National Practitioner Data Bank (NPDB)

The National Practitioner Data Bank — created by the Health Care Quality Improvement Act of 1986 (HCQIA, 42 U.S.C. § 11101) and expanded by the Social Security Act — is a federal repository of adverse actions against health care practitioners, providers, and suppliers. Operated by HHS, it collects reports of medical malpractice payments, license revocations, hospital privilege restrictions, OIG exclusions from federal health programs, criminal convictions related to health care delivery, and other adjudicated actions. Hospitals must query the NPDB before granting any physician or dentist clinical privileges and every two years for all practitioners on their medical staff — failure to query creates a legal presumption that the hospital knew of any unreported adverse action. The NPDB is the central infrastructure for practitioner credentialing accountability in the United States: it closes the gap that once allowed physicians with disciplinary histories in one state to simply relocate and obtain new privileges elsewhere.

Legal Authority

• 42 U.S.C. § 11101 — Health Care Quality Improvement Act of 1986 (HCQIA); establishes the NPDB; requires hospitals to report adverse privilege actions and malpractice payments; mandates hospitals query the NPDB before granting clinical privileges; grants immunity to reporting entities and peer review participants acting in good faith
• 42 U.S.C. § 1320a-7e — Social Security Act § 1128E; expands NPDB reporting to include OIG exclusions, civil monetary penalties, and other adverse actions against all health care entities (not just physicians); integrates NPDB with federal program integrity functions
• 42 U.S.C. § 1396r-2 — Medicaid reporting requirements for adverse actions against nursing facility employees; feeds into NPDB infrastructure
• 45 CFR Part 60 — HHS implementing regulation; establishes reporting timelines (30 days), query requirements, data elements, and access rules for the NPDB

Key Mechanics

The NPDB collects six categories of reports: (1) medical malpractice payments (any payment in settlement or judgment by or on behalf of a practitioner); (2) adverse licensure actions (revocations, suspensions, censures by state licensing boards); (3) adverse clinical privileges actions (reduction, restriction, suspension, or denial of hospital privileges); (4) adverse professional society membership actions; (5) OIG exclusions and sanctions from federal health programs; and (6) criminal convictions related to health care delivery. Hospitals must query the NPDB before granting clinical privileges to any physician or dentist, and must re-query every practitioner on their medical staff at least once every two years; failure to query creates a legal presumption that the hospital had constructive knowledge of any unreported adverse action, eliminating the HCQIA's peer review immunity for privilege decisions. Reports must be submitted within 30 days of an adverse action. The NPDB is not public — practitioners may access their own records; other health care entities (HMOs, group practices) may query; the general public cannot. A practitioner who disagrees with a report may add a statement of dispute to the record but cannot unilaterally require correction; correction requires agreement of the reporting entity or a successful HRSA dispute resolution process.

Current Rule (2026)

What This Rule Does

The regulation implements Congress's response to a documented problem: health care practitioners who committed malpractice or had their licenses revoked in one state could relocate to another state, obtain a new license, and gain hospital privileges without any disclosure of their history. The NPDB creates a national clearinghouse of adverse professional actions that follows practitioners regardless of where they practice.

Mandatory reporting to the NPDB is required from multiple sources. Health care entities (hospitals, group practices, HMOs) that take adverse actions against clinical privileges must report. Federal and state licensing boards must report license revocations, suspensions, and other formal disciplinary actions. Federal and state prosecutors must report criminal convictions related to health care delivery. Insurance companies, attorneys, and health plans must report medical malpractice payments — any settlement or judgment payment made on behalf of a physician, dentist, or other health care practitioner, regardless of whether the payment reflects an admission of liability. OIG exclusions from Medicare, Medicaid, and other federal health programs are reported automatically. The NPDB also receives reports of civil judgments and "other adjudicated actions" — a catchall for formal professional discipline proceedings outside the licensure context.

Mandatory querying is required of hospitals in two circumstances: at the time a health care practitioner applies for medical staff membership or clinical privileges, and every two years for any practitioner already on staff. The two-year cycle requirement — not just a one-time check at hiring — reflects Congressional recognition that practitioners accumulate adverse actions throughout their careers. A hospital that fails to query at the required time is legally presumed to have knowledge of anything in the NPDB about that practitioner. This presumption shifts liability: a hospital that grants privileges without querying and then is sued for negligent credentialing cannot claim it had no notice of a practitioner's history.

Other health care entities (nursing homes, ambulatory surgery centers, group practices, HMOs, managed care plans) and state licensing boards may query the NPDB on a permissive basis. Individual practitioners may query their own records at any time. The public does not have access to NPDB reports about individual practitioners — the database is restricted to credentialing and licensing purposes. (A separate Public Use Data File is available without individual identifiers for research purposes.)

Key Provisions

• § 60.1 — The NPDB: the NPDB collects and releases information under three authorities: HCQIA (professional review, malpractice), Social Security Act § 1921 (state adverse licensure and fraud actions), and Social Security Act § 1128E (health care fraud and abuse data collection)
• § 60.3 — Definitions: "adverse action" includes any formal adverse action taken against a practitioner's license, certification, privileges, or participation in a health care program; "formal proceedings" means proceedings in which charges are filed and the practitioner has notice and opportunity to respond; "health care entity" includes hospitals, HMOs, group practices, and other entities that provide health care services or pay for care
• § 60.7 — Malpractice payments: any entity (insurer, self-insurer, or government program) that makes a payment in settlement or satisfaction of a written claim of medical malpractice must report within 30 days of payment; the report must identify the practitioner, describe the act or omission alleged, and state the amount paid; a payment from any funding source triggers the obligation — including pro-rata payments in multi-defendant settlements
• § 60.8 — State Boards of Medical Examiners: state licensing boards must report formal adverse licensure actions (revocations, suspensions, censures, probation, reprimands) against physicians and dentists to the NPDB and provide a copy of the report to the Federation of State Medical Boards within 30 days of the effective date of the action; actions taken while an appeal is pending are still reportable (§ 60.8(a)(2))
• § 60.10 — Federal licensure and certification actions: federal agencies (CMS, FDA, DEA, OIG) must report final adverse actions — including revocation or suspension of Medicare/Medicaid participation agreements, loss of DEA registration, and formal reprimands — within 30 days
• § 60.12 — Clinical privilege actions: each hospital must report any professional review action that adversely affects a physician's or dentist's clinical privileges for more than 30 days; this includes acceptance of a voluntary surrender of privileges while under investigation — the voluntary surrender provision closes the loophole by which a practitioner under investigation would resign before a formal finding was made
• § 60.13 — Criminal convictions: federal and state prosecutors must report criminal convictions against health care practitioners, providers, and suppliers related to the delivery of a health care item or service; this includes healthcare fraud, kickback offenses, and patient abuse convictions; reports must be filed regardless of whether an appeal is pending
• § 60.15 — Exclusions: OIG exclusions from participation in Medicare, Medicaid, and other federal health care programs must be reported by federal and state agencies, including exclusions in matters that settled without findings of liability; this ensures the NPDB captures exclusions that might not appear as formal adverse licensing actions
• § 60.17 — Mandatory hospital querying: hospitals must request NPDB information (a) when a practitioner applies for staff membership or clinical privileges and (b) every 2 years for practitioners already on staff; a hospital that fails to query is deemed to have knowledge of any adverse information in the NPDB about that practitioner — shifting legal responsibility to the hospital

How It Affects You

If you are a physician, dentist, or other licensed health care practitioner: Any malpractice payment made on your behalf, license action, or clinical privilege restriction will be reported to the NPDB and will appear in any credentialing query about you. You have the right to query your own NPDB record at any time through the NPDB website (npdb.hrsa.gov). If you dispute a report, you can submit a dispute to the NPDB and the reporting entity must respond; if the dispute is not resolved, your statement of dispute is attached to the report and disclosed whenever your record is queried. Malpractice payment reports and adverse action reports remain in the NPDB permanently — there is no expiration. When applying for privileges at a new hospital, expect that the credentialing committee will query the NPDB and review all reports about you. Settlements often include NPDB reporting obligations even when there is no admission of liability.

If you are a hospital administrator or credentialing officer: Querying the NPDB is not optional for initial privileges or biennial renewals — it is a mandatory legal obligation. Failure to query creates a presumption of knowledge under § 60.17(b). For each query, document the date, the specific practitioner, and the NPDB response in your credentialing file. The NPDB's Continuous Query service (a subscription product) alerts you automatically when a new report is filed on a currently enrolled practitioner — highly recommended given the 30-day reporting requirement that can create gaps between a practitioner's adverse action and your next biennial query. A hospital that fails to query and later faces a negligent credentialing suit cannot argue ignorance of a practitioner's NPDB history.

If you are a patient researching a health care provider: The NPDB is NOT publicly searchable. Patients cannot directly query the NPDB about their physicians. The NPDB is restricted to credentialing entities and practitioners querying their own records. For public information about physician disciplinary history, check your state medical board's website — most state boards publish license actions. For OIG exclusion status, search the OIG's publicly accessible List of Excluded Individuals/Entities (LEIE) at oig.hhs.gov/exclusions.

Statutory Authority

This rule implements:

• 42 U.S.C. § 11101 (HCQIA § 421) — Congressional findings establishing the NPDB; authorization for HHS to collect and disclose adverse action information; immunity provisions for good-faith participation in professional peer review
• 42 U.S.C. § 1320a-7e (SSA § 1128E) — Healthcare Integrity and Protection Data Bank (HIPDB) authority, now merged with NPDB; expanded reporting to include all fraud and abuse actions, civil judgments, exclusions, and criminal convictions against providers and suppliers
• 42 U.S.C. § 1396r-2 (SSA § 1921) — Expanded NPDB reporting requirements for state agencies, including adverse actions against providers and suppliers in Medicaid

Recent Rulemakings

78 FR 20484 (April 2013) — The most significant NPDB rulemaking in the program's history merged the Healthcare Integrity and Protection Data Bank (HIPDB) into the NPDB, expanded coverage to all health care practitioners (not just physicians and dentists), and added reporting requirements for criminal convictions, civil judgments, exclusions from health care programs, and other adjudicated actions beyond malpractice payments and privilege actions. This rulemaking also added the provision deeming hospitals to have knowledge of any NPDB report they failed to query for.

Pending Action