United States Government Accountability Office

GAO Report to the Chairman, Committee on 

Veterans’ Affairs, House of 

Representatives 

VA HEALTH CARE

Selected Credentialing 

Requirements at Seven 

Medical Facilities Met, 

but an Aspect of 

Privileging Process 

Needs Improvement 

May 2006 

 

GAO-06-648 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

May 2006

VA HEALTH CARE

Selected Credentialing Requirements at 

Seven Medical Facilities Met, but an 

Aspect of Privileging Process Needs 

Improvement 

Highlights of GAO-06-648, a report to the 

Chairman, Committee on Veterans' 

Affairs, House of Representatives 

The Department of Veterans Affairs 

(VA) is responsible for determining 

that over 36,000 physicians working

in its facilities have the appropriate

professional credentials and 

qualifications to deliver health care

to veterans. To do this, VA 

credentials and privileges 

physicians providing care at its 

medical facilities. In this report, 

GAO determined the extent to 

which selected VA facilities 

complied with (1) four VA 

credentialing requirements and five

VA privileging requirements and 

(2) a requirement to submit 

information on paid malpractice 

claims. GAO also determined 

(3) whether VA has internal

controls to help ensure the 

accuracy of information used to

renew clinical privileges. GAO

reviewed VA’s policies, interviewed 

VA officials, and randomly sampled 

17 physician files at each of seven 

VA medical facilities. 

What GAO Recommends

GAO recommends that VA provide 

guidance to its medical facilities on 

how to collect physician

performance information in

accordance with VA’s policy that 

can be used to renew clinical 

privileges, enforce the timely

submission of VA medical 

malpractice information, and 

instruct facilities to establish 

internal controls for privileging 

information. VA concurred with the 

findings and recommendations and 

provided an action plan to

implement the three

recommendations. 

GAO found that the files reviewed at seven VA medical facilities complied 

with four of VA’s credentialing requirements selected for review, and all but 

one of five privileging requirements. Credentialing is the process of verifying 

that a physician’s professional credentials, such as state medical licenses, 

are valid and meet VA’s requirements for employment. Privileging is the 

process for determining which health care services a physician is allowed to 

provide to veterans. For the files GAO reviewed, compliance with the fifth 

privileging requirement was problematic at six facilities because officials 

used performance information when renewing clinical privileges but 

collected all or most of this information through their facility’s quality 

assurance program. This is prohibited under VA policy. In general, VA quality 

assurance information is confidential, according to federal law and VA 

policy. According to VA officials, if quality assurance information is used 

outside of a facility’s quality assurance program, it could be used for other 

purposes, including litigation. The information is protected to encourage 

physicians to participate in quality assurance programs by reporting and 

discussing adverse events to help prevent such events from occurring in the 

future. VA has not provided guidance to help medical facilities find ways to 

efficiently collect performance information outside of a facility’s quality 

assurance program. At the seventh medical facility, officials did not use 

performance information to renew clinical privileges, as required. 

Three of the seven medical facilities did not meet VA’s requirement to 

submit, within 60 days after being notified that the claim was paid, any 

information on paid VA medical malpractice claims involving facility 

practitioners, including physicians, to VA’s Office of Medical-Legal Affairs.

This office reviews the information and determines whether practitioners 

involved in the claims delivered substandard care, displayed professional 

incompetence, or engaged in professional misconduct. The office informs 

facilities of its determinations. When facilities do not submit all relevant VA 

malpractice information in a timely manner, VA medical facility officials lack

complete information that would allow them to make informed decisions 

about the clinical privileges that their physicians should be granted. 

VA has not required its medical facilities to establish internal controls to 

help ensure that privileging information managed by medical staff 

specialists—who are responsible for obtaining and verifying the information 

used in the credentialing and privileging processes—is accurate. One facility 

GAO visited did not identify 106 physicians whose privileging process had 

not been completed by facility officials for at least 2 years because of 

inaccurate information provided by the facility’s medical staff specialist. As a 

result, these physicians were practicing at the facility without current 

clinical privileges. Without accurate information on the privileges that have 

been granted to physicians and the dates for renewing those privileges, VA 

medical facility officials will not know if they have failed to renew clinical 

privileges for any of their physicians in accordance with VA policy. 

www.gao.gov/cgi-bin/getrpt?GAO-06-648.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Laurie E. 

Ekstrand at (202) 512- 7101 or 

ekstrandl@gao.gov. 
Contents 

Letter 1

Results in Brief 5 

Background 7

Selected Physician Files at Medical Facilities Demonstrated 

Compliance with Four VA Credentialing and Four Privileging

Requirements; a Fifth Privileging Requirement Was Problematic 15 

Not All Medical Facilities Submitted Paid Malpractice Claim 

Information in a Timely Manner 18 

VA Has Not Established Internal Controls to Help Ensure the 

Accuracy of Medical Facilities’ Privileging Information 21 

Conclusions 22

Recommendations for Executive Action 23 

Agency Comments and Our Evaluation 23 

Appendix I Scope and Methodology 25 

Appendix II Comments from the Department of Veterans Affairs 29 

Appendix III GAO Contact and Staff Acknowledgments 33 

Related GAO Products 34 

Table 

Table 1: Average Number of Months Taken by Three VA Medical 

Facilities to Submit VA Medical Malpractice Claim 

Information to VA’s Office of Medical-Legal Affairs (as of 

December 2005) 20 

Figures 

Figure 1: Steps Taken in VA’s Physician Credentialing Process 10 

Figure 2: Steps Taken in VA’s Physician Privileging Process 13 

Page i GAO-06-648 VA Credentialing and Privileging
Figure 3: Medical Malpractice Claim Information Not Submitted by 

Three VA Medical Facilities to the Office of Medical-Legal 

Affairs within 60 Days 19 

Abbreviations 

FSMB Federation of State Medical Boards 

NPDB National Practitioner Data Bank 

VA Department of Veterans Affairs 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 

Page ii GAO-06-648 VA Credentialing and Privileging
United States Government Accountability Office

Washington, DC 20548 

May 25, 2006

The Honorable Steve Buyer 

Chairman 

Committee on Veterans’ Affairs 

House of Representatives 

Dear Mr. Chairman: 

The Department of Veterans Affairs (VA) has over 36,000 physicians 

working at more than 1,300 facilities in its health care system. To help 

ensure the quality of the health care these physicians deliver and the safety

of veterans, VA is responsible for determining that its physicians have the 

appropriate professional credentials and clinical experience to provide 

health care to VA’s patients.1

 To do this, VA credentials and privileges 

physicians providing care at VA medical facilities. Credentialing is the 

process of verifying that a physician’s professional credentials, such as 

licensure, education, and training, are valid and meet VA’s requirements 

for employment. Privileging is the process for determining—based in part 

on a physician’s credentials—which health care services a physician 

should be allowed to provide to VA patients without supervision.2

 These 

health care services are known as a physician’s clinical privileges. 

Physicians are granted initial clinical privileges when they begin their 

employment at a VA medical facility. Physicians’ professional credentials 

and clinical privileges must be reviewed and renewed at least every 

2 years.3

 VA’s credentialing and privileging policy describes the 

information that VA medical facility officials are required to review and 

verify in order to credential and grant clinical privileges to VA physicians. 

In addition to the requirements outlined in VA’s credentialing and 

privileging policy, medical facility officials are required to submit 

information to VA headquarters on any VA physicians who are involved in

 1

We have performed other work related to this subject. See Related GAO Products listed at 

the end of this report. 

2

Health care services could include, for example, surgical procedures and administering 

anesthesia. 

3

Physicians’ clinical privileges are also reviewed whenever a physician requests that a 

health care service be added or removed from the list of approved clinical privileges. This

may occur before the 2-year renewal period. 

Page 1 GAO-06-648 VA Credentialing and Privileging
paid VA medical malpractice claims. This malpractice information is used 

by VA headquarters to make decisions about the appropriateness of the 

care delivered to veterans and should be used by medical facility officials 

when making decisions about the clinical privileges to grant physicians. 

You expressed interest in the credentialing and privileging of VA 

physicians and how this helps VA ensure the delivery of safe care to 

veterans. In response to your request, we (1) determined the extent to 

which selected VA medical facilities complied with four of VA’s 

credentialing requirements and five of VA’s privileging requirements in 

relation to individual physicians, and (2) determined the extent to which

selected VA medical facilities complied with the requirement to submit 

information to VA headquarters on paid VA medical malpractice claims 

involving VA physicians. Also, during the course of our work, we learned 

about a medical facility where inaccuracies in privileging information 

resulted in 106 physicians providing care to veterans in the facility without 

the required clinical privileges. According to VA officials, the individual 

responsible for privileging data inappropriately changed the privileging 

dates for some of these physicians to a later date in order to delay work 

needed to complete the credentialing and privileging requirements on 

these physicians. This led us to add to our review a reporting objective 

related to internal controls. Specifically, in this report we also 

(3) determined whether VA has internal controls to help ensure the 

accuracy of information medical facilities use to renew physicians’ clinical 

privileges. 

To determine the extent to which selected VA medical facilities complied 

with four of VA’s credentialing requirements and five of VA’s privileging 

requirements in relation to individual physicians, we reviewed VA’s 

policies to identify the requirements that VA medical facility officials must 

follow when credentialing and granting clinical privileges to physicians. 

We selected four of VA’s credentialing requirements for review because 

they are requirements that—unlike others—address information about 

physicians that can change or be updated with new information 

periodically. As a result, VA requires that this information be verified by 

medical facility officials when a physician initially applies for employment 

at VA and at least every 2 years thereafter. Other VA credentialing 

requirements are not subject to change or updating and are required by VA

Page 2 GAO-06-648 VA Credentialing and Privileging
to be verified when the physician initially applies for employment.4

 Under 

the four requirements we reviewed, VA medical facility officials must 

1. verify that all state medical licenses held by physicians are valid; 

2. query the Federation of State Medical Boards (FSMB) database to 

determine whether physicians had disciplinary action taken against 

any of their licenses, including expired licenses; 

3. verify information provided by physicians on their involvement in 

medical malpractice claims at a VA or non-VA facility; and 

4. query the National Practitioner Data Bank (NPDB) to determine 

whether a physician was reported to this data bank because of 

involvement in VA or non-VA paid medical malpractice claims, display 

of professional incompetence, or engagement in professional 

misconduct. 

Of the privileging requirements in VA’s credentialing and privileging

policy, we selected four requirements that VA identifies as general 

privileging requirements. In addition, we selected another privileging

requirement about the use of individual performance information because 

of its importance in the renewal of clinical privileges. The five VA 

privileging requirements we selected are 

1. verify that all state medical licenses held by physicians are valid; 

2. verify physicians’ training and experience; 

3. assess physicians’ clinical competence and health status; 

4. consider any information provided by a physician related to medical 

malpractice allegations or paid claims, loss of medical staff 

membership, loss or reduction of clinical privileges at a VA or non-VA 

facility, or any challenges to a physician’s state medical license; and 

 4

Physicians may also possess credentials that VA does not require to work in a VA facility,

such as a Drug Enforcement Administration certificate, which allows a physician practicing

outside of a VA facility to prescribe controlled substances. If a physician does have these 

other credentials, then VA requires medical facility officials to verify these credentials since 

they may change or be updated periodically. 

Page 3 GAO-06-648 VA Credentialing and Privileging
5. use information on a physician’s performance when making decisions 

about whether to renew the physician’s clinical privileges. 

Two of the five privileging requirements—verify all state medical licenses 

and consider medical malpractice information—are also VA credentialing 

requirements we reviewed. 

To determine the extent to which selected VA medical facilities complied 

with four of VA’s credentialing requirements and five of VA’s privileging 

requirements, we conducted site visits to seven VA medical facilities that 

were chosen based on the diversity of their size and geographic location.

The medical facilities are located in Boise, Idaho; Kansas City, Missouri; 

Las Vegas, Nevada; Lexington, Kentucky; Martinsburg, West Virginia; 

Miami, Florida; and San Antonio, Texas. For each of the seven medical 

facilities, VA officials provided a list of medical facility physicians grouped 

by their clinical specialty. Using this list, at each medical facility we 

randomly selected 17 physicians and obtained files with their credentialing 

and privileging information. Our sample included physicians working in 

VA medical facilities full-time and part-time, through a contract,5

 or 

without direct compensation from VA. In some cases, these physicians 

also worked at non-VA medical facilities. Eight of the 17 physician files at 

each medical facility represent eight clinical specialties that are offered at

most VA medical facilities: anesthesiology, gastroenterology, neurology, 

oncology, ophthalmology, orthopedics, radiology, and urology. Four of the 

17 represent general surgery and internal medicine and 5 of the 17 had no

specialty identified on the list provided by VA. To determine whether the 

files we reviewed demonstrated compliance with the four VA credentialing 

requirements and VA’s privileging requirements at each of the seven VA 

medical facilities, we reviewed paper copy credentialing and privileging 

files for our sample of physicians to determine whether these files 

included documentation demonstrating that medical facility officials had 

complied with the credentialing and privileging requirements. We also 

reviewed credentialing information on these physicians stored in VetPro, a 

Web-based credentialing system VA implemented in March 2001. Based on

the sample of physician files we reviewed at each of the seven medical 

facilities, we can discuss a medical facility’s compliance for the physician 

files we reviewed; we cannot draw conclusions about the remaining 

physician files at the medical facilities we visited or about the compliance 

 5

VA medical facilities can contract with local or national companies in order to obtain 

physician services. 

Page 4 GAO-06-648 VA Credentialing and Privileging
of other VA medical facilities. In collecting information on the 

credentialing and privileging requirements from physician files at each 

facility, we employed standard data collection techniques to ensure the 

accuracy and reliability of the data used in this report. 

Finally, we included in our review a requirement that is related to the 

privileging process. Under this requirement, medical facility officials must 

submit to VA’s Office of Medical-Legal Affairs any information on VA 

practitioners, including physicians, who were involved in a paid VA 

medical malpractice claim. The Office of Medical-Legal Affairs determines 

whether the physicians involved in these claims delivered substandard 

care to veterans.6

 We collected information about the extent to which each 

of the seven medical facilities in our review submitted malpractice 

information to the Office of Medical-Legal Affairs.

To determine whether VA has internal controls to help ensure the 

accuracy of information medical facilities use to renew physicians’ clinical 

privileges, we interviewed the director of VA’s credentialing and 

privileging program, as well as other VA headquarters and medical facility 

officials. We identified the internal controls VA has in place for its 

privileging process and, using GAO’s standards for internal controls in the 

federal government, determined whether these controls are adequate.

7

 For 

a complete description of our scope and methodology, see appendix I. We 

conducted our work from July 2005 to May 2006 in accordance with 

generally accepted government auditing standards. 

The physician files we reviewed at the seven VA medical facilities 

demonstrated compliance with the four credentialing requirements we 

reviewed and four of the five privileging requirements. The files we 

reviewed showed that compliance with the fifth privileging requirement—

to use information on a physician’s performance in making privileging 

decisions—was problematic at six of the seven VA medical facilities we 

visited. At these six medical facilities, officials obtained this information 

from their facility’s quality assurance program. In general, information that 

is collected as part of VA’s quality assurance program is confidential 

Results in Brief 

 6

In this report, determinations of substandard care may also include determinations of

professional incompetence or professional misconduct. 

7

GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, 

D.C.: August 2001). 

Page 5 GAO-06-648 VA Credentialing and Privileging
according to federal law, and VA by policy prohibits the use of such 

information in connection with privileging. This information is protected, 

in large part, to encourage physicians to participate in quality assurance 

programs by reporting and discussing openly the causes of adverse patient 

events to help prevent such events from occurring in the future. According 

to VA officials, if quality assurance information is used outside of a 

facility’s quality assurance program, it could be available for other 

purposes, including litigation. VA has not provided guidance to help 

medical facilities find alternative ways to efficiently collect performance 

information, outside of a facility’s quality assurance program, that could be 

used in the renewal of clinical privileges. At the seventh medical facility, 

officials did not use performance information to renew clinical privileges, 

as required.

Three of the seven medical facilities we visited did not meet the 

requirement to submit, within 60 days, information on paid VA medical 

malpractice claims involving their practitioners, including physicians, to 

VA’s Office of Medical-Legal Affairs. This office reviews the claims 

information and makes a determination of whether practitioners, including

physicians, involved in the claims delivered substandard care to veterans.

If it is determined that the physician delivered substandard care to 

veterans, the medical facility must report the physician to NPDB. When VA 

medical facilities do not submit all relevant information to the Office of 

Medical-Legal Affairs in a timely manner, facility officials make privileging 

decisions without the advantage of determinations on whether VA 

physicians delivered substandard care. In addition, substandard care 

determinations that are required to be reported to the NPDB go 

unreported or reporting is delayed when VA medical facilities do not send 

information in a timely manner to the Office of Medical-Legal Affairs. This 

delay or lack of reporting to NPDB prevents other VA and non-VA facilities 

where the physician may also practice from having complete information 

on the physician’s medical malpractice history. 

VA has not required its medical facilities to establish internal controls to 

help ensure that privileging information managed by medical staff 

specialists—employees responsible for obtaining and verifying the 

information used in the credentialing and privileging processes—is 

accurate. One facility we visited did not identify 106 physicians whose 

privileging process had not been completed by facility officials for at least 

2 years because of inaccurate information provided by the facility’s 

medical staff specialist. As a result, these physicians were practicing at the 

facility without current clinical privileges. Subsequent to our visit, this 

facility implemented internal controls to reduce the risk of a similar 

Page 6 GAO-06-648 VA Credentialing and Privileging
situation occurring in the future. During our site visits, we did not identify

any medical facilities that had established such internal controls. Without 

accurate information on the privileges that have been granted to 

physicians and the dates for renewing those privileges, VA medical facility 

officials will not know if they have failed to renew clinical privileges for 

any of their physicians in accordance with VA policy. 

To better ensure that VA physicians are qualified to deliver care safely to 

veterans, we recommend that VA provide guidance to medical facilities on 

how to collect individual physician performance information in 

accordance with VA’s credentialing and privileging policy to use in the 

renewal of physicians’ clinical privileges, and that VA enforce the 

requirement that medical facilities submit information on paid VA medical 

malpractice claims to VA’s Office of Medical-Legal Affairs within 60 days 

after being notified that the claim is paid. Additionally, we recommend 

that VA instruct its medical facilities to establish internal controls to 

ensure the accuracy of their privileging information. In commenting on a 

draft of this report, VA agreed with our findings and conclusions and 

concurred with our recommendations. VA also provided an action plan to 

address the three recommendations. 

Physicians who work at VA medical facilities are required to hold at least 

one current and unrestricted state medical license. Current and 

unrestricted licenses are those in good standing in the states that issued 

them, and licensed physicians may hold licenses from more than one state. 

State medical licenses are issued by state licensing boards, which 

generally establish state licensing requirements governing their licensed 

practitioners.

8

 To keep a license current, physicians must renew their 

licenses before they expire and meet renewal requirements established by 

state licensing boards, such as continuing education. Renewal procedures 

and requirements vary by state. When state licensing boards discover 

violations of licensing practices—such as the abuse of prescription drugs 

or the provision of substandard care—that result in adverse health effects, 

they may place restrictions on licenses or revoke them. Restrictions issued 

by a state licensing board can limit or prohibit a physician from practicing 

in that particular state. Generally, state licensing boards maintain a 

Background 

 8

State licenses are issued by offices in states, territories, or the District of Columbia, 

collectively referred to as state licensing boards. 

Page 7 GAO-06-648 VA Credentialing and Privileging
database that contains information on any restrictions or revocations of 

physicians’ licenses. 

VA requires its medical facility officials to credential and privilege facility 

physicians periodically in order to work at VA. VA physicians must be 

credentialed and privileged prior to their initial appointment to a facility’s

medical staff and then again at least every 2 years when they must reapply 

for a position on the facility’s medical staff. The latter is known as the 

process of reappointment. 

VA’s Credentialing Process Prior to working at VA, physicians initiate the credentialing process for 

their initial appointment by completing VA’s application process, which 

includes entering into VetPro information used by VA medical facility 

officials in the credentialing process. Among the credentialing information 

that VA requires physicians enter into VetPro, for their initial appointment, 

is information on all the medical licenses they have ever held and the 

states where they have obtained these licenses, including any licenses they 

have held that have expired. For their reappointments, physicians must 

update this credentialing information in VetPro.

Once physicians enter their credentialing information into VetPro, a 

facility’s medical staff specialist—an employee who is responsible for 

obtaining and verifying the information used in the credentialing and 

privileging processes—performs a data check on the information to be 

sure that all required information has been entered. In general, the medical 

staff specialist at each VA medical facility manages the accuracy of 

VetPro’s credentialing data. The medical staff specialist verifies, with the 

original source of the information, the accuracy of the credentialing 

information entered by the physicians. This type of check is known as 

primary source verification. For example, the medical staff specialist 

contacts state licensing boards in order to verify that physicians’ state 

medical licenses are valid and unrestricted. 

Medical staff specialists are required, at initial appointment and at 

reappointment, to verify the status of the state medical licenses physicians 

disclose to VA by listing them in VetPro. The medical staff specialists can 

obtain information on the status of physicians’ state medical licenses by 

accessing the information on state licensing boards’ Web sites or by 

contacting the boards directly. 

At initial appointment only, VA requires medical staff specialists to query 

FSMB, which contains information from state licensing boards. This query 

Page 8 GAO-06-648 VA Credentialing and Privileging
enables officials to determine all the state medical licenses a physician has 

ever held, including those not disclosed by a physician to VA, and whether 

a physician has had any disciplinary actions taken against these licenses. 

VA does not require this query at reappointment because VA headquarters 

regularly receives reports from FSMB on any VA physician whose name 

appears on FSMB’s list, indicating that disciplinary action has been taken

against the physician’s state medical license. When VA headquarters 

receives a report from FSMB, it notifies the appropriate VA medical 

facility. 

VA’s credentialing process requires VA medical staff specialists to verify 

medical malpractice claims at initial appointment and at reappointment. 

These claims may be verified by contacting a court of jurisdiction or the 

insurance company involved in the medical malpractice claim, or by 

obtaining a statement of claims status from the attorney representing the 

physician in the medical malpractice claim. In addition, VA requires 

medical staff specialists to query NPDB, which contains reports by state 

licensing boards, hospitals, and other health care entities on 

unprofessional behavior on the part of physicians or adverse actions taken 

against them. This query enables officials to determine whether physicians 

fully disclosed to VA any involvement they might have had in paid medical 

malpractice claims.9

 Once a physician’s credentialing information has been 

verified, the medical staff specialist sends the information to the 

physician’s supervisor, who is known as a clinical service chief.10 The 

clinical service chief reviews this information along with the physician’s 

privileging information. Figure 1 illustrates VA’s credentialing process. 

 9

NPDB includes information on medical malpractice claims that are paid, but does not

include information on ongoing claims. 

10Clinical services may include surgery, medicine, and radiology. 

Page 9 GAO-06-648 VA Credentialing and Privileging
Figure 1: Steps Taken in VA’s Physician Credentialing Process 

Medical staff specialist gives physician 

access to VetPro

Initial appointment and reappointment

Physician updates information 

stored in VetPro from initial 

appointment

Reappointment

Physician enters information into 

VetPro that includes

• All state medical licenses

including expired licenses

• Any involvement in paid or 

settled medical malpractice 

claims

Initial appointment

Medical staff specialist checks

completeness of VetPro information

Performs primary source verification 

of VetPro information

Queries FSMB (only at initial 

appointment)

Queries NPDB

Sends VetPro information to clinical 

service chief

Initial appointment and

reappointment

Clinical service chief reviews

information sent by the medical staff 

specialist and considers it along 

with the physician’s privileging 

information

Source: GAO analysis of VA credentialing policy.

Note: This credentialing process takes place at VA medical facilities. 

Privileging Process At the same time physicians enter credentialing information into VetPro, 

they complete a written request for clinical privileges. The facility medical 

staff specialist provides the physician’s clinical service chief with the 

requested clinical privileges and information that indicates that the 

credentialing information entered by the physician into VetPro has been 

verified with the appropriate primary sources. The medical staff specialist 

also provides the physician’s clinical service chief with information on the 

Page 10 GAO-06-648 VA Credentialing and Privileging
physician’s ability to perform the clinical privileges requested, including 

whether the physician has had a physical examination performed for 

initial appointment. For reappointment, documentation is required by 

another physician stating that the physician is able to perform both 

physically and mentally the clinical privileges requested. In addition, the 

medical staff specialist provides the clinical service chief with information 

on medical malpractice allegations or paid claims, loss of medical staff 

membership, loss or reduction of clinical privileges, or any challenges to 

the physician’s state medical licenses. 

The requested clinical privileges are reviewed by a clinical service chief, 

who recommends whether a physician should be appointed or reappointed 

to the facility’s medical staff and which clinical privileges should be 

granted. When deciding to recommend clinical privileges, a clinical service 

chief considers whether the physician has the appropriate professional 

credentials, training, and work experience to perform the privileges 

requested. For reappointment only, a clinical service chief is to consider 

observations of the physician’s delivery of health care to veterans, and 

VA’s policy requires that information on a physician’s performance, such 

as a physician’s surgical complication rate, be used when deciding 

whether to renew a physician’s clinical privileges. Based on the clinical 

service chief’s observations and the physician’s performance information, 

the clinical service chief recommends that clinical privileges previously 

granted by the facility remain the same, be reduced, or revoked, and 

whether newly requested privileges should be added.11

Clinical service chiefs forward their recommendations and the reasons for 

the recommendations to the next level of a medical facility’s privileging 

review process, which may be a professional standards board or a medical 

executive committee.12 A medical facility professional standards board or 

the medical executive committee reviews the recommendations of the 

clinical service chief and recommends to the facility director whether the 

 11Reduction of privileges may include restricting or prohibiting a physician from performing

certain procedures or prescribing certain medicines. Revocation of privileges refers to the 

permanent loss of all clinical privileges at that facility.

12At some VA medical facilities, the professional standards board and the medical executive 

committee represent the medical staff, have the same members, and perform the same 

functions so are considered to be one committee. If the committees are separate, the 

professional standards board is generally comprised of three to five physician peers and

the medical executive committee is generally comprised of all facility clinical service 

chiefs. 

Page 11 GAO-06-648 VA Credentialing and Privileging
physician should be appointed to the facility’s medical staff and which 

clinical privileges should be granted to the physician. The 2-year time 

period for renewal of clinical privileges and reappointment to the medical 

staff begins on the date that the privileges are approved by the medical 

facility’s director. The list of approved clinical privileges with the date of

approval is maintained in paper copy files at VA medical facilities and the 

initial appointment or reappointment date is entered into VetPro. Figure 2 

illustrates VA’s privileging process. 

Page 12 GAO-06-648 VA Credentialing and Privileging
Figure 2: Steps Taken in VA’s Physician Privileging Process 

Physician completes written 

request for specific clinical 

privileges

Medical staff specialist sends

physician’s clinical privilege request 

to clinical service chief with 

information that includes

• verification of credentialing 

information

• verification of physician’s training 

and experience

• assessment of physician’s clinical 

competence and health status

Clinical service chief reviews

information sent by medical staff 

specialist and recommends

whether physician should be 

appointed and the clinical 

privileges that should be granted, 

then sends the documentation and 

recommendation to the facility’s

professional standards board/

medical executive committee

Professional standards board/

medical executive committee 

reviews information and

recommends whether physician 

should be appointed and the 

clinical privileges that should be 

granted, then sends documentation 

and recommendation to facility 

director

Facility director makes final 

decision to approve a physician’s

appointment or reappointment and 

recommends clinical privileges

Clinical service chief also 

reviews information on physician’s

performance 

Initial appointment and

reappointment

Reappointment only

Source: GAO analysis of VA privileging policy.

Note: This privileging process takes place at VA medical facilities.

Page 13 GAO-06-648 VA Credentialing and Privileging
According to VA’s policy and a VA memorandum, information concerning 

individual physician performance that is used as part of the privileging 

process to either reduce, revoke, or support13 granting clinical privileges 

must be collected separately from a medical facility’s quality assurance 

program.14 VA’s policy is based on a federal law that restricts the 

disclosure of documents produced in the course of VA’s quality assurance 

program.15 In general, documents created in connection with such a 

program are confidential and may not be disclosed except in limited 

circumstances.16 Individuals who willfully disclose documents that they 

know are protected quality assurance documents are subject to fines up to

$20,000. Although the law states that it is not intended to limit the use of 

documents within VA, VA’s policy expressly prohibits the use of such 

documents in connection with the privileging process. VA’s use of separate 

information sources for quality assurance and privileging decisions is 

intended to maintain the confidential status of documents produced in 

connection with quality assurance programs. According to VA, the 

confidentiality of individual performance information helps ensure 

provider participation, including physicians, in a medical facility’s quality 

assurance program by encouraging providers to openly discuss 

opportunities for improvement in provider practice without fear of 

punitive action. 

VA has another requirement that is related to the renewal of physicians’ 

clinical privileges. Medical facility officials are required to submit to VA’s 

Office of Medical-Legal Affairs information on malpractice claims. This 

information must be submitted within 60 days after being notified about a 

paid malpractice claim. The Office of Medical-Legal Affairs is responsible 

for convening a panel of clinicians to determine whether a VA facility 

physician involved in the claim delivered substandard care. The Office of

 13Support granting clinical privileges means that the clinical privileges previously held by 

the physician will be maintained as well as adding newly requested clinical privileges.

14VA requires its medical facilities to have a quality assurance program. In general, the VA 

quality assurance program consists of specified systematic health care reviews carried out 

by or for VA for the purpose of improving the quality of medical care or the utilization of 

health care resources in VA facilities. See 38 C.F.R. § 17.500 (2005). These programs collect 

data on various clinical process and outcome measures involving physicians and other 

types of practitioners. The measures may include a surgeon’s complication rate or a 

physician’s prescribing of medications. Medical facility officials use these measures to look 

for undesirable patterns and trends in performance. 

1538 U.S.C. § 5705 (2000). 

16See Department of Veterans Affairs, VHA Handbook 1100.19 (Mar. 6, 2001). 

Page 14 GAO-06-648 VA Credentialing and Privileging
Medical-Legal Affairs notifies the medical facility director of the results of 

its review. If it is determined that the physician delivered substandard care

to veterans, the medical facility must report the physician to NPDB within

30 days of being notified of the decision. VA medical facility officials also 

would use this determination to decide whether to grant clinical privileges 

to the physician involved in the VA medical malpractice claim. 

The physician files we reviewed at the seven VA medical facilities 

demonstrated compliance with the four credentialing requirements we 

selected for review and four of five VA privileging requirements. The files 

we reviewed showed that six of the seven medical facilities had problems 

complying with a fifth privileging requirement—to use information on a 

physician’s performance when renewing clinical privileges. Compliance 

with that requirement was problematic largely because in their privileging

decisions facility officials used performance information obtained from 

their facility quality assurance program. Information contained in 

documents created in the course of a VA quality assurance program is 

protected by VA policy that expressly prohibits the agency from using that 

documentation in the privileging process. VA has not provided guidance to

help facilities find alternative ways to efficiently collect performance 

information, outside of a facility’s quality assurance program, that could be 

used in privileging decisions. At the seventh medical facility, officials did 

not use performance information to renew clinical privileges, as required. 

Selected Physician 

Files at Medical

Facilities 

Demonstrated 

Compliance with Four 

VA Credentialing and 

Four Privileging 

Requirements; a Fifth 

Privileging 

Requirement Was 

Problematic 

Physician files at all seven medical facilities demonstrated compliance 

with the four credentialing requirements we selected for review. In all 

cases, the VA facility medical staff specialists contacted state licensing 

boards—a form of primary source verification—to ascertain the status of 

the state medical licenses held and disclosed by their physicians.17 Based 

on the physician files we reviewed, medical staff specialists also queried 

the FSMB database as required to obtain additional information on the 

status of physicians’ medical licenses, including those that may not have 

been disclosed by physicians. Medical staff specialists complied with the 

requirement to contact primary sources, such as courts of jurisdiction, to 

verify information on involvement in medical malpractice claims, 

including ongoing claims, disclosed by physicians. Additionally, in all

cases medical staff specialists queried NPDB to identify those physicians

 17VA medical facility officials may also perform primary source verification of physicians’ 

licenses by querying a state licensing board’s Web site for information on the licenses. 

Page 15 GAO-06-648 VA Credentialing and Privileging
who have been involved in paid medical malpractice claims, including any 

physicians who failed to disclose involvement in such claims. 

The physician files at the seven medical facilities also demonstrated 

compliance with four of the five VA privileging requirements we reviewed. 

We found that medical staff specialists contacted state licensing boards to

verify the status of all state medical licenses held by their physicians and 

to determine whether any of these licenses had any action taken against

them. Medical staff specialists also used primary sources to verify that 

physicians had the necessary training and experience to deliver health 

care and perform the clinical privileges they requested. We found that after 

medical staff specialists performed their verification, clinical service 

chiefs reviewed this information as required, along with information on 

physicians’ health status and information disclosed by the physicians 

about their involvement in medical malpractice allegations or cases in 

which claims were paid. 

While we found evidence demonstrating compliance with four of the five 

privileging requirements, the files we reviewed also showed that there 

were problems complying with the fifth privileging requirement—to use 

information on a physician’s performance in making privileging decisions. 

VA requires that during the renewal of a physician’s clinical privileges, VA

clinical service chiefs use information on a physician’s performance to 

support, reduce, or revoke the clinical privileges the physician has 

requested. However, the performance information cannot be collected as 

part of a medical facility’s quality assurance program. Although medical 

facility clinical service chiefs must use performance information in making 

decisions about renewal of clinical privileges, VA has not provided 

guidance on how facility officials can obtain such information in 

accordance with VA policy—that is, outside of a quality assurance 

program. 

VA’s credentialing and privileging policy states that facilities cannot use 

information collected as part of a facility’s quality assurance program to 

reduce or revoke the clinical privileges requested by physicians, but the 

initial policy guidance was silent about the use of this information to 

support granting the clinical privileges requested by physicians. Officials at 

six medical facilities told us that they used quality assurance information 

to support the granting of clinical privileges requested by their physicians,

but collected all or most of this information through facility quality 

assurance programs. In contrast, facility officials at one medical facility 

did not use individual physician performance information to renew 

physicians’ clinical privileges. 

Page 16 GAO-06-648 VA Credentialing and Privileging
VA issued a directive in September 2004 and a memorandum in October 

2004 which VA headquarters officials told us were intended to clarify for 

medical facility officials the circumstances under which physician 

performance information could not be used in the credentialing and 

privileging process. The September 2004 directive explained the specific 

types of information that are protected, such as information that identifies 

an individual physician, and the October 2004 memorandum explained

that information on a physician’s performance that is collected as part of a 

medical facility’s quality assurance program could not be used to support, 

reduce, or revoke a physician’s clinical privileges. The directive and the 

memorandum did not identify the ways in which medical facility officials 

could efficiently collect physician performance information outside of a 

facility’s quality assurance program that would provide information for 

renewing physicians’ clinical privileges. According to facility officials, 

collecting the same information twice—once for quality assurance and 

once for privileging—is resource-intensive and limits the time they have to

address other issues. 

Without guidance from VA, officials from four facilities told us that they do 

not know how to collect this information in accordance with VA’s policy. 

Facility officials from two other medical facilities said they believed that 

they were complying with VA’s requirement because they stored 

performance information in such a way that the identity of individual 

physicians could not be easily retrieved. Quality assurance staff at these 

two medical facilities assigned a code to each physician and filed the 

performance information by assigned code rather than under an individual 

physician’s name. These staff could then retrieve an individual physician’s

performance information using the code. At one facility, quality assurance 

staff said their regional legal counsel told them that the confidentiality of

the information would be maintained with this type of coding system and 

would allow them to use the information to renew physicians’ clinical 

privileges. However, according to both VA headquarters legal counsel and

the director of VA’s credentialing and privileging program, coding quality 

assurance information in this manner and using it to renew clinical 

privileges could make this information available for other purposes, 

including litigation, and therefore does not comply with VA policy. A VA 

headquarters official told us that the medical facilities need further 

education on how to collect individual physician performance information 

that can be used in the renewal of physicians’ clinical privileges. 

Page 17 GAO-06-648 VA Credentialing and Privileging
We found that three of the seven VA medical facilities we visited did not 

comply with the requirement to submit paid VA medical malpractice claim 

information in a timely manner.18 These facilities had not submitted 

information on 52 paid medical malpractice claims that may have involved

their physicians to VA’s Office of Medical-Legal Affairs within the 60-day 

required time frame for information requested as of December 2005.19 See 

figure 3 for the number of paid VA medical malpractice claims for which 

information was not submitted in a timely manner by the three facilities 

from 2001 through 2005.

Not All Medical

Facilities Submitted 

Paid Malpractice 

Claim Information in 

a Timely Manner 

 18At the time of our review, the remaining four VA facilities did not have any medical 

malpractice claim information that had not been submitted within VA’s 60-day time frame. 

19VA medical malpractice claims may involve physicians or another type of licensed health

care practitioner, such as a nurse. 

Page 18 GAO-06-648 VA Credentialing and Privileging
Figure 3: Medical Malpractice Claim Information Not Submitted by Three VA Medical Facilities to the Office of Medical-Legal 

Affairs within 60 Days 

Number of claims

0

2

4

6

8

10

Claim information that was submitted on time

Claim information that was delinquent

2001 2002 2003 2004 2005 2001 2002 2003 2004 2005 2001 2002 2003 2004 2005

Facility A Facility B Facility C

Source: GAO analysis of VA data.

1 1

4

3

2

5

3

10

2

1

2 2

6

4

6

1

2

2 2

3

6

2

2

2

Note: We considered claim information submitted 14 days after the 60-day time frame to be on time, 

while information submitted 15 or more days after the 60-day time frame, we considered to be 

delinquent. 

The Office of Medical-Legal Affairs is responsible for reviewing 

information on paid VA medical malpractice claims submitted by VA 

medical facilities by forming panels of clinicians to determine whether VA 

practitioners, including physicians, delivered substandard care to veterans 

in these claims.20 When VA medical facilities do not submit all relevant 

claim information to the Office of Medical-Legal Affairs, facility clinical 

service chiefs may make privileging decisions without the knowledge of 

physician peer determinations on whether VA physicians delivered 

substandard care to veterans. In addition, substandard care 

determinations that are required to be reported by facility officials to the 

NPDB go unreported or reporting is delayed when VA medical facilities do 

 20The panel must include at least one reviewer who is a member of the profession of the 

practitioner under review. 

Page 19 GAO-06-648 VA Credentialing and Privileging
not send claim information in a timely manner to the Office of MedicalLegal Affairs. This delay or lack of reporting to NPDB prevents other VA 

and non-VA facilities where the physician may also practice from having 

complete information on the physician’s malpractice history. For example, 

at one facility we visited, we found that from 2001 through 2005, 

information on 21 of the facility’s 26 paid medical malpractice claims had 

not been submitted within the 60-day time frame to VA’s Office of MedicalLegal Affairs.

21 Moreover, on average this medical facility took 30 months 

to submit information to VA’s Office of Medical-Legal Affairs, whereas the 

other two facilities averaged about 5 months to submit information. See 

table 1 for the average number of months it took for these VA medical 

facilities to submit paid VA medical malpractice claim information to VA’s 

Office of Medical-Legal Affairs. 

Table 1: Average Number of Months Taken by Three VA Medical Facilities to Submit 

VA Medical Malpractice Claim Information to VA’s Office of Medical-Legal Affairs 

(as of December 2005) 

Average number of months to submit information on VA

medical malpractice claims

Calendar year Facility A Facility B Facility C

2001 4 57 3

2002 3 47 6

2003 9 34 7

2004 6 3 4

2005 3 3 6

Source: GAO analysis of VA data. 

 21As of March 31, 2006, this medical facility had sent all delinquent medical malpractice 

claims to VA’s Office of Medical-Legal Affairs. 

Page 20 GAO-06-648 VA Credentialing and Privileging
VA has not required its medical facilities to establish internal controls to 

help ensure that privileging information managed by medical staff 

specialists is accurate. One facility we visited did not identify 

106 physicians whose privileging process had not been completed by 

facility officials for at least 2 years because of inaccurate information 

provided by the facility’s medical staff specialist. As a result, these 

physicians were practicing at the facility without current clinical 

privileges. Subsequent to our visit, this facility implemented internal 

controls to reduce the risk of a similar situation occurring in the future. 

During our site visits, we did not identify any medical facilities that had 

established such internal controls. Without accurate information on the 

privileges that have been granted to physicians and the dates for renewing 

those privileges, VA medical facility officials will not know if they have 

failed to renew clinical privileges for any of their physicians in accordance

with VA policy. 

VA Has Not 

Established Internal 

Controls to Help 

Ensure the Accuracy 

of Medical Facilities’ 

Privileging 

Information 

For at least 2 years, one VA medical facility did not identify 106 physicians 

whose privileging process had not been completed by facility officials 

because of inaccurate information provided by the facility’s medical staff 

specialist. According to facility officials, the medical staff specialist 

changed the reappointment dates on some of these physicians to a later 

date in order to delay work she needed to perform to complete the 

credentialing and privileging requirements on these physicians. For other 

physicians, the medical staff specialist removed the physicians’ names 

from the VetPro database so that the physicians would not show up on 

VetPro lists as needing to be reappointed to the facility’s medical staff. 

Facility officials further told us that the medical staff specialist changed 

appointment dates and removed names from VetPro in order to conceal 

the fact that these physicians no longer had current privileges. As a result, 

these physicians were practicing at the facility without current clinical

privileges. The clinical service chiefs, members of the professional 

standards board and the medical executive committee, and the facility 

director were unaware that these physicians were working without 

current clinical privileges, and learned of the problem only after it was 

brought to their attention by an individual newly hired to help the facility’s 

medical staff specialist. Medical facility officials told us that after 

becoming aware of the problem, they confronted the medical staff 

specialist responsible for the data inaccuracies, who then resigned. 

Medical facility officials then began to check the clinical privileges of all of

their physicians and identified inaccuracies in the privileging information 

for 106 physicians. After reviewing the 106 physician files, facility officials 

told us they did not find any problems that would have warranted the 

Page 21 GAO-06-648 VA Credentialing and Privileging
physicians’ removal from the facility’s medical staff or that placed veterans

at risk. 

Although this medical facility did not identify any problems with the 

106 physicians’ clinical privileges or with their clinical competence to 

deliver care to veterans, the potential exists for problems to occur at other 

VA medical facilities. During our site visits, we did not identify any 

facilities that had established internal controls that would help ensure the 

accuracy of the information used to renew clinical privileges. A VA 

headquarters official told us that there is no requirement for VA medical 

facilities to have such internal controls in place. While VA does not require 

facilities to establish these internal controls, the facility that identified 

inaccuracies in its privileging information subsequently implemented 

internal controls to reduce the risk of a similar situation occurring in the 

future. Facility officials have taken steps to help ensure that a similar 

situation does not recur. For example, the facility now provides each 

facility clinical service chief with a list of physicians on a quarterly basis 

and asks the clinical service chiefs to verify that the listed physicians are 

currently working at the medical facility and to identify those physicians 

working at the facility who are not on the list. This allows medical facility 

officials to know if physicians have been inappropriately deleted from 

VetPro and are working at the facility without current clinical privileges. 

Without internal controls such as this for their privileging information, 

VA’s medical facilities may not know whether they have allowed some of 

their physicians to practice with expired privileges. 

VA is responsible for ensuring that its physicians are qualified to deliver 

health care to veterans at VA medical facilities and has requirements in 

place that medical facility officials are to use to help ensure that 

physicians meet these qualifications. VA medical facilities we visited 

complied with the four VA credentialing requirements we reviewed and all

but one of five privileging requirements—to use information on a 

physician’s performance when renewing clinical privileges. While officials 

at six of the seven facilities we visited made an attempt to comply with 

VA’s requirement to use performance information, these officials deviated

from VA’s policy by collecting all or most of the performance information 

through their facilities’ quality assurance programs. This occurred, in part, 

because VA has not provided guidance on how to collect this information 

in accordance with VA’s policy. In addition, VA medical facility officials 

did not have all the information they needed on physicians involved in

paid VA medical malpractice claims, because the facilities had not 

submitted such information to VA’s Office of Medical-Legal Affairs in a 

Conclusions 

Page 22 GAO-06-648 VA Credentialing and Privileging
timely manner. This could have placed veterans at risk of receiving care 

from physicians who did not have adequate clinical skills. Finally, VA has 

not required its medical facilities to establish internal controls to help 

ensure the accuracy of their privileging information. Until VA requires its 

medical facilities to establish internal controls to ensure the accuracy of 

privileging information, facilities are at risk for allowing physicians to 

practice with expired clinical privileges. 

To better ensure that VA physicians are qualified to deliver care safely to 

veterans, we recommend that the Secretary of Veterans Affairs direct the 

Under Secretary for Health to take the following three actions: 

• provide guidance to medical facilities on how to collect individual 

physician performance information in accordance with VA’s credentialing 

and privileging policy to use in medical facilities’ privileging processes, 

• enforce the requirement that medical facilities submit information on paid

VA medical malpractice claims to VA’s Office of Medical-Legal Affairs 

within 60 days after being notified that the claim is paid, and 

• instruct medical facilities to establish internal controls to ensure the 

accuracy of their privileging information. 

In commenting on a draft of this report, VA agreed with our findings and 

conclusions and concurred with our recommendations. VA also provided 

an action plan to address the three recommendations. VA acknowledged

that we identify a challenge faced not only by VA facilities, but by all 

health care facilities, to incorporate physician-specific performance 

information into the credentialing and privileging processes. In addition, 

VA recognized the need to improve facility compliance with submitting 

information on paid VA medical malpractice claims to the Office of 

Medical-Legal Affairs in a timely manner. Further, VA agreed that internal

controls are needed to ensure the accuracy of information used to renew 

physicians’ clinical privileges and has begun the work necessary to 

establish these internal controls at all VA facilities. VA also provided 

details of actions it plans to take to implement the three recommendations 

in the draft report. VA’s written comments are reprinted in appendix II. 

Recommendations for 

Executive Action 

Agency Comments 

and Our Evaluation 

Page 23 GAO-06-648 VA Credentialing and Privileging
As agreed with your office, unless you publicly announce its contents 

earlier, we plan no further distribution of this report until 30 days after its 

date. We will then send copies of this report to the Secretary of Veterans 

Affairs and other interested parties. We also will make copies available to 

others upon request. In addition, the report will be available at no charge 

at the GAO Web Site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 

at (202) 512-7101 or ekstrandl@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff members who made major contributions to this 

report are listed in appendix III. 

Sincerely yours, 

Laurie E. Ekstrand 

Director, Health Care 

Page 24 GAO-06-648 VA Credentialing and Privileging
Appendix I: Scope and Methodology 

Page 25 GAO-06-648 VA Credentialing and Privileging

Appendix I: Scope and Methodology 

To determine the extent to which selected Department of Veterans Affairs’ 

(VA) medical facilities complied with VA’s credentialing and privileging 

requirements, we reviewed policies, procedures, and guidance on VA’s 

credentialing and privileging processes. We also interviewed the director 

of VA’s credentialing and privileging program, as well as officials 

responsible for credentialing and privileging at the VA medical facilities 

we visited. We selected four credentialing requirements for review 

because they are requirements that—unlike others—address information 

about physicians that can change or be updated with new information 

periodically. As a result, VA requires that this information be verified by 

facility officials at least every 2 years. Other credentialing requirements, 

such as where a physician attended medical school or previous 

employment history, are not subject to change or updating and are 

required by VA to be verified when the physician initially applies for 

employment. The four credentialing requirements are 

1. verify that all state medical licenses held by physicians are valid; 

2. query the Federation of State Medical Boards (FSMB) database to 

determine whether physicians had disciplinary action taken against 

any of their licenses, including expired licenses; 

3. verify information provided by physicians on their involvement in 

medical malpractice claims at a VA or non-VA medical facility; and 

4. query the National Practitioner Data Bank (NPDB) to determine 

whether a physician was reported to this data bank because of 

involvement in VA or non-VA paid medical malpractice claims, display 

of professional incompetence, or engagement in professional 

misconduct. 

Of the privileging requirements in VA’s credentialing and privileging

policy, we selected four requirements that VA identifies as general 

privileging requirements. In addition, we selected another privileging

requirement about the use of individual performance information because 

of its importance in the renewal of clinical privileges. The five VA 

privileging requirements we selected are 

1. verify that all state medical licenses held by physicians are valid; 

2. verify physicians’ training and experience; 

3. assess physicians’ clinical competence and health status; 
Appendix I: Scope and Methodology 

4. consider any information provided by a physician related to medical 

malpractice allegations or paid claims, loss of medical staff 

membership, loss or reduction of clinical privileges at a VA or non-VA 

facility, or any challenges to a physician’s state medical license; and 

5. use information on a physician’s performance when making decisions 

about whether to renew the physician’s clinical privileges. 

Two of the five privileging requirements—verify all state medical licenses 

and consider medical malpractice information—are also VA credentialing 

requirements. 

We conducted site visits to seven VA medical facilities that were chosen 

based on size and geographic location. The medical facilities selected for 

review were located in Boise, Idaho; Kansas City, Missouri; Las Vegas, 

Nevada; Lexington, Kentucky; Martinsburg, West Virginia; Miami, Florida; 

and San Antonio, Texas. For each medical facility visited, we obtained 

from VA a list of physicians and their specialties. Using this list, at each

facility we randomly selected 17 physicians and obtained files with their 

credentialing and privileging information. Our sample included physicians 

working in VA facilities full-time and part-time, through a contract, or 

without direct compensation from VA. In some cases, these physicians 

also worked at non-VA medical facilities. At each facility we visited, we 

selected one file from the following clinical specialties that are offered at

most VA medical facilities: anesthesiology, gastroenterology, neurology, 

oncology, ophthalmology orthopedics, radiology, and urology. We also 

selected two physician files from general surgery and internal medicine, 

and five files from physician names that had no specialty identified on the 

list provided by VA. At some facilities, we found that the physician 

specialty indicated on the list provided by VA was incorrect. We replaced

these files by random selection with physician files in the specialty 

needed. 

To determine whether the files we reviewed demonstrated compliance 

with the selected VA credentialing requirements and privileging 

requirements, we compared the documentation found in our sample files 

against the credentialing and privileging requirements. During our site 

visits, we reviewed the documentation in VetPro and in a physician’s paper 

copy credentialing file to determine whether the facility complied with 

each of the four VA credentialing requirements that we reviewed. If 

documentation was present either in VetPro or the paper copy file, we 

determined that the medical facility complied with VA’s requirement. For 

each physician, we reviewed the three most recent appointment cycles—

Page 26 GAO-06-648 VA Credentialing and Privileging
Appendix I: Scope and Methodology 

the period from one appointment process to the next appointment 

process, which occurs every 2 years. Some of the physicians in our sample 

had not been through three appointment cycles. For those physicians, we 

reviewed only the number of cycles that had been completed. We 

documented our findings from these reviews on a data collection 

instrument.

At each medical facility, we reviewed a physician’s paper copy privileging 

file to determine whether the physician’s file contained documentation 

that the medical facility met the five VA privileging requirements we 

examined. For the fifth requirement—use of information on a physician’s

performance when making decisions about whether to renew physicians’ 

clinical privileges—we also interviewed facility officials, including the 

facility quality assurance manager, to determine whether the facility 

collected this physician performance information outside of the facility’s 

quality assurance program. For some physician files we reviewed, the 

physician had only been through initial appointment and therefore did not 

have individual physician performance information in the privileging file.

Based on the sample of physician files we reviewed at each of the seven

medical facilities, we can discuss a medical facility’s compliance for the

physician files we reviewed; we cannot draw conclusions about the 

remaining physician files at the medical facilities we visited or about the 

compliance of other VA medical facilities. In collecting information on the 

credentialing and privileging requirements from physician files at each 

facility, we employed standard data collection techniques to ensure the 

accuracy and reliability of the data used in this report, such as 

interviewing medical facility officials about the accuracy and timeliness of 

the information contained in the physician files we reviewed and taking

steps to have a consistent interpretation of VA’s credentialing and 

privileging requirements for the physician files we reviewed at each 

medical facility. 

To determine the extent to which the selected VA medical facilities 

complied with a requirement to submit information on paid VA medical 

malpractice claims, we obtained data from VA’s Office of Medical-Legal 

Affairs in Buffalo, New York to identify the VA medical facilities that were 

delinquent—more than 60 days had passed since the facility was notified 

that a claim had been paid—in submitting medical malpractice claim 

Page 27 GAO-06-648 VA Credentialing and Privileging
Appendix I: Scope and Methodology 

information to this office.1 The data included the name of the VA medical 

facility, the veteran who was named in the claim, the date the Office of 

Medical-Legal Affairs was notified that a claim had been paid, and the date

the Office of Medical-Legal Affairs notified the facility that a VA medical 

malpractice claim had been paid. VA’s Office of Medical-Legal Affairs 

determines whether a physician who was involved in a VA medical 

malpractice claim delivered substandard care to veterans, and if so, was 

reported to NPDB. We interviewed officials at this office to obtain 

information about VA’s process and requirements for determining if 

substandard care was delivered. 

To determine whether VA has internal controls to help ensure the 

accuracy of medical facility information that is used to renew physicians’ 

clinical privileges, we interviewed the director of VA’s credentialing and

privileging program, as well as other VA officials. We identified the 

internal controls VA has in place for its privileging process and used 

GAO’s standards for internal controls in the federal government to 

determine whether these controls were adequate. During our site visits, we 

determined if any of the seven medical facilities had internal controls in 

place to help ensure the accuracy of the information used to support the 

renewal of clinical privileges. We conducted our work from July 2005 to 

May 2006 in accordance with generally accepted government auditing 

standards. 

 1

We considered claim information submitted 14 days after the 60-day time frame to be on 

time, while information submitted 15 or more days after the 60-day time frame, we 

considered to be delinquent. At the time of our review, four of the seven facilities did not 

have any medical malpractice claim information that had not been submitted within VA’s 

60-day time frame. 

Page 28 GAO-06-648 VA Credentialing and Privileging
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 29 GAO-06-648 VA Credentialing and Privileging

Appendix II: Comments from the Department 

of Veterans Affairs 
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 30 GAO-06-648 VA Credentialing and Privileging
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 31 GAO-06-648 VA Credentialing and Privileging
Appendix II: Comments from the Department 

of Veterans Affairs 

Page 32 GAO-06-648 VA Credentialing and Privileging
Appendix III: GAO

A

 Contact and Staff 

cknowledgments 

Page 33 GAO-06-648 VA Credentialing and Privileging

Appendix III: GAO Contact and Staff 

Acknowledgments 

GAO Contact Laurie E. Ekstrand at (202) 512-7101 or ekstrandl@gao.gov

In addition to the contact named above Marcia A. Mann, Assistant 

Director; Kelly Barar; Mary Ann Curran; Martha A. Fisher; and Krister 

Friday made key contributions to this report. 

Acknowledgments 
Related GAO Products 

Page 34 GAO-06-648 VA Credentialing and Privileging

Related GAO Products 

VA Health Care: Steps Taken to Improve Practitioner Screening, but 

Facility Compliance with Screening Requirements Is Poor. GAO-06-544. 

Washington, D.C.: May 25, 2006. 

VA Health Care: Improved Screening of Practitioners Would Reduce Risk

to Veterans. GAO-04-566. Washington, D.C.: March 31, 2004. 

VA Health Care: Veterans at Risk from Inconsistent Screening of 

Practitioners. GAO-04-625T. Washington, D.C.: March 31, 2004. 

(290422) 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER