Research · 10 min read
What the National Practitioner Data Bank Holds, and Who May Read It
There is a federal record of malpractice payments and licensing actions against individual clinicians. The regulation that created it also prints the list of people allowed to query it, and a patient is not on that list.
Key takeaways
- A federal data bank collects malpractice payments and licensing, privileges and enforcement actions against individual practitioners, and the regulation prints the closed list of who may query it.
- A patient or prospective patient is not on that list; public access is limited to statistical information that identifies nobody.
- The statute and the regulation both say a payment in settlement of a malpractice claim creates no presumption that malpractice occurred.
- Hospitals must query at application and every two years, and a hospital that skips it is presumed to know what was reported; other employers may query but are not required to.
- The report is sealed, yet a state board may still publish its own record of the same action, which is why the board register is the route open to you.
- A dispute review by the Secretary looks only at accuracy, and expressly not at the merits of the action or the process the clinician received.
Answer first: the record exists, and it is closed to you
A federal data bank collects information about the professional competence and conduct of physicians, dentists and other health care practitioners. It has existed for decades and it is national.
The regulation behind it lists, in two enumerated groups, exactly who may request information from it. Hospitals, licensing boards, health care entities considering an employment or affiliation relationship, various federal and state agencies, and the practitioner asking about themselves.
A patient is not on either list. Neither is a prospective patient comparing programs.
That is worth knowing precisely rather than vaguely, because the gap is often described as a records problem when it is a design decision written into the rule.
What has to be reported, and by whom
The reporting duties do not fall on clinicians. They fall on the organizations around them.
The regulation names hospitals, health care entities, boards of medical examiners and professional societies that take adverse licensure or professional review actions. It also names state licensing and certification authorities, peer review organizations and private accreditation entities. And it names entities including insurance companies that make payments in medical malpractice matters, along with federal and state agencies and health plans that take final adverse actions.
Eight categories of reportable action are listed. Malpractice payments, licensure and certification actions, negative actions or findings, and adverse actions against clinical privileges. Then health care criminal convictions, health care civil judgments, exclusions from federal or state health care programs, and other adjudicated actions or decisions.
The clock is short. Reports are due within thirty days following the action, and those reporting malpractice payments, negative findings or adverse actions must also send a copy to their state authorities.
The malpractice duty is written broadly and lands on the payer. Each entity, including an insurance company, that makes a payment for the benefit of a practitioner in settlement or satisfaction of a claim must report it. The report also goes to the state licensing board where the act or omission occurred.
The clause that keeps a payment from being a verdict
Both the statute and the regulation say the same thing about how to read a malpractice payment, and it is the sentence most summaries drop.
A payment in settlement of a medical malpractice action or claim shall not be construed as creating a presumption that medical malpractice has occurred.
That is not a hedge added by a commentator. It is the operative text in two places, and it exists because settlements happen for reasons that have nothing to do with whether care fell short.
The regulation also carves one thing out of the word payment. The waiver of an outstanding debt is not construed as a payment and does not have to be reported.
There is a parallel limit on the other side of the record. The definition of a professional review action excludes actions taken primarily because of a practitioner's fees, advertising or other competitive acts, or their participation in prepaid group health plans or salaried employment.
So the record is meant to be about competence and conduct. Commercial disagreements are supposed to stay out of it.
Who has to look, and how often
One institution is required to query, and it is not a telehealth company. Each hospital, directly or through an authorized agent, must request information when a practitioner applies for a position on its medical staff or for clinical privileges. The request repeats every two years for anyone who holds either.
The consequence of skipping it is unusual and worth reading twice. A hospital that does not request the information is presumed to have knowledge of anything reported about that practitioner.
A hospital that does query gets a protection in return. It may rely on what the data bank provides, and is not liable for that reliance unless it knows the information was false.
Other organizations may query without being required to. A health care entity that has entered or may be entering into an employment or affiliation relationship with a practitioner is on the permitted list.
Permitted is not the same as obliged. Nothing in the regulation requires an ordinary employer of clinicians to check, and nothing requires it to tell you whether it did.
The list of who may request, read to the end
The first group covers malpractice payments, medical board licensure actions and adverse clinical privileges actions. It runs to seven entries.
A hospital about its own medical staff. A practitioner about themselves. A state medical board or other licensing authority. A health care entity entering an employment or affiliation relationship, or considering an application for privileges. A health care entity conducting professional review activity. And anyone requesting statistical information in a form that does not identify an individual or entity.
The seventh entry is the one people reach for, and its conditions are strict. An attorney, or an individual representing themselves, who has filed a medical malpractice action against a hospital may request information about a practitioner also named in that action.
Three limits sit on that entry. The action has to be against a hospital. The requester has to submit evidence that the hospital failed to query as required. And the information may be used solely with respect to that litigation.
The second group covers state and federal licensure actions, negative findings, convictions, civil judgments and exclusions. It is a list of agencies, licensing authorities, law enforcement officials, peer review organizations, hospitals and other health care entities, health plans, the subject of the record, and again statistical requests that identify nobody.
Read together, the two groups describe a system built for credentialing and enforcement. It was not built as a consumer register and it does not behave like one.
Confidentiality, and the door it leaves open
The confidentiality rule is short. Information reported to the data bank is confidential and shall not be disclosed outside the department except as the regulation specifies, and recipients must use it solely for the purpose for which it was provided.
Then comes the sentence that changes what is actually knowable. The data bank report may not be disclosed. But nothing in the section prevents a party from disclosing information out of its own files that were used to create the report, where state or federal law otherwise authorizes it.
That is the whole reason a state licensing board's own published action can be public while the federal report of it is not. They are two documents about one event, and only one of them is sealed.
The statute adds a second opening. Information in a form that does not permit identification of any entity, practitioner or patient is not considered confidential. On application by any person, the Secretary is required to prepare and disclose it in that form.
So aggregate counts are available and individual records are not. Disclosing a report improperly carries a civil money penalty under the statute and the regulation alike.
Disputes, immunity, and what none of it decides
The subject of a report is sent a copy routinely and may dispute it. A disputed report is flagged as such and the flag travels to the reporting entity and to anyone who has queried it.
The review that follows is narrower than it sounds. If the matter reaches the Secretary, the review is of the accuracy of the reported information only. It expressly does not consider the merits or appropriateness of the action, or the due process the subject received.
Reporting also carries immunity. Individuals, entities and the data bank itself are not liable in a civil action brought by the subject of a report unless the reporter had actual knowledge that the information was false.
Put those together and the record's character is clear. It is an accurate register of what happened administratively, not an adjudication of whether it should have.
None of this decides anything about a program you are considering. It describes what one federal system collects, who it answers, and the reasons a search you cannot run would not settle the question anyway.
What is checkable instead
The state licensing board that issued a clinician's license is the accessible half of the same picture. Boards publish license status, and a number of them publish formal actions, on their own terms and their own timelines.
That route needs two things the data bank route does not. A full name and a credential, because a lookup by brand name returns nothing.
Ask for both at the point a clinical question is answered, rather than planning to look them up during a problem. A saved message costs nothing and survives a redesign.
And keep the limits in view. A license lookup returns a status rather than a judgment about care, and the absence of a published action is an absence from one register in one state.
Sources
- 45 CFR Part 60, "National Practitioner Data Bank" (sections 60.1, 60.2, 60.3, 60.5, 60.7, 60.8, 60.17, 60.18, 60.20, 60.21 and 60.22)That the data bank collects and releases information relating to the professional competence and conduct of physicians, dentists and other health care practitioners; the classes of organization on which reporting duties fall; the eight listed categories of reportable action and the thirty-day reporting window; that each entity including an insurance company making a payment for the benefit of a practitioner in settlement or satisfaction of a malpractice claim must report, and that the waiver of an outstanding debt is not construed as a payment; that a payment in settlement shall not be construed as creating a presumption that medical malpractice has occurred; that a board of medical examiners must report revocations, suspensions and other restrictions, censures, reprimands, probation and surrenders based on reasons relating to professional competence or conduct; that each hospital must query at application for medical staff membership or clinical privileges and every two years thereafter, that a hospital which does not is presumed to have knowledge of reported information, and that a hospital may rely on what it receives absent knowledge of falsity; the two enumerated lists of persons and entities to whom information is available, including the conditions on the entry for an attorney or self-represented individual who has filed a malpractice action against a hospital; that information is confidential and shall not be disclosed outside the Department except as specified, that recipients must use it solely for the purpose provided, and that nothing prevents a party from disclosing information from its own files used to create such reports where otherwise authorized under state or federal law; that a violation carries a civil money penalty; that a review by the Secretary of a disputed report considers only accuracy and not the merits or appropriateness of the action or the due process the subject received; and that reporters and the data bank are not liable in a civil action brought by the subject absent actual knowledge of falsity. The definition of a professional review action, which excludes actions taken primarily because of fees, advertising, other competitive acts, or participation in prepaid group health plans or salaried employment, is in the definitions section.
- 42 U.S.C. 11137, "Miscellaneous provisions"That the Secretary shall on request provide reported information about a physician or other licensed health care practitioner to state licensing boards, to hospitals, and to other health care entities including health maintenance organizations that have entered or may be entering into an employment or affiliation relationship with the practitioner or to which the practitioner has applied for clinical privileges or medical staff appointment; that information reported is confidential and shall not be disclosed other than to the practitioner involved except as the subsection allows; that nothing in the subsection prevents disclosure by a party otherwise authorized under applicable state law; that information in a form which does not permit the identification of any particular health care entity, physician, other health care practitioner or patient shall not be considered confidential, and that on application by any person the Secretary shall prepare and disclose such information in that form; that a violation carries a civil money penalty; that information provided is intended to be used solely with respect to activities in furtherance of the quality of health care; and that in interpreting reported information, a payment in settlement of a medical malpractice action or claim shall not be construed as creating a presumption that medical malpractice has occurred.
Frequently asked questions
Can I look up my clinician in the National Practitioner Data Bank?
No. The regulation prints two enumerated lists of who may request information, and both were read end to end. They cover hospitals, licensing boards, and health care entities entering an employment or affiliation relationship or reviewing an application for privileges. They also cover federal and state agencies, law enforcement officials, health plans, peer review organizations, and the practitioner asking about themselves. A patient or a prospective patient is not on either list. The only route open to the general public is a request for statistical information in a form that does not identify any individual or entity.
What gets reported into it?
Eight categories, named in the regulation. Malpractice payments. Licensure and certification actions by medical boards and by states. Negative actions or findings by peer review organizations or private accreditation entities. Adverse actions against clinical privileges. Health care related criminal convictions and civil judgments. Exclusions from federal or state health care programs, and other adjudicated actions or decisions. Reports are due within thirty days of the action. The duties fall on organizations — hospitals, boards, insurers and agencies — rather than on the clinician who is the subject.
Does a malpractice payment mean the clinician did something wrong?
The statute and the regulation both answer that, in the same words, and the answer is no. A payment in settlement of a medical malpractice action or claim shall not be construed as creating a presumption that medical malpractice has occurred. The sentence is operative text rather than commentary. Settlements are made for many reasons, including cost and closure, and the drafters wrote the caution directly into the law rather than leaving it to whoever reads a report later.
Does a telehealth company have to check this record before hiring a clinician?
The mandatory query in the regulation applies to hospitals. Each hospital must request information when a practitioner applies for medical staff membership or clinical privileges, and again every two years, and a hospital that does not is presumed to know whatever was reported. Other health care entities that have entered or may be entering an employment or affiliation relationship are permitted to query, not required to. So the honest answer for any other kind of employer is that the regulation allows the check and does not compel it, and does not require anyone to tell you the result.
Is any part of it public?
Aggregate information is, by statutory duty. Information in a form that does not permit the identification of any particular health care entity, practitioner or patient is not considered confidential. On application by any person, the Secretary is required to prepare and disclose it in that form. Individual reports are the opposite: confidential, disclosable only as the regulation specifies, usable by a recipient solely for the purpose it was provided, and enforced with a civil money penalty. The distinction is between counts and names.
If the federal record is sealed, how did I read about a board action online?
Because they are two documents about one event. The regulation says the data bank report may not be disclosed. It then says nothing in it prevents a party from disclosing information out of its own files that were used to create the report, where state or federal law otherwise authorizes it. A licensing board's own record of its own action is that party's own file. So a state may publish what it did while the federal report of the same action stays closed, which is why a board register is the route that is actually available to you.