National Practitioner Data Bank: Reporting, Access, and Penalties

The National Practitioner Data Bank is a confidential federal repository that tracks medical malpractice payments, disciplinary actions, and other adverse events tied to healthcare practitioners, providers, and suppliers. It is not open to the public. Only entities authorized by federal law can submit reports or query the system, and the information it holds is protected by strict confidentiality rules.¹

What Gets Reported

The Data Bank collects several distinct categories of adverse information, each with its own trigger.

Medical Malpractice Payments

Every payment made on behalf of a practitioner in response to a written malpractice claim must be reported, whether it came from a court judgment or a settlement. The dollar amount does not matter. A $500 nuisance settlement triggers the same obligation as a multimillion-dollar verdict. The report identifies the practitioner, the payment amount, any affiliated hospital, and a description of the acts and injuries involved.²

Clinical Privilege Actions

Hospitals and other healthcare entities must report any professional review action that restricts or revokes a practitioner’s clinical privileges for more than 30 days. The rule also covers two situations where the practitioner technically leaves voluntarily: surrendering privileges while under investigation for possible incompetence or misconduct, or giving up privileges in exchange for the entity agreeing not to open an investigation.³ A quiet resignation to avoid scrutiny still triggers a report.

Licensing and Certification Actions

State boards report disciplinary actions that limit a practitioner’s license, including revocations, suspensions, reprimands, censures, and probationary restrictions. The action must affect the practitioner’s authorization to practice within the board’s jurisdiction.

Healthcare-Related Criminal Convictions

Federal and state prosecutors report healthcare-related criminal convictions against practitioners, providers, or suppliers. The definition of “conviction” is deliberately broad. It includes guilty pleas, no-contest pleas, guilty verdicts regardless of pending appeal, and even participation in first-offender or deferred adjudication programs where a formal conviction was withheld.⁴ The conviction must relate to the delivery of healthcare items or services; an unrelated DUI would not be reportable.

Civil Judgments

Federal and state attorneys and health plans report civil judgments related to healthcare delivery entered against a practitioner, provider, or supplier. Settlements with no finding or admission of liability are not reportable as civil judgments, and malpractice payments are reported under their own category rather than double-reported here.⁵

Exclusions From Federal Healthcare Programs

Federal and state agencies report exclusions from programs like Medicare and Medicaid. These typically stem from fraud, patient abuse, or licensing-related problems, and they directly affect the practitioner’s ability to bill government payers.

Who Must File and When

The deadline is uniform: every report must be submitted within 30 days of the action being taken, whether it is a malpractice payment, a clinical privilege action, a board decision, a conviction, a civil judgment, or an exclusion.⁶

Reporting obligations come from three overlapping statutes: Title IV of the Health Care Quality Improvement Act, Section 1921 of the Social Security Act, and Section 1128E of the Social Security Act.¹ Together they capture medical malpractice payers (insurers, self-insured entities, or any organization that pays to settle or satisfy a malpractice claim, regardless of amount); hospitals and other healthcare entities that conduct formal peer review; state licensing and certification boards; professional societies that take adverse action after formal peer review; health plans; and federal and state government agencies.⁷ The regulatory definition of a “health care entity” reaches beyond traditional hospitals to Federally Qualified Health Centers, group practices, HMOs, and similar organizations that conduct formal peer review.⁶

Reports are submitted electronically through the NPDB’s secure portal. The reporting entity provides the practitioner’s identifying information, including full legal name, date of birth, and Social Security Number, along with a description of the events and the legal or institutional basis for the action. Accurate identifiers matter: the NPDB uses them to match reports across queries, so a mistake can flag the wrong practitioner or let a problematic one slip through.

Who Can Access the Data

The NPDB is emphatically not a public database. Patients cannot look up their doctors, journalists cannot search it for patterns, and attorneys have almost no path to the information. Access is restricted to eligible entities with a specific, authorized reason to query.

Hospitals occupy a unique position. They are the only healthcare entities that federal law requires to query. A hospital must check the database whenever a physician, dentist, or other practitioner applies for medical staff appointment or clinical privileges, including temporary privileges, and must run a follow-up query every two years for every practitioner who holds active privileges.⁸

Other healthcare entities, state licensing boards, professional societies, and health plans may query the NPDB but are not federally mandated to do so. Health plans have optional query access, though they are required to report certain actions.⁷ Licensing boards routinely query as part of application review, even though their access is framed as permissive rather than mandatory.

Individual practitioners can run a self-query to see what their file contains. This is the only way to find out whether reports exist and whether they are accurate.⁹ For anyone who has been involved in a malpractice payment or a credentialing issue, a periodic self-query before applying for new privileges is worth doing rather than being caught off guard when the hiring entity pulls the record.

The Narrow Attorney Exception

There is one narrow exception to the rule that attorneys cannot access the NPDB. A plaintiff’s attorney, or a plaintiff acting without an attorney, can obtain NPDB information only if all of the following are true: a malpractice action has been filed against a hospital, the practitioner is named in that action, and discovery shows the hospital failed to query the NPDB as required. Even then, the information can be used only against the hospital for its failure to query, not against the practitioner. Misuse subjects the attorney or plaintiff to civil money penalties.¹⁰

Query Methods and Fees

Authorized entities can query in two ways. A One-Time Query is a single check of a practitioner’s record at a specific moment and costs $2.50. A Continuous Query enrolls a practitioner for 12 months and sends automatic alerts whenever a new report is filed; the annual enrollment fee is also $2.50 per practitioner.¹¹

For individual practitioners, a self-query costs $3.00 for a digitally certified response, with an additional $13.00 for a mailed paper copy if requested at the time of submission.⁹

Continuous Query has become the practical choice for larger organizations. Instead of running individual checks every two years, a hospital can enroll its entire active staff and receive real-time notifications, and the enrollment automatically satisfies the two-year re-query obligation.

Penalties for Failing to Report or Breaching Confidentiality

An entity that fails to report a medical malpractice payment faces a civil money penalty of up to $28,619 per violation, a figure adjusted periodically for inflation.¹² For hospitals and other healthcare entities, the stakes go further. If the Secretary of Health and Human Services determines that an entity has substantially failed to report adverse clinical privilege actions, the Secretary publishes the entity’s name in the Federal Register, and the entity then loses its HCQIA immunity from damages for professional review actions for three years.² That immunity shields hospitals from suits by practitioners who claim they were unfairly subjected to peer review, and losing it exposes the entity to litigation every time it restricts someone’s privileges. Before the penalty is imposed, the Secretary must investigate, provide notice, allow an opportunity to correct, and offer a hearing.

Confidentiality carries its own penalty structure. NPDB information cannot be disclosed outside authorized channels, is not available through Freedom of Information Act requests, and can be used only for activities that further the quality of healthcare.¹³ Anyone who violates these rules faces a civil money penalty of up to $10,000 per violation. Entities involved in a shared investigation or peer review may share NPDB information with others in that same process, provided everyone remains bound by the confidentiality rules.¹⁴

Disputing an Inaccurate Report

A practitioner who finds an error in their file has a formal dispute process, and using it promptly matters because every future employer and licensing board that queries the system will see the entry.

The first step is asking the NPDB to place the report in “disputed status.” That flag is visible to anyone who queries the record. The practitioner then contacts the reporting entity directly to try to resolve the disagreement. If the entity agrees an error was made, it can revise or void the report itself, which is the fastest resolution.¹⁵

If the reporting entity refuses to revise or does not respond within 60 days, the practitioner can escalate to the Secretary of Health and Human Services with supporting materials. The Secretary’s review is limited strictly to the accuracy of the reported facts. It does not evaluate whether the underlying action was fair, whether the practitioner received adequate due process, or whether the discipline was proportionate. The only question is whether the report accurately reflects what happened.¹⁵

The Secretary must issue a decision within 30 days, though the deadline can be extended for good cause. If the report is inaccurate, the NPDB or the reporting entity is directed to correct it. If the action was not reportable at all, the report is voided. If the report is accurate, the disputed status is removed and the report stands.

Whatever the outcome, a practitioner can always attach a subject statement of up to 4,000 characters to any report. The statement does not alter the report, but it becomes a permanent part of the record and is included in every future query response. The NPDB redacts personally identifiable information from subject statements, so practitioners should refer to individuals by role rather than by name.¹⁶

1
National Practitioner Data Bank. NPDB Guidebook – Preface
2
Social Security Administration. Health Care Quality Improvement Act of 1986
3
National Practitioner Data Bank. NPDB Guidebook – Reporting Adverse Clinical Privileges Actions
4
National Practitioner Data Bank. Reporting Federal or State Health Care-Related Criminal Convictions
5
National Practitioner Data Bank. Reporting Health Care-Related Civil Judgments
6
eCFR. 45 CFR Part 60 – National Practitioner Data Bank
7
National Practitioner Data Bank. Who Can Query and Report to the NPDB
8
National Practitioner Data Bank. Hospitals
9
National Practitioner Data Bank. Self-Query Basics
10
National Practitioner Data Bank. NPDB Guidebook, Chapter D – Queries, Overview
11
National Practitioner Data Bank. Billing and Fees
12
National Practitioner Data Bank. Civil Money Penalties
13
Office of the Law Revision Counsel. 42 USC 11137 – Miscellaneous Provisions
14
National Practitioner Data Bank. Confidentiality
15
eCFR. 45 CFR 60.21 – How to Dispute the Accuracy of National Practitioner Data Bank Information
16
National Practitioner Data Bank. How to Submit a Statement