Synergy - March/April 2014 - 22

bank on it

Confidentiality Guidelines
for NPDB Users
By Donald Illich

P
Donald Illich is a writer-editor for
the Division of Practitioner Data
Banks, which is part of the Health
Resources and Services
Administration, Bureau of Health
Professions. He has written
several articles for both internal
and external audiences
concerning the policies and
operations of the Data Bank. He
is a member of the Division's
Policy and Disputes Branch. He
lives and works in Rockville, Md.

rotecting confidential information
is one of the most important
responsibilities of the National
Practitioner Data Bank (NPDB). This
includes ensuring that reports to the
Data Bank are revealed only to eligible
entities, that entities take appropriate
actions to safeguard personally identifiable
information (PII), and that authorized
agents and entities who have permission
to query the Data Bank do not share
confidential information with others
improperly. PII is information that can be
used on its own or with other information
to identify, contact, or locate a single
person, or to identify an individual in
context; it is a type of confidential
information. Authorized agents have
been designated by eligible health care
organizations to query or report on the
organizations' behalf.
The purpose of this article is to help users
understand and comply with confidentiality
requirements.

How the Data Bank Ensures
Report Sharing Only to
Eligible Entities
Data Bank information is confidential and
may be shared only with eligible entities.
Entities are not permitted access to the
NPDB unless they are legally eligible to
do so. Information reported to the NPDB
is considered confidential and may not
be disclosed except as specified in the
regulations. Individuals and entities receiving
information from the NPDB, either directly
or from another party, must use it solely for
the purpose for which it was provided.
Violations of confidentiality can result in
a civil penalty of up to $11,000 for each
violation.
The Privacy Act also protects Data Bank
information and generally allows the subject
of a Data Bank report to access that report
and the names of entities that have queried
22

/

SYNERGY MARCH/APRIL 2014

his or her name. Access and correction
rights are governed by NPDB regulations.
The Data Bank does not allow disclosure
to the general public. The general public
may not request information from the Data
Bank that identifies a particular health care
practitioner, entity, provider, or supplier.
Although Data Bank reports legally cannot
be released for any purpose other than
those allowed by regulation (such as entities
using them to help make employment,
credentialing, certification, and licensing
decisions), the underlying information
that an entity compiles to create a Data
Bank report may be released by the
entity if otherwise permitted by federal
or state law. The NPDB's confidentiality
provisions do not impose any new
confidentiality requirements or restrictions
on those documents or records. Thus,
the confidentiality provisions do not bar
nor restrict the release of the underlying
documents, or the information itself, by an
entity taking an adverse action or making a
payment in settlement of a written medical
malpractice complaint or claim. So, for
instance, a state freedom of information
law that requires the release of records
may require the release of the records
underlying a report but would not permit
the release of the NPDB report itself.
Entities must take care of sensitive materials,
such as PII. To safeguard the system, the
Data Bank requires all user accounts to
have unique user IDs and user passwords.
Each organization and authorized agent
is assigned a Data Bank Identification
Number (DBID) when it registers with the
Data Bank. In addition, each Data Bank
administrator must choose a user ID and
password as part of the registration process.
Once the registration is approved by the
Data Bank, the administrator can assign a
user ID and password to each additional
employee who is authorized to query or
report to the Data Bank.
Synergy - March/April 2014

Table of Contents for the Digital Edition of Synergy - March/April 2014
