Physicians who work at VA medical facilities are required to hold at least one current and unrestricted state medical license. Current and unrestricted licenses are those in good standing in the states that issued them, and licensed physicians may hold licenses from more than one state. State medical licenses are issued by state licensing boards, which generally establish state licensing requirements governing their licensed practitioners. To keep a license current, physicians must renew their licenses before they expire and meet renewal requirements established by state licensing boards, such as continuing education. Renewal procedures and requirements vary by state. When state licensing boards discover violations of licensing practices--such as the abuse of prescription drugs or the provision of substandard care--that result in adverse health effects, they may place restrictions on licenses or revoke them. Restrictions issued by a state licensing board can limit or prohibit a physician from practicing in that particular state. Generally, state licensing boards maintain a database that contains information on any restrictions or revocations of physicians' licenses. VA requires its medical facility officials to credential and privilege facility physicians periodically in order to work at VA. VA physicians must be credentialed and privileged prior to their initial appointment to a facility's medical staff and then again at least every 2 years when they must reapply for a position on the facility's medical staff. The latter is known as the process of reappointment. Prior to working at VA, physicians initiate the credentialing process for their initial appointment by completing VA's application process, which includes entering into VetPro information used by VA medical facility officials in the credentialing process. Among the credentialing information that VA requires physicians enter into VetPro, for their initial appointment, is information on all the medical licenses they have ever held and the states where they have obtained these licenses, including any licenses they have held that have expired. For their reappointments, physicians must update this credentialing information in VetPro. Once physicians enter their credentialing information into VetPro, a facility's medical staff specialist--an employee who is responsible for obtaining and verifying the information used in the credentialing and privileging processes--performs a data check on the information to be sure that all required information has been entered. In general, the medical staff specialist at each VA medical facility manages the accuracy of VetPro's credentialing data. The medical staff specialist verifies, with the original source of the information, the accuracy of the credentialing information entered by the physicians. This type of check is known as primary source verification. For example, the medical staff specialist contacts state licensing boards in order to verify that physicians' state medical licenses are valid and unrestricted. Medical staff specialists are required, at initial appointment and at reappointment, to verify the status of the state medical licenses physicians disclose to VA by listing them in VetPro. The medical staff specialists can obtain information on the status of physicians' state medical licenses by accessing the information on state licensing boards' Web sites or by contacting the boards directly. At initial appointment only, VA requires medical staff specialists to query FSMB, which contains information from state licensing boards. This query enables officials to determine all the state medical licenses a physician has ever held, including those not disclosed by a physician to VA, and whether a physician has had any disciplinary actions taken against these licenses. VA does not require this query at reappointment because VA headquarters regularly receives reports from FSMB on any VA physician whose name appears on FSMB's list, indicating that disciplinary action has been taken against the physician's state medical license. When VA headquarters receives a report from FSMB, it notifies the appropriate VA medical facility. VA's credentialing process requires VA medical staff specialists to verify medical malpractice claims at initial appointment and at reappointment. These claims may be verified by contacting a court of jurisdiction or the insurance company involved in the medical malpractice claim, or by obtaining a statement of claims status from the attorney representing the physician in the medical malpractice claim. In addition, VA requires medical staff specialists to query NPDB, which contains reports by state licensing boards, hospitals, and other health care entities on unprofessional behavior on the part of physicians or adverse actions taken against them. This query enables officials to determine whether physicians fully disclosed to VA any involvement they might have had in paid medical malpractice claims. Once a physician's credentialing information has been verified, the medical staff specialist sends the information to the physician's supervisor, who is known as a clinical service chief. The clinical service chief reviews this information along with the physician's privileging information. Figure 1 illustrates VA's credentialing process. At the same time physicians enter credentialing information into VetPro, they complete a written request for clinical privileges. The facility medical staff specialist provides the physician's clinical service chief with the requested clinical privileges and information that indicates that the credentialing information entered by the physician into VetPro has been verified with the appropriate primary sources. The medical staff specialist also provides the physician's clinical service chief with information on the physician's ability to perform the clinical privileges requested, including whether the physician has had a physical examination performed for initial appointment. For reappointment, documentation is required by another physician stating that the physician is able to perform both physically and mentally the clinical privileges requested. In addition, the medical staff specialist provides the clinical service chief with information on medical malpractice allegations or paid claims, loss of medical staff membership, loss or reduction of clinical privileges, or any challenges to the physician's state medical licenses. The requested clinical privileges are reviewed by a clinical service chief, who recommends whether a physician should be appointed or reappointed to the facility's medical staff and which clinical privileges should be granted. When deciding to recommend clinical privileges, a clinical service chief considers whether the physician has the appropriate professional credentials, training, and work experience to perform the privileges requested. For reappointment only, a clinical service chief is to consider observations of the physician's delivery of health care to veterans, and VA's policy requires that information on a physician's performance, such as a physician's surgical complication rate, be used when deciding whether to renew a physician's clinical privileges. Based on the clinical service chief's observations and the physician's performance information, the clinical service chief recommends that clinical privileges previously granted by the facility remain the same, be reduced, or revoked, and whether newly requested privileges should be added. Clinical service chiefs forward their recommendations and the reasons for the recommendations to the next level of a medical facility's privileging review process, which may be a professional standards board or a medical executive committee. A medical facility professional standards board or the medical executive committee reviews the recommendations of the clinical service chief and recommends to the facility director whether the physician should be appointed to the facility's medical staff and which clinical privileges should be granted to the physician. The 2-year time period for renewal of clinical privileges and reappointment to the medical staff begins on the date that the privileges are approved by the medical facility's director. The list of approved clinical privileges with the date of approval is maintained in paper copy files at VA medical facilities and the initial appointment or reappointment date is entered into VetPro. Figure 2 illustrates VA's privileging process. According to VA's policy and a VA memorandum, information concerning individual physician performance that is used as part of the privileging process to either reduce, revoke, or support granting clinical privileges must be collected separately from a medical facility's quality assurance program. VA's policy is based on a federal law that restricts the disclosure of documents produced in the course of VA's quality assurance program. In general, documents created in connection with such a program are confidential and may not be disclosed except in limited circumstances. Individuals who willfully disclose documents that they know are protected quality assurance documents are subject to fines up to $20,000. Although the law states that it is not intended to limit the use of documents within VA, VA's policy expressly prohibits the use of such documents in connection with the privileging process. VA's use of separate information sources for quality assurance and privileging decisions is intended to maintain the confidential status of documents produced in connection with quality assurance programs. According to VA, the confidentiality of individual performance information helps ensure provider participation, including physicians, in a medical facility's quality assurance program by encouraging providers to openly discuss opportunities for improvement in provider practice without fear of punitive action. VA has another requirement that is related to the renewal of physicians' clinical privileges. Medical facility officials are required to submit to VA's Office of Medical-Legal Affairs information on malpractice claims. This information must be submitted within 60 days after being notified about a paid malpractice claim. The Office of Medical-Legal Affairs is responsible for convening a panel of clinicians to determine whether a VA facility physician involved in the claim delivered substandard care. The Office of Medical-Legal Affairs notifies the medical facility director of the results of its review. If it is determined that the physician delivered substandard care to veterans, the medical facility must report the physician to NPDB within 30 days of being notified of the decision. VA medical facility officials also would use this determination to decide whether to grant clinical privileges to the physician involved in the VA medical malpractice claim. The physician files we reviewed at the seven VA medical facilities demonstrated compliance with the four credentialing requirements we selected for review and four of five VA privileging requirements. The files we reviewed showed that six of the seven medical facilities had problems complying with a fifth privileging requirement--to use information on a physician's performance when renewing clinical privileges. Compliance with that requirement was problematic largely because in their privileging decisions facility officials used performance information obtained from their facility quality assurance program. Information contained in documents created in the course of a VA quality assurance program is protected by VA policy that expressly prohibits the agency from using that documentation in the privileging process. VA has not provided guidance to help facilities find alternative ways to efficiently collect performance information, outside of a facility's quality assurance program, that could be used in privileging decisions. At the seventh medical facility, officials did not use performance information to renew clinical privileges, as required. Physician files at all seven medical facilities demonstrated compliance with the four credentialing requirements we selected for review. In all cases, the VA facility medical staff specialists contacted state licensing boards--a form of primary source verification--to ascertain the status of the state medical licenses held and disclosed by their physicians. Based on the physician files we reviewed, medical staff specialists also queried the FSMB database as required to obtain additional information on the status of physicians' medical licenses, including those that may not have been disclosed by physicians. Medical staff specialists complied with the requirement to contact primary sources, such as courts of jurisdiction, to verify information on involvement in medical malpractice claims, including ongoing claims, disclosed by physicians. Additionally, in all cases medical staff specialists queried NPDB to identify those physicians who have been involved in paid medical malpractice claims, including any physicians who failed to disclose involvement in such claims. The physician files at the seven medical facilities also demonstrated compliance with four of the five VA privileging requirements we reviewed. We found that medical staff specialists contacted state licensing boards to verify the status of all state medical licenses held by their physicians and to determine whether any of these licenses had any action taken against them. Medical staff specialists also used primary sources to verify that physicians had the necessary training and experience to deliver health care and perform the clinical privileges they requested. We found that after medical staff specialists performed their verification, clinical service chiefs reviewed this information as required, along with information on physicians' health status and information disclosed by the physicians about their involvement in medical malpractice allegations or cases in which claims were paid. While we found evidence demonstrating compliance with four of the five privileging requirements, the files we reviewed also showed that there were problems complying with the fifth privileging requirement--to use information on a physician's performance in making privileging decisions. VA requires that during the renewal of a physician's clinical privileges, VA clinical service chiefs use information on a physician's performance to support, reduce, or revoke the clinical privileges the physician has requested. However, the performance information cannot be collected as part of a medical facility's quality assurance program. Although medical facility clinical service chiefs must use performance information in making decisions about renewal of clinical privileges, VA has not provided guidance on how facility officials can obtain such information in accordance with VA policy--that is, outside of a quality assurance program. VA's credentialing and privileging policy states that facilities cannot use information collected as part of a facility's quality assurance program to reduce or revoke the clinical privileges requested by physicians, but the initial policy guidance was silent about the use of this information to support granting the clinical privileges requested by physicians. Officials at six medical facilities told us that they used quality assurance information to support the granting of clinical privileges requested by their physicians, but collected all or most of this information through facility quality assurance programs. In contrast, facility officials at one medical facility did not use individual physician performance information to renew physicians' clinical privileges. VA issued a directive in September 2004 and a memorandum in October 2004 which VA headquarters officials told us were intended to clarify for medical facility officials the circumstances under which physician performance information could not be used in the credentialing and privileging process. The September 2004 directive explained the specific types of information that are protected, such as information that identifies an individual physician, and the October 2004 memorandum explained that information on a physician's performance that is collected as part of a medical facility's quality assurance program could not be used to support, reduce, or revoke a physician's clinical privileges. The directive and the memorandum did not identify the ways in which medical facility officials could efficiently collect physician performance information outside of a facility's quality assurance program that would provide information for renewing physicians' clinical privileges. According to facility officials, collecting the same information twice--once for quality assurance and once for privileging--is resource-intensive and limits the time they have to address other issues. Without guidance from VA, officials from four facilities told us that they do not know how to collect this information in accordance with VA's policy. Facility officials from two other medical facilities said they believed that they were complying with VA's requirement because they stored performance information in such a way that the identity of individual physicians could not be easily retrieved. Quality assurance staff at these two medical facilities assigned a code to each physician and filed the performance information by assigned code rather than under an individual physician's name. These staff could then retrieve an individual physician's performance information using the code. At one facility, quality assurance staff said their regional legal counsel told them that the confidentiality of the information would be maintained with this type of coding system and would allow them to use the information to renew physicians' clinical privileges. However, according to both VA headquarters legal counsel and the director of VA's credentialing and privileging program, coding quality assurance information in this manner and using it to renew clinical privileges could make this information available for other purposes, including litigation, and therefore does not comply with VA policy. A VA headquarters official told us that the medical facilities need further education on how to collect individual physician performance information that can be used in the renewal of physicians' clinical privileges. We found that three of the seven VA medical facilities we visited did not comply with the requirement to submit paid VA medical malpractice claim information in a timely manner. These facilities had not submitted information on 52 paid medical malpractice claims that may have involved their physicians to VA's Office of Medical-Legal Affairs within the 60-day required time frame for information requested as of December 2005. See figure 3 for the number of paid VA medical malpractice claims for which information was not submitted in a timely manner by the three facilities from 2001 through 2005. The Office of Medical-Legal Affairs is responsible for reviewing information on paid VA medical malpractice claims submitted by VA medical facilities by forming panels of clinicians to determine whether VA practitioners, including physicians, delivered substandard care to veterans in these claims. When VA medical facilities do not submit all relevant claim information to the Office of Medical-Legal Affairs, facility clinical service chiefs may make privileging decisions without the knowledge of physician peer determinations on whether VA physicians delivered substandard care to veterans. In addition, substandard care determinations that are required to be reported by facility officials to the NPDB go unreported or reporting is delayed when VA medical facilities do not send claim information in a timely manner to the Office of Medical- Legal Affairs. This delay or lack of reporting to NPDB prevents other VA and non-VA facilities where the physician may also practice from having complete information on the physician's malpractice history. For example, at one facility we visited, we found that from 2001 through 2005, information on 21 of the facility's 26 paid medical malpractice claims had not been submitted within the 60-day time frame to VA's Office of Medical- Legal Affairs. Moreover, on average this medical facility took 30 months to submit information to VA's Office of Medical-Legal Affairs, whereas the other two facilities averaged about 5 months to submit information. See table 1 for the average number of months it took for these VA medical facilities to submit paid VA medical malpractice claim information to VA's Office of Medical-Legal Affairs. VA has not required its medical facilities to establish internal controls to help ensure that privileging information managed by medical staff specialists is accurate. One facility we visited did not identify 106 physicians whose privileging process had not been completed by facility officials for at least 2 years because of inaccurate information provided by the facility's medical staff specialist. As a result, these physicians were practicing at the facility without current clinical privileges. Subsequent to our visit, this facility implemented internal controls to reduce the risk of a similar situation occurring in the future. During our site visits, we did not identify any medical facilities that had established such internal controls. Without accurate information on the privileges that have been granted to physicians and the dates for renewing those privileges, VA medical facility officials will not know if they have failed to renew clinical privileges for any of their physicians in accordance with VA policy. For at least 2 years, one VA medical facility did not identify 106 physicians whose privileging process had not been completed by facility officials because of inaccurate information provided by the facility's medical staff specialist. According to facility officials, the medical staff specialist changed the reappointment dates on some of these physicians to a later date in order to delay work she needed to perform to complete the credentialing and privileging requirements on these physicians. For other physicians, the medical staff specialist removed the physicians' names from the VetPro database so that the physicians would not show up on VetPro lists as needing to be reappointed to the facility's medical staff. Facility officials further told us that the medical staff specialist changed appointment dates and removed names from VetPro in order to conceal the fact that these physicians no longer had current privileges. As a result, these physicians were practicing at the facility without current clinical privileges. The clinical service chiefs, members of the professional standards board and the medical executive committee, and the facility director were unaware that these physicians were working without current clinical privileges, and learned of the problem only after it was brought to their attention by an individual newly hired to help the facility's medical staff specialist. Medical facility officials told us that after becoming aware of the problem, they confronted the medical staff specialist responsible for the data inaccuracies, who then resigned. Medical facility officials then began to check the clinical privileges of all of their physicians and identified inaccuracies in the privileging information for 106 physicians. After reviewing the 106 physician files, facility officials told us they did not find any problems that would have warranted the physicians' removal from the facility's medical staff or that placed veterans at risk. Although this medical facility did not identify any problems with the 106 physicians' clinical privileges or with their clinical competence to deliver care to veterans, the potential exists for problems to occur at other VA medical facilities. During our site visits, we did not identify any facilities that had established internal controls that would help ensure the accuracy of the information used to renew clinical privileges. A VA headquarters official told us that there is no requirement for VA medical facilities to have such internal controls in place. While VA does not require facilities to establish these internal controls, the facility that identified inaccuracies in its privileging information subsequently implemented internal controls to reduce the risk of a similar situation occurring in the future. Facility officials have taken steps to help ensure that a similar situation does not recur. For example, the facility now provides each facility clinical service chief with a list of physicians on a quarterly basis and asks the clinical service chiefs to verify that the listed physicians are currently working at the medical facility and to identify those physicians working at the facility who are not on the list. This allows medical facility officials to know if physicians have been inappropriately deleted from VetPro and are working at the facility without current clinical privileges. Without internal controls such as this for their privileging information, VA's medical facilities may not know whether they have allowed some of their physicians to practice with expired privileges. VA is responsible for ensuring that its physicians are qualified to deliver health care to veterans at VA medical facilities and has requirements in place that medical facility officials are to use to help ensure that physicians meet these qualifications. VA medical facilities we visited complied with the four VA credentialing requirements we reviewed and all but one of five privileging requirements--to use information on a physician's performance when renewing clinical privileges. While officials at six of the seven facilities we visited made an attempt to comply with VA's requirement to use performance information, these officials deviated from VA's policy by collecting all or most of the performance information through their facilities' quality assurance programs. This occurred, in part, because VA has not provided guidance on how to collect this information in accordance with VA's policy. In addition, VA medical facility officials did not have all the information they needed on physicians involved in paid VA medical malpractice claims, because the facilities had not submitted such information to VA's Office of Medical-Legal Affairs in a timely manner. This could have placed veterans at risk of receiving care from physicians who did not have adequate clinical skills. Finally, VA has not required its medical facilities to establish internal controls to help ensure the accuracy of their privileging information. Until VA requires its medical facilities to establish internal controls to ensure the accuracy of privileging information, facilities are at risk for allowing physicians to practice with expired clinical privileges. To better ensure that VA physicians are qualified to deliver care safely to veterans, we recommend that the Secretary of Veterans Affairs direct the Under Secretary for Health to take the following three actions: provide guidance to medical facilities on how to collect individual physician performance information in accordance with VA's credentialing and privileging policy to use in medical facilities' privileging processes, enforce the requirement that medical facilities submit information on paid VA medical malpractice claims to VA's Office of Medical-Legal Affairs within 60 days after being notified that the claim is paid, and instruct medical facilities to establish internal controls to ensure the accuracy of their privileging information. In commenting on a draft of this report, VA agreed with our findings and conclusions and concurred with our recommendations. VA also provided an action plan to address the three recommendations. VA acknowledged that we identify a challenge faced not only by VA facilities, but by all health care facilities, to incorporate physician-specific performance information into the credentialing and privileging processes. In addition, VA recognized the need to improve facility compliance with submitting information on paid VA medical malpractice claims to the Office of Medical-Legal Affairs in a timely manner. Further, VA agreed that internal controls are needed to ensure the accuracy of information used to renew physicians' clinical privileges and has begun the work necessary to establish these internal controls at all VA facilities. VA also provided details of actions it plans to take to implement the three recommendations in the draft report. VA's written comments are reprinted in appendix II. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. We will then send copies of this report to the Secretary of Veterans Affairs and other interested parties. We also will make copies available to others upon request. In addition, the report will be available at no charge at the GAO Web Site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7101 or ekstrandl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made major contributions to this report are listed in appendix III. To determine the extent to which selected Department of Veterans Affairs' (VA) medical facilities complied with VA's credentialing and privileging requirements, we reviewed policies, procedures, and guidance on VA's credentialing and privileging processes. We also interviewed the director of VA's credentialing and privileging program, as well as officials responsible for credentialing and privileging at the VA medical facilities we visited. We selected four credentialing requirements for review because they are requirements that--unlike others--address information about physicians that can change or be updated with new information periodically. As a result, VA requires that this information be verified by facility officials at least every 2 years. Other credentialing requirements, such as where a physician attended medical school or previous employment history, are not subject to change or updating and are required by VA to be verified when the physician initially applies for employment. The four credentialing requirements are 1. verify that all state medical licenses held by physicians are valid; 2. query the Federation of State Medical Boards (FSMB) database to determine whether physicians had disciplinary action taken against any of their licenses, including expired licenses; 3. verify information provided by physicians on their involvement in medical malpractice claims at a VA or non-VA medical facility; and 4. query the National Practitioner Data Bank (NPDB) to determine whether a physician was reported to this data bank because of involvement in VA or non-VA paid medical malpractice claims, display of professional incompetence, or engagement in professional misconduct. Of the privileging requirements in VA's credentialing and privileging policy, we selected four requirements that VA identifies as general privileging requirements. In addition, we selected another privileging requirement about the use of individual performance information because of its importance in the renewal of clinical privileges. The five VA privileging requirements we selected are 1. verify that all state medical licenses held by physicians are valid; 2. verify physicians' training and experience; 3. assess physicians' clinical competence and health status; 4. consider any information provided by a physician related to medical malpractice allegations or paid claims, loss of medical staff membership, loss or reduction of clinical privileges at a VA or non-VA facility, or any challenges to a physician's state medical license; and 5. use information on a physician's performance when making decisions about whether to renew the physician's clinical privileges. Two of the five privileging requirements--verify all state medical licenses and consider medical malpractice information--are also VA credentialing requirements. We conducted site visits to seven VA medical facilities that were chosen based on size and geographic location. The medical facilities selected for review were located in Boise, Idaho; Kansas City, Missouri; Las Vegas, Nevada; Lexington, Kentucky; Martinsburg, West Virginia; Miami, Florida; and San Antonio, Texas. For each medical facility visited, we obtained from VA a list of physicians and their specialties. Using this list, at each facility we randomly selected 17 physicians and obtained files with their credentialing and privileging information. Our sample included physicians working in VA facilities full-time and part-time, through a contract, or without direct compensation from VA. In some cases, these physicians also worked at non-VA medical facilities. At each facility we visited, we selected one file from the following clinical specialties that are offered at most VA medical facilities: anesthesiology, gastroenterology, neurology, oncology, ophthalmology orthopedics, radiology, and urology. We also selected two physician files from general surgery and internal medicine, and five files from physician names that had no specialty identified on the list provided by VA. At some facilities, we found that the physician specialty indicated on the list provided by VA was incorrect. We replaced these files by random selection with physician files in the specialty needed. To determine whether the files we reviewed demonstrated compliance with the selected VA credentialing requirements and privileging requirements, we compared the documentation found in our sample files against the credentialing and privileging requirements. During our site visits, we reviewed the documentation in VetPro and in a physician's paper copy credentialing file to determine whether the facility complied with each of the four VA credentialing requirements that we reviewed. If documentation was present either in VetPro or the paper copy file, we determined that the medical facility complied with VA's requirement. For each physician, we reviewed the three most recent appointment cycles-- the period from one appointment process to the next appointment process, which occurs every 2 years. Some of the physicians in our sample had not been through three appointment cycles. For those physicians, we reviewed only the number of cycles that had been completed. We documented our findings from these reviews on a data collection instrument. At each medical facility, we reviewed a physician's paper copy privileging file to determine whether the physician's file contained documentation that the medical facility met the five VA privileging requirements we examined. For the fifth requirement--use of information on a physician's performance when making decisions about whether to renew physicians' clinical privileges--we also interviewed facility officials, including the facility quality assurance manager, to determine whether the facility collected this physician performance information outside of the facility's quality assurance program. For some physician files we reviewed, the physician had only been through initial appointment and therefore did not have individual physician performance information in the privileging file. Based on the sample of physician files we reviewed at each of the seven medical facilities, we can discuss a medical facility's compliance for the physician files we reviewed; we cannot draw conclusions about the remaining physician files at the medical facilities we visited or about the compliance of other VA medical facilities. In collecting information on the credentialing and privileging requirements from physician files at each facility, we employed standard data collection techniques to ensure the accuracy and reliability of the data used in this report, such as interviewing medical facility officials about the accuracy and timeliness of the information contained in the physician files we reviewed and taking steps to have a consistent interpretation of VA's credentialing and privileging requirements for the physician files we reviewed at each medical facility. To determine the extent to which the selected VA medical facilities complied with a requirement to submit information on paid VA medical malpractice claims, we obtained data from VA's Office of Medical-Legal Affairs in Buffalo, New York to identify the VA medical facilities that were delinquent--more than 60 days had passed since the facility was notified that a claim had been paid--in submitting medical malpractice claim information to this office. The data included the name of the VA medical facility, the veteran who was named in the claim, the date the Office of Medical-Legal Affairs was notified that a claim had been paid, and the date the Office of Medical-Legal Affairs notified the facility that a VA medical malpractice claim had been paid. VA's Office of Medical-Legal Affairs determines whether a physician who was involved in a VA medical malpractice claim delivered substandard care to veterans, and if so, was reported to NPDB. We interviewed officials at this office to obtain information about VA's process and requirements for determining if substandard care was delivered. To determine whether VA has internal controls to help ensure the accuracy of medical facility information that is used to renew physicians' clinical privileges, we interviewed the director of VA's credentialing and privileging program, as well as other VA officials. We identified the internal controls VA has in place for its privileging process and used GAO's standards for internal controls in the federal government to determine whether these controls were adequate. During our site visits, we determined if any of the seven medical facilities had internal controls in place to help ensure the accuracy of the information used to support the renewal of clinical privileges. We conducted our work from July 2005 to May 2006 in accordance with generally accepted government auditing standards. In addition to the contact named above Marcia A. Mann, Assistant Director; Kelly Barar; Mary Ann Curran; Martha A. Fisher; and Krister Friday made key contributions to this report. VA Health Care: Steps Taken to Improve Practitioner Screening, but Facility Compliance with Screening Requirements Is Poor. GAO-06-544. Washington, D.C.: May 25, 2006. VA Health Care: Improved Screening of Practitioners Would Reduce Risk to Veterans. GAO-04-566. Washington, D.C.: March 31, 2004. VA Health Care: Veterans at Risk from Inconsistent Screening of Practitioners. GAO-04-625T. Washington, D.C.: March 31, 2004.

Summary:
The Department of Veterans Affairs (VA) is responsible for determining that over 36,000 physicians working in its facilities have the appropriate professional credentials and qualifications to deliver health care to veterans. To do this, VA credentials and privileges physicians providing care at its medical facilities. In this report, GAO determined the extent to which selected VA facilities complied with (1) four VA credentialing requirements and five VA privileging requirements and (2) a requirement to submit information on paid malpractice claims. GAO also determined (3) whether VA has internal controls to help ensure the accuracy of information used to renew clinical privileges. GAO reviewed VA's policies, interviewed VA officials, and randomly sampled 17 physician files at each of seven VA medical facilities. GAO found that the files reviewed at seven VA medical facilities complied with four of VA's credentialing requirements selected for review, and all but one of five privileging requirements. Credentialing is the process of verifying that a physician's professional credentials, such as state medical licenses, are valid and meet VA's requirements for employment. Privileging is the process for determining which health care services a physician is allowed to provide to veterans. For the files GAO reviewed, compliance with the fifth privileging requirement was problematic at six facilities because officials used performance information when renewing clinical privileges but collected all or most of this information through their facility's quality assurance program. This is prohibited under VA policy. In general, VA quality assurance information is confidential, according to federal law and VA policy. According to VA officials, if quality assurance information is used outside of a facility's quality assurance program, it could be used for other purposes, including litigation. The information is protected to encourage physicians to participate in quality assurance programs by reporting and discussing adverse events to help prevent such events from occurring in the future. VA has not provided guidance to help medical facilities find ways to efficiently collect performance information outside of a facility's quality assurance program. At the seventh medical facility, officials did not use performance information to renew clinical privileges, as required. Three of the seven medical facilities did not meet VA's requirement to submit, within 60 days after being notified that the claim was paid, any information on paid VA medical malpractice claims involving facility practitioners, including physicians, to VA's Office of Medical-Legal Affairs. This office reviews the information and determines whether practitioners involved in the claims delivered substandard care, displayed professional incompetence, or engaged in professional misconduct. The office informs facilities of its determinations. When facilities do not submit all relevant VA malpractice information in a timely manner, VA medical facility officials lack complete information that would allow them to make informed decisions about the clinical privileges that their physicians should be granted. VA has not required its medical facilities to establish internal controls to help ensure that privileging information managed by medical staff specialists--who are responsible for obtaining and verifying the information used in the credentialing and privileging processes--is accurate. One facility GAO visited did not identify 106 physicians whose privileging process had not been completed by facility officials for at least 2 years because of inaccurate information provided by the facility's medical staff specialist. As a result, these physicians were practicing at the facility without current clinical privileges. Without accurate information on the privileges that have been granted to physicians and the dates for renewing those privileges, VA medical facility officials will not know if they have failed to renew clinical privileges for any of their physicians in accordance with VA policy.