Health Information Systems

The Department of Health and Human Services (HHS) created its National Practitioner Data Bank to help prevent unethical or incompetent doctors from moving across state lines and concealing their professional history. HHS' management of the data bank, however, has allowed weaknesses that undermine achievement of a timely, secure, and cost-efficient operation. The data bank usually does not give users responses to their questions for several weeks, which in turn delays the granting of privileges to health care practitioners. Further, poor internal controls have allowed user organizations to receive sensitive practitioner data to which they were not entitled. In addition, HHS has inadequately monitored the data bank contractor. Finally, although HHS intends to revamp the data bank, its plans have not incorporated a sound system development approach and are based on funding uncertainties. As a result, HHS may acquire a system that does not meet users' needs.

GAO found that: (1) data bank users generally did not timely receive responses to queries, which inhibited them from making decisions regarding health care practitioner privileges; (2) approximately 20 percent of the hospitals surveyed did not receive query responses before granting practitioner privileges; (3) the reliance on paper documentation, absence of social security numbers on reports, and software deficiencies were the primary reasons for response delays; (4) the data bank failed to provide adequate security for sensitive practitioner data; (5) because of insufficient internal controls, query responses were mailed to wrong addresses and six hospitals erroneously received sensitive practitioner data; (6) HHS failure to use available contractor and internal staff resources and computer specialists to monitor operation of the automated system resulted in continued system deficiencies, inaccurate system documentation, and changes not being reviewed; (7) plans for the data bank's automated system redesign were flawed because of inadequate development principles, inattention to user needs, and existing system deficiencies; and (8) although HHS plans to implement and finance system improvements by charging user fees, it does not have the authority to do so.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone: