Health Information Systems:

National Practitioner Data Bank Continues to Experience Problems

IMTEC-93-1: Published: Jan 29, 1993. Publicly Released: Jan 29, 1993.

Additional Materials:

Contact:

Patricia T. Taylor
(202) 512-6252
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

GAO reviewed the Department of Health and Human Services' (HHS) National Practitioner Data Bank's management controls, focusing on whether HHS: (1) ensures that the data bank timely and securely accepts and responds to user requests; (2) adequately monitors contractor operations of the data bank's automated system; and (3) future directional planning and financing is adequate.

GAO found that: (1) data bank users generally did not timely receive responses to queries, which inhibited them from making decisions regarding health care practitioner privileges; (2) approximately 20 percent of the hospitals surveyed did not receive query responses before granting practitioner privileges; (3) the reliance on paper documentation, absence of social security numbers on reports, and software deficiencies were the primary reasons for response delays; (4) the data bank failed to provide adequate security for sensitive practitioner data; (5) because of insufficient internal controls, query responses were mailed to wrong addresses and six hospitals erroneously received sensitive practitioner data; (6) HHS failure to use available contractor and internal staff resources and computer specialists to monitor operation of the automated system resulted in continued system deficiencies, inaccurate system documentation, and changes not being reviewed; (7) plans for the data bank's automated system redesign were flawed because of inadequate development principles, inattention to user needs, and existing system deficiencies; and (8) although HHS plans to implement and finance system improvements by charging user fees, it does not have the authority to do so.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: HHS has delayed contract award to take the steps recommended by GAO.

    Recommendation: The Secretary of Health and Human Services should not award a contract for the development of a new automated system until ensuring that user needs have been adequately identified, requirements have been fully defined, and alternatives have been assessed.

    Agency Affected: Department of Health and Human Services

  2. Status: Closed - Implemented

    Comments: In accordance with GAO's recommendation, the Deputy Assistant Secretary for Information Resources Management is providing oversight of development activities for the new system, and a detailed user needs assessment is being conducted.

    Recommendation: The Secretary of Health and Human Services should direct the Deputy Assistant Secretary of the Office of Information Resources Management, which is responsible for ensuring consistency with information resources management requirements, to provide independent technical oversight of the HHS organization responsible for developing the new automated system to ensure that it follows sound system development life-cycle practices, including ensuring that a detailed identification of user needs is performed.

    Agency Affected: Department of Health and Human Services

  3. Status: Closed - Implemented

    Comments: HHS has initiated on-going efforts that use agency personnel and contractor support to monitor the data bank contractor's operations. These activities satisfy the intent of the recommendation.

    Recommendation: The Secretary of Health and Health Services should direct the Administrator, HRSA, to use necessary technical expertise to perform routine on-site monitoring of the contractor's operation of the automated system. Such monitoring should include, at a minimum: (1) comprehensive reviews of the contractor's implementation of test plans, corrective actions to remedy known weaknesses, and documentation for data backup; (2) obtaining full documentation of the automated system, including software; and (3) analyses of contractor proposals of system changes based on reviews of system documentation and test results.

    Agency Affected: Department of Health and Human Services

  4. Status: Closed - Implemented

    Comments: With its recent award of a $12-million contract to develop a new system, HHS has begun to further implement its long-range strategy to minimize the use of hard copy documents through the use of online transmission of queries, responses to queries, and adverse action and malpractice payment reports through a secure data network. In the interim, a number of other changes are being implemented to help ensure that responses are mailed to the correct recipients (e.g., printing additional identification data on each page of query responses and requesting entities to submit a single complete official mailing address.

    Recommendation: To improve the handling of query responses containing sensitive malpractice payment or adverse action information, the Secretary of Health and Human Services should direct the Administrator, HRSA, to institute additional safeguards to ensure that practitioner identification data on these queries match reports and that responses are mailed to the correct recipients.

    Agency Affected: Department of Health and Human Services

  5. Status: Closed - Implemented

    Comments: HHS agrees with the recommendation, and its Division of Quality Assurance has modified and distributed revised instructions to all Data Bank reporters and queriers indicating that the practitioner's social security number should be submitted if it was obtained in accordance with Section 7 of the Privacy Act of 1974.

    Recommendation: To improve the data bank's timeliness in responding to queries, the Secretary of Health and Human Services should direct the Administrator, Health Resources and Services Administration (HRSA), to send information to reporting and querying organizations that encourages the use of social security numbers and explains how supplying social security numbers can improve the timeliness of query responses.

    Agency Affected: Department of Health and Human Services

  6. Status: Closed - Implemented

    Comments: HHS changed user fees, effective July 1, 1993, to: (1) recognize the difference in processing costs for queries submitted on paper and those submitted electronically; and (2) encourage more extensive use of electronic querying.

    Recommendation: To improve the data bank's timeliness in responding to queries, the Secretary of Health and Human Services (HHS) should direct the Administrator of the Health Resources and Services Administration (HRSA) to establish a user fee policy that sets fees commmensurate with the costs for processing queries for each type of media used.

    Agency Affected: Department of Health and Human Services

  7. Status: Closed - Not Implemented

    Comments: On the basis of language in the fiscal year 1993 appropriations bill, which allowed recovery of full operating costs with a user fee of $6 per query, HHS has taken a position that development costs may be funded with user fees. On July 1, 1993, the change in the user fee structure to fund the development of the new processing system was initiated. In addition to the user fee of $6 per query, funds have been appropriated annually to pay the cost of ongoing system enhancements. HHS considers this recommendation to be implemented.

    Recommendation: The Secretary of Health and Human Services should immediately pursue funding authority for development of the new system.

    Agency Affected: Department of Health and Human Services

 

Explore the full database of GAO's Open Recommendations »

Sep 26, 2016

Sep 15, 2016

Sep 14, 2016

Sep 8, 2016

Jun 29, 2016

Jun 22, 2016

Jun 10, 2016

Jun 9, 2016

Jun 2, 2016

May 25, 2016

Looking for more? Browse all our products here