Veterans' Health Care: Improved Oversight of Community Care Physicians' Credentials Needed
Released: 2016-09-19T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: To help ensure that veterans are provided timely and accessible health care, VHA purchases care from community physicians. Two community care programs, PC3 and Choice, require physicians to hold certain credentials reflecting their qualifications. Congress included a provision in law for GAO to review VHA's processes for, and oversight of, credentials verification for PC3 and Choice physicians. This report examines (1) whether VA contractors comply with contractual requirements for verifying PC3 and Choice physicians' credentials; (2) the extent to which VHA oversees the contractors responsible for verifying the credentials of PC3 and Choice physicians; and (3) VHA's own processes for, and oversight of, verifying Choice physicians' credentials under recently implemented VHA Choice provider agreements. GAO reviewed PC3 and Choice contracts, VHA and contractor policies, and federal internal control standards. GAO reviewed a nongeneralizable sample of 50 PC3 and 50 Choice physician credentials files, selected among five types of care across the nation. GAO also interviewed VHA officials and contractor representatives.

section_title: What GAO Found
paragraphs: GAO found that the Department of Veterans Affairs' (VA) contractors—Health Net Federal Services (Health Net) and TriWest Healthcare Alliance (TriWest)—complied with contractual requirements to verify the credentials of physicians under one community care program, but were deficient in doing so under another program. Based on GAO's review of selected physicians, GAO found that the contractors almost always verified and documented the credentials of physicians in the Veterans Health Administration's (VHA) Patient-Centered Community Care (PC3) program consistent with the requirements of the contract. In contrast, the contractors did not always verify credentials of the physicians in the Veterans Choice Program (Choice) in a timely manner; and for many physicians, contractors could not produce documentation to support verification consistent with the requirements of the contract. For example, Health Net did not document verification of six Choice physicians' certification to prescribe controlled substances, and TriWest provided insufficient documentation for GAO to determine whether it verified most of the selected Choice physicians' credentials. Both contractors shared plans to address the identified deficiencies.

VHA lacked a comprehensive strategy for overseeing Health Net's and TriWest's compliance with contract requirements for verifying the credentials of PC3 and Choice physicians. VA's contracts with Health Net and TriWest specify that VHA will review the contractors' credentialing periodically to determine whether the contractors are in full compliance with the terms of the contract. In addition, federal internal control standards call for monitoring, and corresponding guidance suggests that agencies consider having a strategy to ensure that monitoring is effective. However, GAO found that VHA's monitoring is primarily limited to independent reviews of physicians' credentials using primary source databases, rather than oversight of the contractors' processes for verifying physicians' credentials. VHA has evaluated TriWest's documentation of verifying physicians' credentials for PC3 physicians, but not Health Net's, and has not evaluated either contractor for Choice physicians. Additionally, VHA officials provided conflicting information about the scope, frequency, and interpretation of the results of the oversight they do conduct. Without a comprehensive oversight strategy, VHA cannot ensure that Health Net and TriWest are in compliance with the terms of the contract and that veterans are treated by qualified physicians.

In February 2016, VHA began entering into Choice provider agreements with community physicians to provide Choice care to veterans in certain situations. Under these agreements, VHA staff at each medical facility—rather than the contractors—review Choice physicians' credentials. GAO found that VHA did not require its staff to verify licenses submitted by physicians against the issuing source; rather, they review copies of the licenses. Federal internal control standards state that management should identify potential risk factors, such as opportunities for fraud, due to the absence of controls. Without assessing the risk of not verifying physicians' licenses against the issuing source, VHA does not know if a policy change is needed. Furthermore, VHA lacked plans for overseeing staff across each of its medical facilities with the new responsibility of verifying Choice physicians' credentials under the recently implemented VHA Choice provider agreements.

section_title: What GAO Recommends
paragraphs: VHA should develop a comprehensive oversight strategy that includes monitoring and evaluations of the contractors' verification of PC3 and Choice physicians' credentials, as well as VHA staff's review of Choice physicians; and assess the risk of not verifying Choice physicians' licenses under VHA Choice provider agreements. VA concurred with these recommendations.

section_title: Letter
paragraphs: The majority of veterans using health care services delivered by the  Department of Veterans Affairs (VA) receive care in medical facilities  operated by VA’s Veterans Health Administration (VHA). However, some  VHA medical facilities have experienced long wait times for veterans  needing care or cannot provide certain specialty care services at the  facility. To help ensure that veterans are provided timely and accessible  care, the department has purchased health care services from non-VA  community physicians through its community care programs since 1945.  In 2015, VA obligated $10.5 billion for community care. Two more recent  community care programs—Patient-Centered Community Care (PC3)  and the Veterans Choice Program (Choice)—are the first to include  credentials requirements, such as an unrestricted state medical license  and a lack of sanctions that would prevent participation in federally  funded health care programs, in order to demonstrate that physicians are  qualified to provide care to veterans. Credentials verification is an  important means by which health care organizations gain assurance that  patients receive safe, high quality care.

VA awarded PC3 contracts in September 2013 to Health Net Federal  Services (Health Net) and TriWest Healthcare Alliance (TriWest). These  contracts require that Health Net and TriWest each develop a regional  network of providers, including physicians, to deliver care to veterans  when care cannot be delivered at a VHA medical facility. The contracts  specify that Health Net and TriWest are responsible for verifying that  physicians in their networks hold certain credentials, such as state  medical licenses and eligibility for participation in federally funded health  care programs.

In 2014, a well-publicized series of events continued to call into question  VHA’s ability to deliver veterans timely access to care in its own facilities.  To improve veterans’ access to medical services, Congress enacted the  Veterans Access, Choice, and Accountability Act of 2014 (Choice Act),  which provided, among other things, temporary authority and additional  VA funding to allow veterans who meet expanded eligibility requirements  to obtain health care services from community physicians. The Choice  Act included credentials requirements for physicians to be eligible to  furnish care or services to veterans under the program. In implementing  the Choice Act, VA modified its existing PC3 contracts to include Choice  and required Health Net and TriWest to ensure that participating Choice  physicians possess a specific set of credentials. In addition to Health  Net’s and TriWest’s responsibilities for administering Choice, VHA  recently began entering into agreements with community physicians to  provide Choice care to veterans in situations when the contractors are  unable to do so. The agreements VHA enters into with physicians to  provide such care are referred to as VHA Choice provider agreements.  Under VHA Choice provider agreements, staff at VHA medical facilities  are responsible for ensuring that physicians hold the required credentials.

The Choice Act included a provision for GAO to report to Congress on  VHA’s use of contractors and its own staff for verifying the credentials of  PC3 and Choice physicians, and VHA’s oversight of these processes.  This report examines  1.  whether VA contractors comply with contractual requirements for  verifying PC3 and Choice physicians’ credentials;  2.  the extent to which VHA oversees the contractors responsible for  verifying the credentials of PC3 and Choice physicians; and  3.  VHA’s own processes for verifying Choice physicians’ credentials, and  oversight of responsible VHA staff, under the recently implemented  VHA Choice provider agreements.

To examine whether VA contractors comply with contractual requirements  for verifying PC3 and Choice physicians’ credentials, we reviewed VA’s  contracts with Health Net and TriWest to identify credentials requirements  for PC3 and Choice physicians, including Choice Act requirements  incorporated into the contracts with respect to Choice physicians. We also  reviewed Health Net’s and TriWest’s credentials policies, and interviewed  representatives from each contractor regarding their credentials  verification procedures. For each contractor, we selected and reviewed a  nongeneralizable sample of 50 physician credentials files—25 PC3  physician files and 25 Choice physician files—for a total of 100 physician  credentials files, to determine whether the contractors complied with  contractual requirements. We selected files for physicians that deliver five  of the most common types of care—obstetrics and gynecology,  ophthalmology, primary care, psychiatry, and surgery—across each of the  four census regions (Northeast, Midwest, South, and West). We selected  physicians who had seen veteran patients, as well as physicians who had  not, based on VHA payment information as of January 2016. Information  obtained from our review of 100 contractor PC3 and Choice physicians’  credentials files cannot be generalized to all contractor PC3 and Choice  physicians. To assess the reliability of the data used to select our sample,  we interviewed knowledgeable agency officials about their respective  data sources and methods for collecting data, manually reviewed the  data, and electronically tested the data for missing values and obvious  errors. We concluded that the data were sufficiently reliable for our  purposes. After reviewing the credentials files in our sample, we reviewed  with contractor staff all instances of documentation we were unable to  locate. To identify industry standards for verifying credentials, we  interviewed representatives and reviewed documentation from URAC, an  accreditation organization.

To examine the extent to which VHA oversees the contractors  responsible for verifying the credentials of PC3 and Choice physicians,  we reviewed VA’s contracts with Health Net and TriWest, as well as  agency documents related to VHA’s oversight of the contractors. We also  interviewed VHA officials regarding VHA’s oversight activities of Health  Net’s and TriWest’s verification of PC3 and Choice physicians’  credentials. We compared VHA’s oversight activities and mechanisms  with federal internal control standards for monitoring.

To examine VHA’s own processes for verifying Choice physicians’  credentials, and oversight of responsible VHA staff, under the recently  implemented VHA Choice provider agreements, we reviewed agency  documents and interviewed VHA staff regarding credentials verification  procedures and oversight activities. We compared VHA’s processes for  verifying Choice physicians’ credentials with the contractors’ processes  for verifying Choice physicians’ credentials. We compared VHA’s  oversight activities related to the VHA Choice provider agreements with  federal internal control standards for monitoring and risk assessment.  We also interviewed officials at the five VHA medical facilities that  participated in the initial implementation phase of VHA Choice provider  agreements.

We conducted this performance audit from November 2015 to September  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: VA Community Care Programs
paragraphs: PC3 and Choice are among several VA community care programs, each  of which has varying eligibility requirements and types of services  offered. While the amount of claims VA paid for the treatment of  veterans under PC3 decreased by about half over the past year, the  amount has more than tripled for the treatment of veterans under Choice.

PC3 was not specifically enacted by law, but was created by VA under  existing statutory authorities to provide veterans with needed care that is  not feasibly available from a VHA medical facility. VA originally required  its PC3 contractors, Health Net and TriWest, to each develop regional  networks, made up of community providers of specialty care, mental  health care, limited emergency care, and maternity and limited newborn  care. VA and the contractors began implementing PC3 in October 2013,  and it was fully implemented nationwide as of April 2014. In August 2014,  VA expanded PC3 to allow community providers of primary care to join  Health Net’s and TriWest’s networks.

Veterans may be eligible to obtain care under PC3 when they are unable  to access a particular service from a VHA medical facility, either because  the service is not offered or the veteran would have to travel a long  distance to obtain it from a VHA medical facility. The veteran’s VHA  provider requests an authorization for care, and if approved, the  responsible contractor tries to arrange for care for the veteran with one of  the providers in its PC3 network.
subsections: section_title: Choice
paragraphs: The Choice Act provides, among other things, temporary authority and  funding for veterans to obtain certain types of health care services from  community providers to address long wait times, lengthy travel distances,  or other challenges accessing care at a VHA medical facility. Under this  authority, VHA introduced Choice in November 2014. As stated in VHA’s  December 2015 guidance, Choice allows eligible veterans to obtain  health care services from community providers if the veteran meets any  of the following criteria:  the next available medical appointment with a VA provider is more  than 30 days from the veteran’s preferred date or the date the  veteran’s physician determines he or she should be seen;  the veteran lives more than 40 miles driving distance from the nearest  VHA medical facility with a full-time primary care physician;  the veteran needs to travel by air, boat, or ferry to the VHA medical  facility that is closest to his or her home;  the veteran faces an unusual or excessive burden in traveling to a  VHA medical facility based on geographic challenges, environmental  factors, or a medical condition;  the veteran’s specific health care needs, including the nature and  frequency of care needed, warrants participation in the program; or  the veteran lives in a state or territory without a full-service VHA  medical facility.

Choice is primarily implemented through VA’s contracts with Health Net  and TriWest; however, staff at VHA medical facilities have also, under  certain conditions, begun entering into VHA Choice provider  agreements. Specifically, VHA Choice provider agreements can be  used when 1) the services are not covered under VA’s contracts with  Health Net and TriWest, or 2) Health Net or TriWest cannot deliver the  care and returns the authorization request to the VHA medical facility for  certain reasons. If the needed services are covered by the VA contracts  for Choice care, VHA must give Health Net and TriWest the first  opportunity to arrange the care for the veteran. VHA began entering into  Choice provider agreements in February 2016. As of July 14, 2016, VHA  reported that its medical facilities had 4,859 VHA Choice provider  agreements in place, and had used 925 of them to authorize Choice care  for veterans.

section_title: Hierarchy of VA Community Care Referrals
paragraphs: Because some veterans could be eligible for more than one type of VA  community care—for example, if they live a long distance from a VHA  medical facility—VHA issued guidance on the hierarchy of community  care referrals. Given that Congress designated funding specifically for  Choice, the guidance communicates a preference for the use of Choice,  whenever possible. Specifically, when a VHA medical facility determines  that there is a need for community care, VHA instructs them to first refer  the veteran to the appropriate contractor for Choice care if the veteran  meets the eligibility criteria and the needed services are covered by  Choice. If the veteran is eligible for Choice care, but the contractor is  unable to arrange for the care, the facility may use a VHA Choice provider  agreement or another type of community care, such as PC3. If the  veteran is not eligible for Choice or the needed services are not covered  by Choice, the VHA guidance says VHA medical facility staff may use  their discretion to refer the veteran to another type of community care. As  of July 2016, both Health Net and TriWest reported that Choice care  made up the vast majority of their authorizations.

section_title: Credentials Verification
paragraphs: The process of reviewing and verifying physicians’ credentials, also  known as credentialing, includes inspecting and authenticating the  documents that constitute evidence of appropriate education, training,  licensure, and experience to ensure the physician is qualified to practice  medicine in the designated setting. Industry standards for credentialing,  developed by various accreditation organizations, such as URAC,  generally require accredited organizations to verify credentials in order to  confirm the factual accuracy and authenticity of the information submitted  by the physician. The industry standards call for some credentials, such  as medical licenses, to be verified using the primary source—the original  or issuing source of the credential. In the case of a medical license, the  primary source would be the state licensing board that issued the license.  Other credentials may be verified using accepted secondary sources,  such as the National Practitioners Data Bank for verifying malpractice  history. The standards also call for documentation of credentials  verification activities, such that there is evidence that verification was  conducted consistent with requirements and standards.

VA contracted with Health Net and TriWest to conduct credentials  verification for PC3 physicians in their respective networks, and maintain  documentation of this verification. To implement contractual requirements  for PC3, Health Net and TriWest verify PC3 physicians’ credentials in  accordance with URAC accreditation standards for credentialing. For  example, Health Net and TriWest verify licenses, education and training,  and malpractice history for each PC3 physician, and conduct  reverification at least once every three years.

Health Net and TriWest are also required to verify the credentials of  Choice physicians; however, to further the goal of getting veterans access  to care quickly under Choice, VA chose to require fewer credentials for  Choice physicians. According to a VHA official, it generally takes  between 5 and 10 days to complete the credentials verification process  for Choice physicians, compared to 90 days for PC3. Specifically, in  contrast to traditional credentialing, VA’s contracts only require Health Net  and TriWest to ensure that Choice physicians hold an active, unrestricted license in the state where Choice service have a national provider identification (NPI) number; have a Drug Enforcement Agency (DEA) number to prescribe are not excluded from participation in federally funded health care participate in Medicare.

Health Net’s and TriWest’s contracts require them to comply with section  101 of the Choice Act, which also requires Choice physicians to submit  verification of their credentials at least annually. VHA policy requires  Choice physicians who participate in VHA Choice provider agreements to  submit a similar set of credentials at least annually. For additional detail  on the different credentials requirements, see figure 1.

section_title: VA’s Consolidation of Community Care
paragraphs: The VA Budget and Choice Improvement Act required VHA to develop a  plan for consolidating community care, and VHA submitted its plan to  Congress on October 30, 2015. In its submission to Congress, VHA  outlined its plan to consolidate all of its existing community care  programs, including PC3 and Choice, into a single program with uniform  credentials requirements for all participating physicians. VHA’s plan  stated that it does not currently have a standard approach to credentialing  under the various existing community care programs. In April 2016, VA  published a draft of a performance work statement for a future contract for  consolidated community care in order to solicit comments and  suggestions from interested parties. The April 2016 draft specifies that  the contractors’ credentialing program will be accredited by a national  organization and shall perform credentialing in accordance with the  accreditation standards.

section_title: VA Contractors Complied with Requirements for Verifying Selected PC3 Physicians’ Credentials, but their Verification of Choice Physicians’ Credentials was Deficient
subsections: section_title: VA Contractors Complied with Contract Requirements for Verifying Selected PC3 Physicians’ Credentials
paragraphs: We found that both Health Net and TriWest complied with contractual  requirements to verify PC3 physicians’ credentials and maintain  documentation for our selected sample. To meet these requirements,  both Health Net and TriWest developed written policies on the types of  credentials required and how to verify them, and both contractors  submitted an outline of their credentials verification procedures to VHA.  Both contractors also have quality assurance mechanisms in place that  include routinely reviewing a sample of files for errors and missing  information.

We reviewed the credentials files for 50 PC3 physicians and found that  Health Net always conducted credentials verification consistent with its  policies and procedures, and TriWest almost always did so. We identified  three deficiencies among the 25 selected PC3 physicians from TriWest.  Specifically, we found that TriWest did not verify one physician’s license, one physician’s absence from the exclusionary list, and one physician’s malpractice insurance coverage.

We found that Health Net and TriWest document credentials verification  in different ways. TriWest’s procedure is to maintain copies of credentials  verification from primary sources (such as a printout from the state  licensing board website for each physician), while Health Net’s procedure  is to document discrete data elements from the verification sources (such  as the name of the source and the date the credential expires). Both  approaches are acceptable under URAC accreditation standards and  allowed us to observe that credentials verification had been conducted.

section_title: VA Contractors’ Verification of Selected Choice Physicians’ Credentials was Deficient
paragraphs: We identified deficiencies in both Health Net’s and TriWest’s verification  of credentials for the 50 selected Choice physicians we reviewed. VA’s  contracts specify five types of credentials that are required for Choice  physicians and incorporate the Choice Act requirement that Choice  physicians submit verification of their credentials at least annually. We  found that the contractors did not always verify the credentials of Choice  physicians in a timely manner and often could not produce documentation  to demonstrate that verification occurred.

Initial verification: Of the 50 selected Choice physicians from Health  Net and TriWest, we identified one physician from Health Net whose  credentials had not been verified before treating veterans.  Specifically, we found that Health Net conducted the verification of  this physician after we identified the physicians for our review, at  which time the physician had treated at least three veterans. This is  inconsistent with VA’s contract, which calls for Health Net to ensure  that each physician holds the specified set of credentials in order to  deliver Choice care.

Annual reverification: Health Net’s and TriWest’s contracts incorporate  a Choice Act requirement that physicians must submit verification of  their credentials at least annually. In practice, the Choice physicians  do not submit verification of their credentials, because the information  needed for verification is available to Health Net and TriWest through  online databases, such as state licensing board websites. VHA  officials and representatives of both Health Net and TriWest  consistently interpreted the provision of the Choice Act to require  annual reverification of the physicians’ credentials.

However, we did not find evidence that Health Net and TriWest were  conducting this annual reverification among the 50 selected Choice  physicians. Specifically, we identified six Health Net Choice  physicians whose credentials had been initially verified over a year  before our review. At the time of our review, Health Net could not  provide documentation of reverifying these physicians within a year of  their initial verification, but provided documentation of reverifying five  of them after we identified our sample. Upon reverifying these  physicians, Health Net learned that one physician was no longer  participating in Medicare. Health Net representatives told us they had  discontinued this physician from Choice participation. Following our  review, Health Net representatives told us they could provide  evidence that they had reverified these physicians three months prior  to our review. Specifically, they had provided a list of 48,000  providers, including these six physicians, to an outside vendor to  reverify the required credentials. Health Net representatives explained  that they had not loaded this information into the database, and thus  they had not provided evidence of this reverification to us during our  review. At the time of our review, reverification was not part of  TriWest’s process. Of the 25 Choice physicians that we selected  from TriWest, there were eight physicians in our sample whose  credentials were initially verified over a year before our review, and  we did not find evidence that they had been reverified. The other 17  physicians’ credentials were initially verified within the year prior to our  review.

Documentation: Health Net could not produce documentation of the  initial verification of six physicians’ DEA numbers, though Health Net  included an annotation on the documentation for our review that it had  conducted the verification. While Health Net conducted the DEA  verification for these physicians just before our review, all six  physicians had each treated at least 15 veterans by that time.

Similarly, TriWest provided insufficient documentation for us to  determine whether it verified most of the selected Choice physicians’  credentials. Specifically, TriWest provided screenshots of its  credentialing database that included limited information, such as the  physician’s name and the state issuing the credential and the  registration number of the credential. However, the screenshots of the  database rarely included license expiration dates and did not include  information about who conducted the verification, what source was  used, or when it was conducted. Unlike TriWest’s process for  documenting verification of PC3 physicians’ credentials, TriWest was  not saving screenshots of the source documents that would contain  this type of information for most Choice physicians. Based on this  documentation, it was not possible for us to tell whether the  information in the database was obtained from the physician or  whether TriWest had conducted any verification of credentials.

TriWest representatives explained that responsibility for verifying most  Choice physicians’ credentials was assigned to staff who did not have  access to TriWest’s credentialing database used for entering  information and saving documentation; rather, these staff said they  took mental note of their verification activities without documenting  anything. TriWest representatives further explained that other staff  with access to the credentialing database take the information that  was obtained and enter it into the credentialing database, but do not  look for missing or incorrect information.

The lack of documentation makes it difficult to determine whether  credentials verification actually occurred. In fact, TriWest  representatives disclosed that they identified deficiencies among the  25 selected physicians, which we would not have been able to identify  from the documentation provided. Specifically, TriWest identified 4  physicians who were not meeting the contract’s Medicare-participation  requirement as a result of our request. TriWest representatives told us  they had terminated these physicians from Choice participation. In  addition, TriWest acknowledged that their database was missing the  DEA numbers for 21 of the 25 selected physicians, though they had  added them to the database prior to sending the files to us. As a result  of this finding, TriWest conducted a systematic review of physicians in  its database and identified an additional 1,817 Choice physicians  whose DEA numbers were missing. TriWest representatives said they  have added the missing information to the database and have  retrained their staff on the verification of Medicare-participation and  DEA numbers.

Unlike their processes for PC3, neither Health Net nor TriWest had  developed written policies on verification of Choice physicians’ credentials  at the time of our review. Additionally, both contractors were conducting  little to no oversight of the staff responsible for Choice credentials  verification. Neither contractor was including Choice physicians in its  routine quality assurance monitoring that they conduct of PC3 physicians’  credentials files. A Health Net official reported routinely checking  credentials against the primary sources for a sample of Choice physicians  in order to identify physicians that do not have the appropriate credentials  to participate in the program. However, without reviewing documentation  in the credentials files, this official could not identify the deficiencies with  the process like we identified related to timely verification and  documentation.

Health Net and TriWest representatives attributed the deficiencies we  identified to Choice being set up very quickly, and Choice being different  from the typical credentials verification process for which they are  accredited. Both Health Net and TriWest provided us with copies of  written policies on the verification of Choice physicians’ credentials  developed following our review, and both described plans for additional  improvements, such as reassigning credentials verification responsibility  to staff with access to the credentialing database where documentation is  stored. These plans, if implemented, could potentially result in better  compliance with the contract, a determination that VHA would be  responsible for making through future oversight.

section_title: VHA Lacked a Comprehensive Strategy for Overseeing Contractors Responsible for Verifying the Credentials of PC3 and Choice Physicians
paragraphs: We found that VHA lacked a comprehensive strategy for overseeing  Health Net’s and TriWest’s compliance with contract requirements for  verifying the credentials of PC3 and Choice physicians. VA’s contracts  with Health Net and TriWest include a section referred to as the quality  assurance surveillance plan (QASP), which specifies that VHA will review  the contractors’ credentialing periodically to determine whether the  contractors are in full compliance with the terms of the contract. In  addition, federal internal control standards call for monitoring, and  corresponding guidance suggests an agency consider having a strategy  to ensure that monitoring is effective. However, we found that VHA’s  monitoring is primarily limited to independent reviews of physicians’  credentials using primary source databases, rather than oversight of the  contractors’ verification processes through review of documentation. VHA  has conducted only one evaluation of the contractors’ documentation of  verifying physicians’ credentials. Additionally, VHA officials provided  conflicting information about the scope, frequency, and interpretation of  the results of the oversight they do conduct.

We found that VHA conducts monthly ongoing monitoring of certain types  of credentials in two ways. Each month, Health Net and TriWest each  submit to VHA a list of PC3 and Choice providers in its network, including  physicians. First, VHA checks that all providers listed, including  physicians, are not on the exclusionary list from participation in federal  programs. VHA also selects a sample of providers, including physicians,  from the contractors’ lists each month and checks online databases to  verify that they possess certain credentials. The QASPs call for 100  percent compliance with credentials requirements. From September 2015  to February 2016, VHA reviewed 484 physicians and identified 18  physicians with a potential issue, such as an expired license in the state  where the physician practices. VHA also reviewed 698 non-physician  providers during the same period and identified 33 with a potential issue.  VHA expects the contractor to terminate any physician VHA identifies as  having an issue, and VHA officials told us they check subsequent monthly  lists to ensure that identified physicians have been removed. However,  this ongoing monitoring does not identify systematic deficiencies in the  contractors’ processes for verifying physicians’ credentials, such as not  annually reverifying physicians. As we demonstrated through our review  of the contractors’ credentials files, reviewing documentation can reveal  such deficiencies and help ensure that the contractors’ processes are  being implemented to identify physicians that do not have the required  credentials to care for veterans through these community care programs.

We also found that VHA has conducted one evaluation of the contractors’  documentation of verifying physicians’ credentials: an audit of TriWest’s  credentials verification for PC3 physicians. This audit—similar to our  review—generally found TriWest’s credentials verification for PC3  physicians to be reliable, but did identify some instances of insufficient  documentation. VHA has not conducted any similar evaluations of Health  Net’s documentation of verifying PC3 physicians’ credentials, despite  original intentions of auditing both contractors. Further, VHA officials  responsible for auditing VHA programs have not conducted any audits of  either of the contractors’ verification of credentials for Choice  physicians.

In the absence of a comprehensive oversight strategy, we found that VHA  officials lacked consensus regarding their oversight plans and provided  conflicting information about the scope, frequency, and interpretation of  the results of their existing oversight activities. Specifically, various VHA  officials we interviewed had conflicting understandings of whether the  monthly reviews included both PC3 and Choice physicians. For example,  VHA officials responsible for conducting the reviews were including both  PC3 and Choice physicians in the monthly samples. However, the  officials responsible for overseeing the contracts and reporting the results  to the contractors via the QASPs were reporting the results as specific to  Choice. An analysis of the samples from the monthly reports we reviewed  revealed that 22 percent of physicians sampled were Choice physicians  and the remainder were PC3 physicians. In addition, while federal entities  such as VHA have the discretion to determine appropriate oversight  methods based on an assessment of their own risk and resources, VHA  officials we interviewed disagreed about the needed frequency of these  audits. Specifically, the VHA officials responsible for overseeing the  contracts believe that the officials responsible for auditing VHA programs  should be conducting further audits of credentials verification; however,  the auditing officials told us that they did not have plans to conduct any  additional audits related to credentials verification in fiscal year 2016, for  either PC3 or Choice, due to competing priorities.

Without a comprehensive oversight strategy, VHA cannot ensure the  contractors are in compliance, and VHA officials may be missing an  opportunity to assess current monitoring activities for effectiveness and  make any changes to their methods. As a result, VHA risks sending  veterans to physicians who do not meet PC3 and Choice credentials  requirements, which could call into question the quality of care provided  to veterans through these two community care programs.

section_title: VHA Did Not Require Its Staff to Verify Licenses and Lacked Specific Plans for Oversight of VHA Choice Provider Agreements
subsections: section_title: VHA Did Not Require Its Staff to Verify Choice Physicians’ Licenses under Choice Provider Agreements
paragraphs: Under VHA Choice provider agreements, staff at VHA medical facilities  are not required to verify physicians’ licenses. Specifically, staff at the  five VHA medical facilities that participated in the initial implementation  phase of VHA Choice provider agreements told us that they review a  copy of the license submitted by the physician, but they do not verify its  status at the time of review or determine whether the license has any  negative actions taken against it.

VHA officials told us that they do not consider this process to be  traditional credentialing because VHA staff rely on the physicians to attest  to the accuracy of the information that they submit with their provider  agreement, including that they hold an unrestricted license. However,  they also told us they designed the credentials requirements for VHA  Choice provider agreements to be similar to the Choice contractors’  requirements to avoid any advantages or disadvantages of participation  through VHA. Federal internal control standards state that management  should define risk tolerances and identify potential risk factors, such as  the opportunity for fraud due to the absence of controls. In the absence  of verifying a license against the issuing source under the VHA Choice  provider agreement, VHA may not be able to determine whether a  physician has submitted a copy of a license that was revoked by the state  licensing board before it was due to expire. This could have the  unintended consequence of physicians with licensing problems migrating  to Choice provider agreements with VHA medical facilities where their  licenses are not verified. Without assessing the risk that a lack of  verification of physicians’ licenses by VHA staff poses for the program,  VHA does not know whether a change to its policy is needed.

section_title: VHA Lacked Specific Plans for Oversight of Its Staff Responsible for Verification of Credentials for Choice Physicians
paragraphs: VHA lacked specific plans for oversight of its staff responsible for verifying  Choice physicians’ credentials as part of the recently implemented VHA  Choice provider agreements. Under VHA Choice provider agreements,  which the agency began implementing in February 2016, staff at each of  VHA’s approximately 170 medical facilities have the new responsibility of  reviewing community physicians’ credentials. Specifically, VHA policy on  Choice provider agreements requires medical facility staff to verify that  Choice physicians are not excluded from participation in federally funded  health care programs, to review documented evidence of DEA numbers  and medical licensure, and to conduct annual reverification of these  credentials. At the time of our review, VHA officials did not have any  specific plans for conducting oversight to determine whether medical  facility staff are complying with these requirements.

VHA’s lack of oversight of medical facility staff reviewing credentials for  physicians involved in VHA Choice provider agreements is inconsistent  with federal standards for internal control, which call for agencies to  establish monitoring activities, and with GAO guidance for internal  controls, which calls for management to have a strategy to ensure that  ongoing monitoring is effective. VHA officials told us they had ideas for  oversight activities, but they had not determined any specific details that a  comprehensive strategy might include, such as the scope, frequency, or  start date for implementing these activities. For example, VHA officials  also told us they are maintaining a temporary database of physicians with  VHA Choice provider agreements, to which staff upload electronic copies  of a physician’s credentials along with the signed agreement. VHA  officials said that in the future, they may conduct periodic audits to check  that facility staff are uploading all of the required documents regarding  physician credentials, but they did not have plans for when such audits  would start or how frequently they might conduct them. In addition, VHA  staff said they have plans to develop a permanent electronic database  that would include a feature to allow individual VHA medical facilities to  conduct their own oversight. However, VHA did not have a timeline for  when this permanent database would be operational.

Although VHA’s use of VHA Choice provider agreements was in its early  stages at the time of our review, developing a specific plan before results  are expected is important to ensure that the agency can make program  adjustments as needed to achieve desired results. Without conducting  oversight, VHA cannot ensure that staff at each of its medical facilities are  verifying Choice physicians’ credentials consistent with the requirements  of the program. As a result, VHA risks sending veterans to physicians  whose qualifications do not meet VHA Choice provider agreement  requirements, which could call into question the quality of care provided  to veterans through the program.

section_title: Conclusions
paragraphs: Providing our nation’s veterans with quality health care is a critical  responsibility of VHA, and ensuring physician qualifications through  verifying credentials is crucial. However, VHA’s existing oversight  approach is insufficient to ensure that Health Net and TriWest are  verifying credentials according to contractual requirements, or that VHA’s  own staff are reviewing qualifications as appropriate under the recently  implemented VHA Choice provider agreements. VHA’s oversight of its  contractors generally does not include the review of credentials file  documentation, and VHA has conducted only one evaluation of the  contractors’ documentation of verifying credentials and has no  documented plans for additional reviews in the future. Moreover, VHA  currently lacks a comprehensive strategy and detailed plans for oversight  of contractors’ and its own staff’s credentials verification activities.  Without a comprehensive oversight strategy that provides consensus on  the scope and frequency of oversight activities, as well as the  interpretation of oversight findings, VHA cannot ensure veterans receive  quality care via PC3 and Choice.

Unlike Health Net and TriWest, VHA does not require its own staff at VHA  medical facilities to verify state licenses of Choice physicians under the  VHA Choice provider agreements, even though the program was  designed to be similar to Choice as implemented by Health Net and  TriWest. Thoroughly reviewing Choice physicians’ licenses could be  particularly important given that other types of qualifications, such as a  physician’s malpractice history, are not reviewed for Choice physicians.  Without verifying physicians’ licenses, VHA may be putting itself at risk for  procuring care from physicians who are not qualified to treat veterans.

section_title: Recommendations for Executive Action
paragraphs: In order to ensure that veterans receive quality care from qualified  physicians, we recommend that the Secretary of Veterans Affairs direct  the Under Secretary for Health to take the following two actions:

Develop and implement a comprehensive oversight strategy that  includes ongoing monitoring and evaluations of the contractors’  verification of PC3 and Choice physicians’ credentials, as well as VHA  staff’s review of Choice physicians. VHA’s oversight should include  reviewing documentation and assessing whether the contractors’  plans for improving their processes for Choice credentials verification  are effective.

Assess the risk associated with not verifying Choice physicians’ licenses under VHA Choice provider agreements, and determine whether modifications to VHA’s policy are needed.

section_title: Agency Comments
paragraphs: We provided a draft of this report for review to the Department of  Veterans Affairs. In its written comments, reproduced in appendix I, the  department concurred with our recommendations and described plans to  implement them by March 2017. The department also provided technical  comments, which we incorporated as appropriate.

We are sending copies of this report to relevant congressional  committees and other interested parties. This report is also available at  no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or curdae@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs are on the last page of this  report. GAO staff who made major contributions to this report are listed in  appendix II.

section_title: Appendix I: Comments from the Department of Veterans Affairs

section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Marcia A. Mann, Assistant  Director; Kaitlin McConnell, Analyst-in-Charge; and Hannah Marston  Minter made key contributions to this report. Also contributing were Muriel  Brown; Christine Davis; Jacquelyn Hamilton; Drew Long; Jennifer  Whitworth; and William T. Woods.


Question-summary annotations: questions: question: How was the compliance of VHA in verifying the credentials of various contractors?
answer: GAO found that the Department of Veterans Affairs' (VA) contractors—Health Net Federal Services (Health Net) and TriWest Healthcare Alliance (TriWest)—complied with contractual requirements to verify the credentials of physicians under one community care program, but were deficient in doing so under another program.
child_questions: question: What were GAO's findings of the documentation of the credentials of physicians?
answer: Based on GAO's review of selected physicians, GAO found that the contractors almost always verified and documented the credentials of physicians in the Veterans Health Administration's (VHA) Patient-Centered Community Care (PC3) program consistent with the requirements of the contract.

question: According to GAO, how was the verification of those in the Veterans Choice Program?
answer: In contrast, the contractors did not always verify credentials of the physicians in the Veterans Choice Program (Choice) in a timely manner; and for many physicians, contractors could not produce documentation to support verification consistent with the requirements of the contract.
child_questions: question: Describe an example of the verification or lack thereof of the contractors.
answer: For example, Health Net did not document verification of six Choice physicians' certification to prescribe controlled substances, and TriWest provided insufficient documentation for GAO to determine whether it verified most of the selected Choice physicians' credentials. Both contractors shared plans to address the identified deficiencies.

questions: question: What was the issue with the VHA's strategy for overseeing Health Net's and TriWest's compliance?
answer: VHA lacked a comprehensive strategy for overseeing Health Net's and TriWest's compliance with contract requirements for verifying the credentials of PC3 and Choice physicians.

question: What is in review for the contracts?
answer: VA's contracts with Health Net and TriWest specify that VHA will review the contractors' credentialing periodically to determine whether the contractors are in full compliance with the terms of the contract.

question: What did GAO find about the VHA?
answer: However, GAO found that VHA's monitoring is primarily limited to independent reviews of physicians' credentials using primary source databases, rather than oversight of the contractors' processes for verifying physicians' credentials.

question: How has VHA analyzed the documentation of TriWest and Health Net?
answer: VHA has evaluated TriWest's documentation of verifying physicians' credentials for PC3 physicians, but not Health Net's, and has not evaluated either contractor for Choice physicians.
child_questions: question: In what ways was VHA's information conflicting?
answer: Additionally, VHA officials provided conflicting information about the scope, frequency, and interpretation of the results of the oversight they do conduct.

question: How does this affect compliance?
answer: Without a comprehensive oversight strategy, VHA cannot ensure that Health Net and TriWest are in compliance with the terms of the contract and that veterans are treated by qualified physicians.

questions: question: What did VHA start in 2016 with community physicians?
answer: In February 2016, VHA began entering into Choice provider agreements with community physicians to provide Choice care to veterans in certain situations.
child_questions: question: What is under this agreement?
answer: Under these agreements, VHA staff at each medical facility—rather than the contractors—review Choice physicians' credentials. GAO found that VHA did not require its staff to verify licenses submitted by physicians against the issuing source; rather, they review copies of the licenses.

question: What were the federal internal controls standards?
answer: Federal internal control standards state that management should identify potential risk factors, such as opportunities for fraud, due to the absence of controls.

question: How does the lack of assessing risk of licenses affect VHA?
answer: Without assessing the risk of not verifying physicians' licenses against the issuing source, VHA does not know if a policy change is needed.
child_questions: question: In what aways VHA prepared or not prepared in facing this issue?
answer: Furthermore, VHA lacked plans for overseeing staff across each of its medical facilities with the new responsibility of verifying Choice physicians' credentials under the recently implemented VHA Choice provider agreements.

questions: question: How does VHA ensure various care to veterans?
answer: To help ensure that veterans are provided timely and accessible health care, VHA purchases care from community physicians.

question: What are the programs in place to hold credentials?
answer: Two community care programs, PC3 and Choice, require physicians to hold certain credentials reflecting their qualifications.

question: How did Congress have VHA reviewed?
answer: Congress included a provision in law for GAO to review VHA's processes for, and oversight of, credentials verification for PC3 and Choice physicians.
child_questions: question: What does the report explain pertaining to this review?
answer: This report examines (1) whether VA contractors comply with contractual requirements for verifying PC3 and Choice physicians' credentials; (2) the extent to which VHA oversees the contractors responsible for verifying the credentials of PC3 and Choice physicians; and (3) VHA's own processes for, and oversight of, verifying Choice physicians' credentials under recently implemented VHA Choice provider agreements. GAO reviewed PC3 and Choice contracts, VHA and contractor policies, and federal internal control standards.

question: What did GAO review to get the information they required for PC3 and Choice?
answer: GAO reviewed a nongeneralizable sample of 50 PC3 and 50 Choice physician credentials files, selected among five types of care across the nation. GAO also interviewed VHA officials and contractor representatives.