Healthcare Quality Improvement Act (HCQIA) — Peer Review & National Practitioner Data Bank

The Healthcare Quality Improvement Act of 1986 (42 U.S.C. §§ 11101–11152) is the federal statute that enables hospitals, medical staff organizations, and other health care entities to conduct meaningful peer review — disciplinary and quality oversight processes — without being bankrupted by antitrust lawsuits from physicians who are disciplined or have their privileges revoked. Before HCQIA, physicians subjected to peer review actions sometimes sued hospitals under federal antitrust law, claiming that peer review was an illegal conspiracy to eliminate competition. HCQIA provides qualified immunity from damages for peer reviewers who follow fair procedures, and in exchange requires health care entities to report disciplinary actions and malpractice payments to the National Practitioner Data Bank (NPDB) — a federal database that hospitals must query when credentialing physicians. The twin pillars of HCQIA — protection from antitrust suits for fair peer review and mandatory reporting to NPDB — are the statutory foundation of the U.S. medical credentialing system. For the AHRQ research programs that use NPDB data to track patient safety and quality trends, see that page. HCQIA also interacts with EMTALA, which prohibits patient dumping by hospitals — peer review can reveal EMTALA-related conduct.

Current Law (2026)

Legal Authority

• 42 U.S.C. § 11111 — Professional review protection: if a professional review action meets the standards in § 11112, the review entity and individual reviewers are immune from liability in damages under federal or state law, except for civil rights violations; this is the core liability protection enabling peer review
• 42 U.S.C. § 11112 — Standards for professional review actions: to receive immunity, a professional review action must be: (1) taken in reasonable belief that it furthers quality health care; (2) after reasonable effort to obtain the facts; (3) after adequate notice and hearing or procedures that ensure fairness; and (4) in the reasonable belief that the action was warranted; these procedural standards define what makes peer review "protected"
• 42 U.S.C. § 11113 — Attorney's fees: if a defendant substantially prevails in a suit brought against a protected peer review action, the court shall award reasonable attorney's fees and costs; this provision deters meritless antitrust suits against peer reviewers
• 42 U.S.C. § 11131 — Malpractice payment reporting: every entity that makes a malpractice payment on behalf of a physician or dentist must report the payment to the Secretary (HRSA/NPDB) within 30 days; the report must include the payment amount, reason, and the practitioner's identification; this creates a national record of malpractice payments regardless of state law
• 42 U.S.C. § 11132 — Licensing board reporting: state medical and dental boards must report license revocations, suspensions, and restrictions; licensure actions taken for reasons related to professional competence or conduct must be reported to the NPDB within 30 days
• 42 U.S.C. § 11133 — Hospital peer review reporting: hospitals and other health care entities must report adverse privilege actions affecting a physician for more than 30 days; voluntary surrender of privileges during an investigation must also be reported; reports identify the physician, the action taken, and the basis for the action
• 42 U.S.C. § 11135 — Hospital query obligation: hospitals must query the NPDB when a physician applies for medical staff privileges and at least every two years for physicians with existing privileges; a hospital that fails to query is deemed to have constructive knowledge of information in the NPDB — making failure to query a potential liability in negligent credentialing cases

The National Practitioner Data Bank

The NPDB is the operational center of the HCQIA system. Maintained by HRSA, it is a confidential database that:

Collects malpractice payment reports, licensing board actions, hospital privilege restrictions, DEA actions, Medicare/Medicaid exclusions, and clinical privilege surrenders.

Provides query results to authorized entities — hospitals (mandatorily), health plans, state medical boards, and practitioners querying their own records. The NPDB is not publicly accessible; public query capability was specifically rejected by Congress to prevent the database from being used as a public blacklist.

Creates accountability through the mandatory query requirement: hospitals that credential a physician without querying the NPDB lose the defense of not knowing about that physician's disciplinary history. Negligent credentialing claims are a significant medical malpractice category, and failure to query NPDB undermines a hospital's ability to defend such claims.

Documents patterns: Because the NPDB collects from across the country, it can identify physicians who have been disciplined in one state and moved to another to avoid that history — the so-called "physician wandering" problem that motivated HCQIA's national scope.

The Peer Review Process

For a peer review action to receive HCQIA immunity, the reviewing entity must follow fair procedures:

1. Notice: the physician must receive written notice of the proposed action and the reasons for it
2. Hearing: the physician must have an opportunity for a hearing before a panel that does not include economic competitors
3. Legal representation: the physician may be represented by an attorney
4. Decision in writing: the reviewing body must provide a written decision with the reasons

A hospital or medical staff organization that follows these procedures can revoke or restrict clinical privileges — affecting a physician's ability to practice at that facility — without facing antitrust liability for the decision, as long as the decision was based on professional competence or conduct concerns.

How It Affects You

If you are a physician: Your NPDB record follows you nationally — any hospital or health plan that credentials you will query it. Malpractice payments (including small settlements paid on your behalf without your admission of liability), medical license restrictions, and privilege revocations exceeding 30 days are permanently reported with no expiration. Query your own record at npdb.hrsa.gov (Self-Query, free) before applying for privileges anywhere new — you need to know what hospitals see before they see it. If you are facing a peer review action, the hospital must provide HCQIA-compliant procedures: written notice of the proposed action and reasons, an opportunity to request a hearing, a hearing before a panel that does not include your economic competitors, the right to legal representation, and a written decision with reasons. These protections apply before privileges are restricted for more than 30 days. Engage a healthcare attorney with medical staff law experience at the first notice of a peer review inquiry — the hearing is your best opportunity to contest the action, and failure to raise procedural objections during the process can foreclose legal challenges afterward.

If you are a hospital credentialing officer or medical staff coordinator: Querying NPDB is legally mandatory at initial appointment and at every re-credentialing cycle (at minimum every two years). Failure to query creates constructive knowledge: courts in negligent credentialing cases treat hospitals as if they knew whatever the NPDB contained — even if they never queried. Track re-credentialing deadlines at least 90 days in advance and build NPDB query into your standard workflow so results are reviewed before privileges expire. When NPDB returns a match, analyze the report in full — a single low-value malpractice settlement in an unrelated specialty requires different analysis than multiple payments in the physician's current area. If a reportable action occurs at your facility, you have 30 days to submit the NPDB report after the action becomes final; late reporting exposes the hospital to HRSA sanctions and can undermine the qualified immunity protection for the underlying peer review action.

If you are a medical board member or peer reviewer: The § 11112 immunity safe harbor requires four elements — take contemporaneous notes on each and preserve the record: (1) the reviewing body had a reasonable belief the action would further quality health care; (2) reasonable efforts were made to obtain the facts (patient records, practitioner explanation, expert consultation where indicated); (3) adequate procedures were followed — notice, hearing opportunity, legal representation rights, written decision; and (4) there was a reasonable belief the action was warranted by the facts found. Courts apply a deferential standard to peer review decisions meeting these criteria — the question is not whether the reviewing body was right, but whether it had a reasonable basis. Under § 11113, if a physician brings an antitrust suit challenging a protected peer review action and the reviewing entity substantially prevails, the court shall award attorney's fees against the plaintiff — this deters meritless suits, but requires that your review actually followed the § 11112 procedures and that you document that compliance contemporaneously.

If you are a patient concerned about a physician's background: The NPDB is not publicly accessible — Congress explicitly barred public access. Your primary tools: (1) your state medical board's public disciplinary database — find your state's board at fsmb.org/contact-a-member-board (Federation of State Medical Boards) or search directly at docinfo.org, which aggregates state board data; (2) your state's medical licensing verification system, which shows current license status, disciplinary actions, and sometimes malpractice payment history; (3) if your concern involves hospital failures to act on known physician problems, file a complaint with The Joint Commission (jointcommission.org/report-a-concern), which accredits most U.S. hospitals and investigates patient safety concerns, or with your state department of health. You can also file a complaint with your state medical board at the contacts listed at fsmb.org.

State Variations

Every state has its own peer review privilege statute that may provide broader protection than HCQIA. Many state statutes protect peer review records from discovery in malpractice litigation — HCQIA does not itself provide evidentiary privilege (only damages immunity). States with strong peer review privilege statutes provide a more complete shield: HCQIA protects from antitrust liability; state privilege statutes protect from having peer review documents produced in court.

Pending Legislation

No major structural changes to HCQIA pending as of April 2026. The NPDB is periodically updated to cover additional reporting categories. Expansion of NPDB reporting to include behavioral health providers and certain allied health professionals has been a recurring policy discussion.

Recent Developments

• NPDB query requirements and telehealth multi-state practice: The NPDB's original reporting and query model assumed physicians practicing in one state. The telehealth expansion — physicians now routinely see patients in states where they hold licenses but aren't physically present — has complicated both reporting (which state's board takes action for a telehealth incident?) and querying (hospitals credentialing a physician who practices via telehealth must query NPDB but may not be aware of adverse actions in all states where the physician is licensed). The Interstate Medical Licensure Compact (IMLC), now covering most states, improves multi-state licensing but hasn't fully resolved the NPDB reporting question for cross-state telehealth adverse events.
• Opioid prescribing-related NPDB reports: volume and response: The opioid epidemic generated a significant increase in state licensing board disciplinary actions against physicians for inappropriate opioid prescribing — DEA license surrenders, state board suspensions, and civil money penalties that are reportable to NPDB. The NPDB has tracking data showing that opioid prescribing-related adverse actions peaked around 2019–2020 and have modestly declined as prescribing guidelines were implemented. The NPDB database is used by hospitals and insurers to screen physicians before employment; a malpractice payment plus a licensing action creates a significant barrier to future employment even if the physician's prescribing has since been corrected.
• NPDB access expansion: who can query and for what purposes: NPDB querying has been expanded beyond hospitals to include more health care entities, nursing homes, home health agencies, and outpatient surgical centers. The practical effect: a nurse practitioner or PA with a malpractice payment or licensing board action faces broader querying during credentialing than in earlier years, when NPDB was primarily used for physician hospital privilege applications. The anti-competitive peer review immunity provisions of the HCQIA (which protect quality improvement activities from antitrust claims) continue to be tested in cases where hospitals argue that privilege denials were quality-based rather than anticompetitive.
• Artificial intelligence credentialing and peer review implications: Hospital credentialing and quality review programs increasingly incorporate AI tools to flag performance patterns — outlier complication rates, unusual prescribing, patient complaint clustering. The legal framework for AI-assisted peer review under HCQIA's immunity provisions hasn't been fully tested; if AI-generated quality assessments drive adverse privilege actions, the HCQIA immunity analysis may need updating. HRSA and the Joint Commission have begun discussing standards for AI quality metrics in credentialing, but no formal regulatory guidance has been issued as of April 2026.