PC3 and Choice are among several VA community care programs, each of which has varying eligibility requirements and types of services offered. While the amount of claims VA paid for the treatment of veterans under PC3 decreased by about half over the past year, the amount has more than tripled for the treatment of veterans under Choice. PC3 was not specifically enacted by law, but was created by VA under existing statutory authorities to provide veterans with needed care that is not feasibly available from a VHA medical facility. VA originally required its PC3 contractors, Health Net and TriWest, to each develop regional networks, made up of community providers of specialty care, mental health care, limited emergency care, and maternity and limited newborn care. VA and the contractors began implementing PC3 in October 2013, and it was fully implemented nationwide as of April 2014. In August 2014, VA expanded PC3 to allow community providers of primary care to join Health Net’s and TriWest’s networks. Veterans may be eligible to obtain care under PC3 when they are unable to access a particular service from a VHA medical facility, either because the service is not offered or the veteran would have to travel a long distance to obtain it from a VHA medical facility. The veteran’s VHA provider requests an authorization for care, and if approved, the responsible contractor tries to arrange for care for the veteran with one of the providers in its PC3 network. The Choice Act provides, among other things, temporary authority and funding for veterans to obtain certain types of health care services from community providers to address long wait times, lengthy travel distances, or other challenges accessing care at a VHA medical facility. Under this authority, VHA introduced Choice in November 2014. As stated in VHA’s December 2015 guidance, Choice allows eligible veterans to obtain health care services from community providers if the veteran meets any of the following criteria: the next available medical appointment with a VA provider is more than 30 days from the veteran’s preferred date or the date the veteran’s physician determines he or she should be seen; the veteran lives more than 40 miles driving distance from the nearest VHA medical facility with a full-time primary care physician; the veteran needs to travel by air, boat, or ferry to the VHA medical facility that is closest to his or her home; the veteran faces an unusual or excessive burden in traveling to a VHA medical facility based on geographic challenges, environmental factors, or a medical condition; the veteran’s specific health care needs, including the nature and frequency of care needed, warrants participation in the program; or the veteran lives in a state or territory without a full-service VHA medical facility. Choice is primarily implemented through VA’s contracts with Health Net and TriWest; however, staff at VHA medical facilities have also, under certain conditions, begun entering into VHA Choice provider agreements. Specifically, VHA Choice provider agreements can be used when 1) the services are not covered under VA’s contracts with Health Net and TriWest, or 2) Health Net or TriWest cannot deliver the care and returns the authorization request to the VHA medical facility for certain reasons. If the needed services are covered by the VA contracts for Choice care, VHA must give Health Net and TriWest the first opportunity to arrange the care for the veteran. VHA began entering into Choice provider agreements in February 2016. As of July 14, 2016, VHA reported that its medical facilities had 4,859 VHA Choice provider agreements in place, and had used 925 of them to authorize Choice care for veterans. Because some veterans could be eligible for more than one type of VA community care—for example, if they live a long distance from a VHA medical facility—VHA issued guidance on the hierarchy of community care referrals. Given that Congress designated funding specifically for Choice, the guidance communicates a preference for the use of Choice, whenever possible. Specifically, when a VHA medical facility determines that there is a need for community care, VHA instructs them to first refer the veteran to the appropriate contractor for Choice care if the veteran meets the eligibility criteria and the needed services are covered by Choice. If the veteran is eligible for Choice care, but the contractor is unable to arrange for the care, the facility may use a VHA Choice provider agreement or another type of community care, such as PC3. If the veteran is not eligible for Choice or the needed services are not covered by Choice, the VHA guidance says VHA medical facility staff may use their discretion to refer the veteran to another type of community care. As of July 2016, both Health Net and TriWest reported that Choice care made up the vast majority of their authorizations. The process of reviewing and verifying physicians’ credentials, also known as credentialing, includes inspecting and authenticating the documents that constitute evidence of appropriate education, training, licensure, and experience to ensure the physician is qualified to practice medicine in the designated setting. Industry standards for credentialing, developed by various accreditation organizations, such as URAC, generally require accredited organizations to verify credentials in order to confirm the factual accuracy and authenticity of the information submitted by the physician. The industry standards call for some credentials, such as medical licenses, to be verified using the primary source—the original or issuing source of the credential. In the case of a medical license, the primary source would be the state licensing board that issued the license. Other credentials may be verified using accepted secondary sources, such as the National Practitioners Data Bank for verifying malpractice history. The standards also call for documentation of credentials verification activities, such that there is evidence that verification was conducted consistent with requirements and standards. VA contracted with Health Net and TriWest to conduct credentials verification for PC3 physicians in their respective networks, and maintain documentation of this verification. To implement contractual requirements for PC3, Health Net and TriWest verify PC3 physicians’ credentials in accordance with URAC accreditation standards for credentialing. For example, Health Net and TriWest verify licenses, education and training, and malpractice history for each PC3 physician, and conduct reverification at least once every three years. Health Net and TriWest are also required to verify the credentials of Choice physicians; however, to further the goal of getting veterans access to care quickly under Choice, VA chose to require fewer credentials for Choice physicians. According to a VHA official, it generally takes between 5 and 10 days to complete the credentials verification process for Choice physicians, compared to 90 days for PC3. Specifically, in contrast to traditional credentialing, VA’s contracts only require Health Net and TriWest to ensure that Choice physicians hold an active, unrestricted license in the state where Choice service have a national provider identification (NPI) number; have a Drug Enforcement Agency (DEA) number to prescribe are not excluded from participation in federally funded health care participate in Medicare. Health Net’s and TriWest’s contracts require them to comply with section 101 of the Choice Act, which also requires Choice physicians to submit verification of their credentials at least annually. VHA policy requires Choice physicians who participate in VHA Choice provider agreements to submit a similar set of credentials at least annually. For additional detail on the different credentials requirements, see figure 1. The VA Budget and Choice Improvement Act required VHA to develop a plan for consolidating community care, and VHA submitted its plan to Congress on October 30, 2015. In its submission to Congress, VHA outlined its plan to consolidate all of its existing community care programs, including PC3 and Choice, into a single program with uniform credentials requirements for all participating physicians. VHA’s plan stated that it does not currently have a standard approach to credentialing under the various existing community care programs. In April 2016, VA published a draft of a performance work statement for a future contract for consolidated community care in order to solicit comments and suggestions from interested parties. The April 2016 draft specifies that the contractors’ credentialing program will be accredited by a national organization and shall perform credentialing in accordance with the accreditation standards. We found that both Health Net and TriWest complied with contractual requirements to verify PC3 physicians’ credentials and maintain documentation for our selected sample. To meet these requirements, both Health Net and TriWest developed written policies on the types of credentials required and how to verify them, and both contractors submitted an outline of their credentials verification procedures to VHA. Both contractors also have quality assurance mechanisms in place that include routinely reviewing a sample of files for errors and missing information. We reviewed the credentials files for 50 PC3 physicians and found that Health Net always conducted credentials verification consistent with its policies and procedures, and TriWest almost always did so. We identified three deficiencies among the 25 selected PC3 physicians from TriWest. Specifically, we found that TriWest did not verify one physician’s license, one physician’s absence from the exclusionary list, and one physician’s malpractice insurance coverage. We found that Health Net and TriWest document credentials verification in different ways. TriWest’s procedure is to maintain copies of credentials verification from primary sources (such as a printout from the state licensing board website for each physician), while Health Net’s procedure is to document discrete data elements from the verification sources (such as the name of the source and the date the credential expires). Both approaches are acceptable under URAC accreditation standards and allowed us to observe that credentials verification had been conducted. We identified deficiencies in both Health Net’s and TriWest’s verification of credentials for the 50 selected Choice physicians we reviewed. VA’s contracts specify five types of credentials that are required for Choice physicians and incorporate the Choice Act requirement that Choice physicians submit verification of their credentials at least annually. We found that the contractors did not always verify the credentials of Choice physicians in a timely manner and often could not produce documentation to demonstrate that verification occurred. Initial verification: Of the 50 selected Choice physicians from Health Net and TriWest, we identified one physician from Health Net whose credentials had not been verified before treating veterans. Specifically, we found that Health Net conducted the verification of this physician after we identified the physicians for our review, at which time the physician had treated at least three veterans. This is inconsistent with VA’s contract, which calls for Health Net to ensure that each physician holds the specified set of credentials in order to deliver Choice care. Annual reverification: Health Net’s and TriWest’s contracts incorporate a Choice Act requirement that physicians must submit verification of their credentials at least annually. In practice, the Choice physicians do not submit verification of their credentials, because the information needed for verification is available to Health Net and TriWest through online databases, such as state licensing board websites. VHA officials and representatives of both Health Net and TriWest consistently interpreted the provision of the Choice Act to require annual reverification of the physicians’ credentials. However, we did not find evidence that Health Net and TriWest were conducting this annual reverification among the 50 selected Choice physicians. Specifically, we identified six Health Net Choice physicians whose credentials had been initially verified over a year before our review. At the time of our review, Health Net could not provide documentation of reverifying these physicians within a year of their initial verification, but provided documentation of reverifying five of them after we identified our sample. Upon reverifying these physicians, Health Net learned that one physician was no longer participating in Medicare. Health Net representatives told us they had discontinued this physician from Choice participation. Following our review, Health Net representatives told us they could provide evidence that they had reverified these physicians three months prior to our review. Specifically, they had provided a list of 48,000 providers, including these six physicians, to an outside vendor to reverify the required credentials. Health Net representatives explained that they had not loaded this information into the database, and thus they had not provided evidence of this reverification to us during our review. At the time of our review, reverification was not part of TriWest’s process. Of the 25 Choice physicians that we selected from TriWest, there were eight physicians in our sample whose credentials were initially verified over a year before our review, and we did not find evidence that they had been reverified. The other 17 physicians’ credentials were initially verified within the year prior to our review. Documentation: Health Net could not produce documentation of the initial verification of six physicians’ DEA numbers, though Health Net included an annotation on the documentation for our review that it had conducted the verification. While Health Net conducted the DEA verification for these physicians just before our review, all six physicians had each treated at least 15 veterans by that time. Similarly, TriWest provided insufficient documentation for us to determine whether it verified most of the selected Choice physicians’ credentials. Specifically, TriWest provided screenshots of its credentialing database that included limited information, such as the physician’s name and the state issuing the credential and the registration number of the credential. However, the screenshots of the database rarely included license expiration dates and did not include information about who conducted the verification, what source was used, or when it was conducted. Unlike TriWest’s process for documenting verification of PC3 physicians’ credentials, TriWest was not saving screenshots of the source documents that would contain this type of information for most Choice physicians. Based on this documentation, it was not possible for us to tell whether the information in the database was obtained from the physician or whether TriWest had conducted any verification of credentials. TriWest representatives explained that responsibility for verifying most Choice physicians’ credentials was assigned to staff who did not have access to TriWest’s credentialing database used for entering information and saving documentation; rather, these staff said they took mental note of their verification activities without documenting anything. TriWest representatives further explained that other staff with access to the credentialing database take the information that was obtained and enter it into the credentialing database, but do not look for missing or incorrect information. The lack of documentation makes it difficult to determine whether credentials verification actually occurred. In fact, TriWest representatives disclosed that they identified deficiencies among the 25 selected physicians, which we would not have been able to identify from the documentation provided. Specifically, TriWest identified 4 physicians who were not meeting the contract’s Medicare-participation requirement as a result of our request. TriWest representatives told us they had terminated these physicians from Choice participation. In addition, TriWest acknowledged that their database was missing the DEA numbers for 21 of the 25 selected physicians, though they had added them to the database prior to sending the files to us. As a result of this finding, TriWest conducted a systematic review of physicians in its database and identified an additional 1,817 Choice physicians whose DEA numbers were missing. TriWest representatives said they have added the missing information to the database and have retrained their staff on the verification of Medicare-participation and DEA numbers. Unlike their processes for PC3, neither Health Net nor TriWest had developed written policies on verification of Choice physicians’ credentials at the time of our review. Additionally, both contractors were conducting little to no oversight of the staff responsible for Choice credentials verification. Neither contractor was including Choice physicians in its routine quality assurance monitoring that they conduct of PC3 physicians’ credentials files. A Health Net official reported routinely checking credentials against the primary sources for a sample of Choice physicians in order to identify physicians that do not have the appropriate credentials to participate in the program. However, without reviewing documentation in the credentials files, this official could not identify the deficiencies with the process like we identified related to timely verification and documentation. Health Net and TriWest representatives attributed the deficiencies we identified to Choice being set up very quickly, and Choice being different from the typical credentials verification process for which they are accredited. Both Health Net and TriWest provided us with copies of written policies on the verification of Choice physicians’ credentials developed following our review, and both described plans for additional improvements, such as reassigning credentials verification responsibility to staff with access to the credentialing database where documentation is stored. These plans, if implemented, could potentially result in better compliance with the contract, a determination that VHA would be responsible for making through future oversight. We found that VHA lacked a comprehensive strategy for overseeing Health Net’s and TriWest’s compliance with contract requirements for verifying the credentials of PC3 and Choice physicians. VA’s contracts with Health Net and TriWest include a section referred to as the quality assurance surveillance plan (QASP), which specifies that VHA will review the contractors’ credentialing periodically to determine whether the contractors are in full compliance with the terms of the contract. In addition, federal internal control standards call for monitoring, and corresponding guidance suggests an agency consider having a strategy to ensure that monitoring is effective. However, we found that VHA’s monitoring is primarily limited to independent reviews of physicians’ credentials using primary source databases, rather than oversight of the contractors’ verification processes through review of documentation. VHA has conducted only one evaluation of the contractors’ documentation of verifying physicians’ credentials. Additionally, VHA officials provided conflicting information about the scope, frequency, and interpretation of the results of the oversight they do conduct. We found that VHA conducts monthly ongoing monitoring of certain types of credentials in two ways. Each month, Health Net and TriWest each submit to VHA a list of PC3 and Choice providers in its network, including physicians. First, VHA checks that all providers listed, including physicians, are not on the exclusionary list from participation in federal programs. VHA also selects a sample of providers, including physicians, from the contractors’ lists each month and checks online databases to verify that they possess certain credentials. The QASPs call for 100 percent compliance with credentials requirements. From September 2015 to February 2016, VHA reviewed 484 physicians and identified 18 physicians with a potential issue, such as an expired license in the state where the physician practices. VHA also reviewed 698 non-physician providers during the same period and identified 33 with a potential issue. VHA expects the contractor to terminate any physician VHA identifies as having an issue, and VHA officials told us they check subsequent monthly lists to ensure that identified physicians have been removed. However, this ongoing monitoring does not identify systematic deficiencies in the contractors’ processes for verifying physicians’ credentials, such as not annually reverifying physicians. As we demonstrated through our review of the contractors’ credentials files, reviewing documentation can reveal such deficiencies and help ensure that the contractors’ processes are being implemented to identify physicians that do not have the required credentials to care for veterans through these community care programs. We also found that VHA has conducted one evaluation of the contractors’ documentation of verifying physicians’ credentials: an audit of TriWest’s credentials verification for PC3 physicians. This audit—similar to our review—generally found TriWest’s credentials verification for PC3 physicians to be reliable, but did identify some instances of insufficient documentation. VHA has not conducted any similar evaluations of Health Net’s documentation of verifying PC3 physicians’ credentials, despite original intentions of auditing both contractors. Further, VHA officials responsible for auditing VHA programs have not conducted any audits of either of the contractors’ verification of credentials for Choice physicians. In the absence of a comprehensive oversight strategy, we found that VHA officials lacked consensus regarding their oversight plans and provided conflicting information about the scope, frequency, and interpretation of the results of their existing oversight activities. Specifically, various VHA officials we interviewed had conflicting understandings of whether the monthly reviews included both PC3 and Choice physicians. For example, VHA officials responsible for conducting the reviews were including both PC3 and Choice physicians in the monthly samples. However, the officials responsible for overseeing the contracts and reporting the results to the contractors via the QASPs were reporting the results as specific to Choice. An analysis of the samples from the monthly reports we reviewed revealed that 22 percent of physicians sampled were Choice physicians and the remainder were PC3 physicians. In addition, while federal entities such as VHA have the discretion to determine appropriate oversight methods based on an assessment of their own risk and resources, VHA officials we interviewed disagreed about the needed frequency of these audits. Specifically, the VHA officials responsible for overseeing the contracts believe that the officials responsible for auditing VHA programs should be conducting further audits of credentials verification; however, the auditing officials told us that they did not have plans to conduct any additional audits related to credentials verification in fiscal year 2016, for either PC3 or Choice, due to competing priorities. Without a comprehensive oversight strategy, VHA cannot ensure the contractors are in compliance, and VHA officials may be missing an opportunity to assess current monitoring activities for effectiveness and make any changes to their methods. As a result, VHA risks sending veterans to physicians who do not meet PC3 and Choice credentials requirements, which could call into question the quality of care provided to veterans through these two community care programs. Under VHA Choice provider agreements, staff at VHA medical facilities are not required to verify physicians’ licenses. Specifically, staff at the five VHA medical facilities that participated in the initial implementation phase of VHA Choice provider agreements told us that they review a copy of the license submitted by the physician, but they do not verify its status at the time of review or determine whether the license has any negative actions taken against it. VHA officials told us that they do not consider this process to be traditional credentialing because VHA staff rely on the physicians to attest to the accuracy of the information that they submit with their provider agreement, including that they hold an unrestricted license. However, they also told us they designed the credentials requirements for VHA Choice provider agreements to be similar to the Choice contractors’ requirements to avoid any advantages or disadvantages of participation through VHA. Federal internal control standards state that management should define risk tolerances and identify potential risk factors, such as the opportunity for fraud due to the absence of controls. In the absence of verifying a license against the issuing source under the VHA Choice provider agreement, VHA may not be able to determine whether a physician has submitted a copy of a license that was revoked by the state licensing board before it was due to expire. This could have the unintended consequence of physicians with licensing problems migrating to Choice provider agreements with VHA medical facilities where their licenses are not verified. Without assessing the risk that a lack of verification of physicians’ licenses by VHA staff poses for the program, VHA does not know whether a change to its policy is needed. VHA lacked specific plans for oversight of its staff responsible for verifying Choice physicians’ credentials as part of the recently implemented VHA Choice provider agreements. Under VHA Choice provider agreements, which the agency began implementing in February 2016, staff at each of VHA’s approximately 170 medical facilities have the new responsibility of reviewing community physicians’ credentials. Specifically, VHA policy on Choice provider agreements requires medical facility staff to verify that Choice physicians are not excluded from participation in federally funded health care programs, to review documented evidence of DEA numbers and medical licensure, and to conduct annual reverification of these credentials. At the time of our review, VHA officials did not have any specific plans for conducting oversight to determine whether medical facility staff are complying with these requirements. VHA’s lack of oversight of medical facility staff reviewing credentials for physicians involved in VHA Choice provider agreements is inconsistent with federal standards for internal control, which call for agencies to establish monitoring activities, and with GAO guidance for internal controls, which calls for management to have a strategy to ensure that ongoing monitoring is effective. VHA officials told us they had ideas for oversight activities, but they had not determined any specific details that a comprehensive strategy might include, such as the scope, frequency, or start date for implementing these activities. For example, VHA officials also told us they are maintaining a temporary database of physicians with VHA Choice provider agreements, to which staff upload electronic copies of a physician’s credentials along with the signed agreement. VHA officials said that in the future, they may conduct periodic audits to check that facility staff are uploading all of the required documents regarding physician credentials, but they did not have plans for when such audits would start or how frequently they might conduct them. In addition, VHA staff said they have plans to develop a permanent electronic database that would include a feature to allow individual VHA medical facilities to conduct their own oversight. However, VHA did not have a timeline for when this permanent database would be operational. Although VHA’s use of VHA Choice provider agreements was in its early stages at the time of our review, developing a specific plan before results are expected is important to ensure that the agency can make program adjustments as needed to achieve desired results. Without conducting oversight, VHA cannot ensure that staff at each of its medical facilities are verifying Choice physicians’ credentials consistent with the requirements of the program. As a result, VHA risks sending veterans to physicians whose qualifications do not meet VHA Choice provider agreement requirements, which could call into question the quality of care provided to veterans through the program. Providing our nation’s veterans with quality health care is a critical responsibility of VHA, and ensuring physician qualifications through verifying credentials is crucial. However, VHA’s existing oversight approach is insufficient to ensure that Health Net and TriWest are verifying credentials according to contractual requirements, or that VHA’s own staff are reviewing qualifications as appropriate under the recently implemented VHA Choice provider agreements. VHA’s oversight of its contractors generally does not include the review of credentials file documentation, and VHA has conducted only one evaluation of the contractors’ documentation of verifying credentials and has no documented plans for additional reviews in the future. Moreover, VHA currently lacks a comprehensive strategy and detailed plans for oversight of contractors’ and its own staff’s credentials verification activities. Without a comprehensive oversight strategy that provides consensus on the scope and frequency of oversight activities, as well as the interpretation of oversight findings, VHA cannot ensure veterans receive quality care via PC3 and Choice. Unlike Health Net and TriWest, VHA does not require its own staff at VHA medical facilities to verify state licenses of Choice physicians under the VHA Choice provider agreements, even though the program was designed to be similar to Choice as implemented by Health Net and TriWest. Thoroughly reviewing Choice physicians’ licenses could be particularly important given that other types of qualifications, such as a physician’s malpractice history, are not reviewed for Choice physicians. Without verifying physicians’ licenses, VHA may be putting itself at risk for procuring care from physicians who are not qualified to treat veterans. In order to ensure that veterans receive quality care from qualified physicians, we recommend that the Secretary of Veterans Affairs direct the Under Secretary for Health to take the following two actions: Develop and implement a comprehensive oversight strategy that includes ongoing monitoring and evaluations of the contractors’ verification of PC3 and Choice physicians’ credentials, as well as VHA staff’s review of Choice physicians. VHA’s oversight should include reviewing documentation and assessing whether the contractors’ plans for improving their processes for Choice credentials verification are effective. Assess the risk associated with not verifying Choice physicians’ licenses under VHA Choice provider agreements, and determine whether modifications to VHA’s policy are needed. We provided a draft of this report for review to the Department of Veterans Affairs. In its written comments, reproduced in appendix I, the department concurred with our recommendations and described plans to implement them by March 2017. The department also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to relevant congressional committees and other interested parties. This report is also available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or curdae@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact named above, Marcia A. Mann, Assistant Director; Kaitlin McConnell, Analyst-in-Charge; and Hannah Marston Minter made key contributions to this report. Also contributing were Muriel Brown; Christine Davis; Jacquelyn Hamilton; Drew Long; Jennifer Whitworth; and William T. Woods.

Summary: To help ensure that veterans are provided timely and accessible health care, VHA purchases care from community physicians. Two community care programs, PC3 and Choice, require physicians to hold certain credentials reflecting their qualifications. Congress included a provision in law for GAO to review VHA's processes for, and oversight of, credentials verification for PC3 and Choice physicians. This report examines (1) whether VA contractors comply with contractual requirements for verifying PC3 and Choice physicians' credentials; (2) the extent to which VHA oversees the contractors responsible for verifying the credentials of PC3 and Choice physicians; and (3) VHA's own processes for, and oversight of, verifying Choice physicians' credentials under recently implemented VHA Choice provider agreements. GAO reviewed PC3 and Choice contracts, VHA and contractor policies, and federal internal control standards. GAO reviewed a nongeneralizable sample of 50 PC3 and 50 Choice physician credentials files, selected among five types of care across the nation. GAO also interviewed VHA officials and contractor representatives. GAO found that the Department of Veterans Affairs' (VA) contractors—Health Net Federal Services (Health Net) and TriWest Healthcare Alliance (TriWest)—complied with contractual requirements to verify the credentials of physicians under one community care program, but were deficient in doing so under another program. Based on GAO's review of selected physicians, GAO found that the contractors almost always verified and documented the credentials of physicians in the Veterans Health Administration's (VHA) Patient-Centered Community Care (PC3) program consistent with the requirements of the contract. In contrast, the contractors did not always verify credentials of the physicians in the Veterans Choice Program (Choice) in a timely manner; and for many physicians, contractors could not produce documentation to support verification consistent with the requirements of the contract. For example, Health Net did not document verification of six Choice physicians' certification to prescribe controlled substances, and TriWest provided insufficient documentation for GAO to determine whether it verified most of the selected Choice physicians' credentials. Both contractors shared plans to address the identified deficiencies. VHA lacked a comprehensive strategy for overseeing Health Net's and TriWest's compliance with contract requirements for verifying the credentials of PC3 and Choice physicians. VA's contracts with Health Net and TriWest specify that VHA will review the contractors' credentialing periodically to determine whether the contractors are in full compliance with the terms of the contract. In addition, federal internal control standards call for monitoring, and corresponding guidance suggests that agencies consider having a strategy to ensure that monitoring is effective. However, GAO found that VHA's monitoring is primarily limited to independent reviews of physicians' credentials using primary source databases, rather than oversight of the contractors' processes for verifying physicians' credentials. VHA has evaluated TriWest's documentation of verifying physicians' credentials for PC3 physicians, but not Health Net's, and has not evaluated either contractor for Choice physicians. Additionally, VHA officials provided conflicting information about the scope, frequency, and interpretation of the results of the oversight they do conduct. Without a comprehensive oversight strategy, VHA cannot ensure that Health Net and TriWest are in compliance with the terms of the contract and that veterans are treated by qualified physicians. In February 2016, VHA began entering into Choice provider agreements with community physicians to provide Choice care to veterans in certain situations. Under these agreements, VHA staff at each medical facility—rather than the contractors—review Choice physicians' credentials. GAO found that VHA did not require its staff to verify licenses submitted by physicians against the issuing source; rather, they review copies of the licenses. Federal internal control standards state that management should identify potential risk factors, such as opportunities for fraud, due to the absence of controls. Without assessing the risk of not verifying physicians' licenses against the issuing source, VHA does not know if a policy change is needed. Furthermore, VHA lacked plans for overseeing staff across each of its medical facilities with the new responsibility of verifying Choice physicians' credentials under the recently implemented VHA Choice provider agreements. VHA should develop a comprehensive oversight strategy that includes monitoring and evaluations of the contractors' verification of PC3 and Choice physicians' credentials, as well as VHA staff's review of Choice physicians; and assess the risk of not verifying Choice physicians' licenses under VHA Choice provider agreements. VA concurred with these recommendations.