wamp 

Ranking Member 

Subcommittee on Military Construction, Veterans Affairs, 

 and Related Agencies 

Committee on Appropriations 

House of Representatives 

The Honorable Bob Filner 

Chairman 

Committee on Veterans’ Affairs 

House of Representatives 

The Honorable Richard J. Durbin 

United States Senate 
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

To determine what policies and guidance the Department of Veterans 

Affairs (VA) has in place to help ensure that information about physician 

professional qualifications, clinical abilities, and clinical performance is 

accurate and complete, we reviewed VA policies and guidance on 

credentialing and privileging and monitoring of physician performance. To 

obtain more information about these policies and guidance, we 

interviewed VA headquarters officials, including VA’s Director, 

Credentialing and Privileging. We reviewed 2008 credentialing and 

privileging accreditation standards issued by The Joint Commission 

(“Joint Commission”), a nonprofit organization that evaluates and 

accredits more than 16,000 health care organizations in the United States, 

including hospitals. We also interviewed officials from Joint Commission, 

including the Senior Vice President for Healthcare Improvement and the 

Vice President, Standards and Survey Methods. 

To obtain information about the potential effects of VA’s policy requiring 

written verification of licensure, we interviewed VA’s Director of Quality 

Standards and two officials from the Federation of State Medical Boards 

(FSMB)—the Senior Director of the Federation Credentials Verification 

Services and Federation Physician Data Center and Credentials 

Verification Service and the Manager of the FSMB Physician Data Center. 

To obtain information on medical board policy related to the disclosure of 

physician licensure information, we conducted a Web-based survey of 

medical boards in all 50 states and the District of Columbia.1

 We opened 

the survey on March 19, 2009, and closed it on April 9, 2009, with a final 

response rate of 76 percent. 

To determine the extent to which selected VA medical centers (VAMC) 

comply with selected VA credentialing and privileging policies, we 

conducted site visits to six VAMCs and reviewed credentialing and 

privileging files for a judgmental sample of 30 physicians at each VAMC, a 

total of 180 physician records. For each physician, we examined 

credentialing and privileging documentation for compliance with VA 

policies. The four credentialing and privileging requirements we selected 

for review included 

 

1

We did not survey state boards of osteopathic medicine. The New York State Education 

Department, Office of the Professions, is responsible for updating physician licensure 

information, while the Department of Health Office of Professional Medical Conduct 

maintains information related to physician discipline. We surveyed each organization 

separately and combined their responses into one response for New York. 

Page 41 GAO-10-26 VA Credentialing and Privileging 
Appendix I: Scope and Methodology 

• verification of all state medical licenses ever held by the physician; 

• verification of malpractice claims by contacting a court of jurisdiction or 

the insurance company involved in the medical malpractice claim, or by 

obtaining a statement of claim status from the attorney representing the 

physician in the malpractice claim; 

• receipt of the minimum number of references; VA requires that physicians 

provide three references prior to their initial appointment at a VAMC and 

two references prior to medical staff reappointment; and 

• query the FSMB about disciplinary actions that state medical boards have 

taken against physician licenses. 

In addition to the four credentialing and privileging requirements, we also 

examined whether credentialers ensured that reprivileging took place 

within 2 years after the previous privileging process. We looked for 

evidence of omissions by physician applicants related to medical licenses, 

malpractice, and at five of six VAMCs visited, gaps in background greater 

than 30 days. We also looked for documentation by physician service 

chiefs—officials responsible for physicians providing particular clinical 

services—of the rationale for credentialing and privileging 

recommendations for physicians as is required by VA policy. We 

interviewed staff responsible for recommending or granting physician 

appointment or privileges—including service chiefs, chiefs of staff, and 

facility directors—about their decision-making processes. We also 

interviewed credentialers who collect documentation to verify physiciansupplied information about their processes for verifying credentialing and 

privileging information. 

At each site we identified a judgmental sample of 30 physicians’ files. In 

selecting the files, we attempted to maximize the number of physician 

medical specialties while also having consistency in the specialties that 

were reviewed at each site. To identify which medical specialties were 

likely to be represented at each site, we identified a list of “core 

specialties” using descriptions of hospital services and lists of designated 

service chiefs at VAMCs. From this core, we identified the three highest 

paying surgical and medicine specialties as well as the highest paying 

specialty from imaging services—since pay is a challenge where VA 

competes with the private sector to hire qualified physicians—and chose 

Page 42 GAO-10-26 VA Credentialing and Privileging 
Appendix I: Scope and Methodology 

two physicians from each of these specialties.2 We reviewed the files of at 

least five newly hired physicians at each site to identify whether the 

facility was complying with VA’s October 2007 credentialing and 

privileging policy, which was in effect when we began our work. In 

addition, at each site we reviewed the files of at least two psychiatrists—

because of VA’s initiative to hire more mental health providers—and all 

physicians who were the only specialist in their discipline on the medical 

staff.3

 In addition, we reviewed the files of at least two general surgeons, 

since problems at the Marion VAMC focused on issues related specifically 

to the clinical skills of a general surgeon at that facility. When the VAMC 

had more than two physicians in each medical specialty we designated, or 

more than five newly hired physicians, we chose files randomly from 

within the whole group of specialists or new physicians. On the basis of 

the sample of physician files we reviewed at each of the six VAMCs, we 

can discuss a facility’s documented compliance for the physician files we 

reviewed; we cannot draw conclusions about the remaining physician files 

at the VAMCs we visited or about the compliance of other VAMCs. 

Because our file review included reviewing information in VetPro, we 

assessed the database’s reliability. To do this, we examined relevant 

documentation and interviewed VA headquarters officials about measures 

VA takes to ensure the reliability of information in VetPro. On the basis of 

our review, we determined that the information in VetPro was sufficiently 

reliable for the purposes of our report. 

We visited the following facilities: Alexandria VAMC (Pineville, Louisiana); 

Edward Hines, Jr. VA Hospital (Hines, Illinois); Lebanon VAMC (Lebanon, 

Pennsylvania); Hunter Holmes McGuire VAMC (Richmond, Virginia); 

Togus VAMC (Augusta, Maine); and VA Montana Health Care System (Fort 

Harrison, Montana). We chose these VAMCs based on a variety of factors, 

 

2

Physician pay data came from the American Medical Group Association’s 2007 Medical 

Group Compensation and Financial Survey. The surgical specialties selected were 

orthopedic surgery, urology, and anesthesiology. The medical specialties selected were 

cardiology, gastroenterology, and dermatology. 

3

We chose these sole specialists because for these physicians peer review often must be 

done using specialists from outside the facility. 

Page 43 GAO-10-26 VA Credentialing and Privileging 
Appendix I: Scope and Methodology 

including location in metropolitan and nonmetropolitan areas,4 geographic 

balance,5

 and facilities’ procedural complexity level.6 We eliminated from 

consideration those facilities that did not perform inpatient surgery 

because the VA Office of Inspector General (OIG) report on the Marion 

VAMC identified weaknesses in the inpatient surgery unit. We also 

excluded the seven facilities we visited in our 2006 report on credentialing 

and privileging,7

 and facilities in Veterans Integrated Service Network 

(VISN) 15 because, during the time of our selection process, a VA official 

told us that the VISN was transitioning away from a centralized 

credentialing process.8

 We conducted our site visits between August 2008 

and February 2009. The results from our site visits are not generalizable to 

all facilities. 

To determine the extent to which VA helps ensure compliance with its 

credentialing and privileging policies, we reviewed VA policy changes in 

October and November 2008 which contained provisions delegating 

credentialing and privileging oversight responsibilities to VISN officials. 

We reviewed GAO internal control standards to determine criteria for 

management oversight.9

 We interviewed the chief medical officer (CMO) 

for each of the six VISNs where we conducted a VAMC site visit to capture 

 

4

We considered area population in the selection process to ensure that we included VAMCs 

in regions that were similar to the Marion VAMC in terms of rurality or geographic 

isolation. To identify those VAMCs in rural and geographically isolated areas, we used the 

Rural-Urban Continuum Codes from the 2007 Area Resource File. We deemed a facility 

rural or geographically isolated if it was located in a nonmetropolitan county or the lowest 

population category for metropolitan counties in the continuum. Facilities that met this 

standard were located in counties in nonmetropolitan areas or in metropolitan areas of less 

than 250,000 people. Four of the six facilities we visited—Lebanon VAMC, VA Montana 

Health Care System, Togus VAMC, and Alexandria VAMC—met this standard. 

5

To address geographic balance, the selected VAMCs were from different VISNs and 

Census divisions. 

6

To consider facility complexity, we used VA’s classification system that assigns VAMCs to 

one of three complexity levels. In descending order of complexity, they are complexity 

level 1 (further subdivided into levels 1a, 1c, and 1c), complexity level 2, and complexity 

level 3. We selected two hospitals at complexity level 1, two hospitals at level 2, and two 

hospitals at level 3. Alexandria VAMC, a complexity level 2 facility at the time of our site 

selection, had been reclassified as a complexity level 3 facility at the time of our site visit. 

7

The VAMCs were located in Boise, Idaho; Kansas City, Missouri; Las Vegas, Nevada; 

Lexington, Kentucky; Martinsburg, West Virginia; Miami, Florida; and San Antonio, Texas. 

8

Marion VAMC is part of VISN 15. 

9

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). 

Page 44 GAO-10-26 VA Credentialing and Privileging 
Appendix I: Scope and Methodology 

information about the review processes in place to oversee the proper 

execution of credentialing and privileging activities. Our interviews with 

VISN CMOs were conducted between December 2008 and May 2009, after 

VA’s policies had been released. We reviewed VA’s August 2009 guidance 

for evaluating VAMCs’ credentialing and privileging processes. Further, we 

analyzed how the VetPro database displays information for users and the 

information that physicians are asked to input into VetPro, and we 

interviewed service chiefs to understand their interpretation of 

information in VetPro. The analysis of the VetPro display included an 

examination of how corrections made by VAMC staff were displayed for 

VetPro users. The information from our site visits cannot be used to 

generalize about practices at all VAMCs, and the information from our 

interviews with VISN officials cannot be used to generalize about VA 

oversight at the VISN level. 

To determine the extent to which selected VAMCs implemented VA 

policies and guidance to continuously monitor physician performance,10

we reviewed relevant VA policies, including those for credentialing and 

privileging, and interviewed VA headquarters officials and the CMOs for 

six VISNs that included the VAMCs we visited. To clarify our 

understanding of accreditation standards relating to physician 

performance monitoring, we interviewed officials from The Joint 

Commission. Finally, we evaluated VAMC implementation of VA policies 

and guidance pertaining to physician performance monitoring on our site 

visits to six VAMCs. We interviewed service chiefs about efforts to monitor 

physician performance at each of the VAMCs we visited, and collected 

documents describing how the individual services conducted continuous 

monitoring of physician performance. We spoke with the service chiefs in 

charge of the surgery, mental health, and medicine services at each facility 

visited.11 We also interviewed service chiefs in primary care, radiology, and 

 

10We conducted our site visits between August 2008 and February 2009. Evaluation of 

VAMC compliance with VA policies on continuous monitoring of physician performance is 

based on VA’s October 2007 policy on credentialing and privileging. While VA issued a 

revised policy in November 2008, we had already conducted several site visits and 

therefore evaluated all six VAMCs based on VA’s 2007 policy. 

11We chose surgery because the VA OIG identified problems with the surgical program at 

the Marion VAMC, and mental health because of a recent VA initiative to hire more mental 

health physicians. At one VAMC we interviewed the associate chief of staff (ACOS) for 

acute care. At this facility, the acute care unit is organized to include physician staff 

positions in internal medicine. While the ACOS for acute care was not the direct supervisor 

for internal medicine physicians, the ACOS has ultimate responsibility for the internal 

medicine practices of the VAMC. 

Page 45 GAO-10-26 VA Credentialing and Privileging 
Appendix I: Scope and Methodology 

long-term care at some facilities. To determine the possible effects of the 

inappropriate use of protected physician performance information, we 

reviewed federal law and interviewed VA general counsel staff. On the 

basis of the information we gathered, we can discuss individual VAMC and 

service compliance with VA policies and guidance to continuously monitor 

physician performance. However, we cannot generalize about the other 

service practices at the selected VAMCs, or about the practices at all 

VAMCs. 

To examine the extent to which VA has oversight mechanisms in place to 

track that VAMCs are performing surgical procedures that match their 

capabilities, we reviewed several VA policies, including policies on 

restructuring clinical programs, quality reviews of surgical programs and 

outcomes, mortality assessment, and peer review for quality management. 

We also reviewed the VA OIG report on the Marion VAMC to identify 

issues related to surgical program oversight, and reviewed and identified 

relevant accreditation standards from The Joint Commission. For 

background information on VA’s National Surgical Quality Improvement 

Program (NSQIP), we reviewed copies of facility-level NSQIP reports, 

NSQIP training materials, and peer-reviewed journal articles on NSQIP. 

We reviewed the final report written by VA’s Operative Complexity and 

Infrastructure Standards Workgroup to identify recommendations to VA in 

implementing its oversight mechanism. We also conducted a series of 

interviews with the VA headquarters officials to obtain additional 

information on implementation for VA’s oversight mechanism. While on 

site visits at the selected VAMCs, we conducted interviews with chiefs of 

surgery, and after the site visits, we conducted follow-up interviews to 

obtain information on the facility-level use of NSQIP and other surgical 

program monitors. The information we obtained through our site visits 

and interviews with chiefs of surgery cannot be generalized to all VAMCs. 

We conducted this performance audit from July 2008 through January 

2010 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

Page 46 GAO-10-26 VA Credentialing and Privileging 
Appendix II: Comments from the Department Appendix II: Comments from the Department of Veterans Affairs 

of Veterans Affairs 

Page 47 GAO-10-26 VA Credentialing and Privileging 
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 48 GAO-10-26 VA Credentialing and Privileging 
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 49 GAO-10-26 VA Credentialing and Privileging 
Appendix III: GAO

A

 Contact and Staff 

cknowledgments 

Page 50 GAO-10-26 VA Credentialing and Privileging 

Appendix III: GAO Contact and Staff 

Acknowledgments 

GAO Contact Randall B. Williamson, (202) 512-7114 

 In addition to the contact named above, Marcia A. Mann, Assistant 

Director; Susannah Bloch; Lori Fritz; Kaitlin McConnell; Kate Nast; Steve 

Robblee; Jessica Cobert Smith; and Rusty Walker made key contributions 

to this report. 

Staff 

Acknowledgments 

(290726) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper