(a) When information must be requested. Each hospital, either directly or through an authorized agent, must request information from the NPDB concerning a health care practitioner, as follows:

(1) At the time a health care practitioner applies for a position on its medical staff (courtesy or otherwise) or for clinical privileges at the hospital; and

(2) Every 2 years for any health care practitioner who is on its medical staff (courtesy or otherwise) or has clinical privileges at the hospital.

(b) Failure to request information. Any hospital which does not request the information as required in paragraph (a) of this section is presumed to have knowledge of any information reported to the NPDB concerning this health care practitioner.

(c) Reliance on the obtained information. Each hospital may rely upon the information provided by the NPDB to the hospital. A hospital shall not be held liable for this reliance unless the hospital has knowledge that the information provided was false.

(a) Who may request information and what information may be available. Information in the NPDB will be available, upon request, to the persons or entities, or their authorized agents, as described below:

(1) Information reported under §§ 60.7, 60.8, and 60.12 of this part is available to:

(i) A hospital that requests information concerning a health care practitioner who is on its medical staff (courtesy or otherwise) or has clinical privileges at the hospital,

(ii) A health care practitioner who requests information concerning himself or herself,

(iii) A State Medical Board of Examiners or other state authority that licenses health care practitioners,

(iv) A health care entity which has entered or may be entering into an employment or affiliation relationship with a health care practitioner, or to which the health care practitioner has applied for clinical privileges or appointment to the medical staff,

(v) An attorney, or individual representing himself or herself, who has filed a medical malpractice action or claim in a state or Federal court or other adjudicative body against a hospital, and who requests information regarding a specific health care practitioner who is also named in the action or claim. This information will be disclosed only upon the submission of evidence that the hospital failed to request information from the NPDB, as required by § 60.17(a) of this part, and may be used solely with respect to litigation resulting from the action or claim against the hospital,

(vi) A health care entity with respect to professional review activity, and

(vii) A person or entity requesting statistical information, in a form which does not permit the identification of any individual or entity.

(2) Information reported under §§ 60.9, 60.10, 60.11, 60.13, 60.14, 60.15, and 60.16 of this part is available to the agencies, authorities, and officials listed below that request information on licensure or certification actions, any other negative actions or findings, or final adverse actions concerning an individual practitioner, health care entity, provider, or supplier. These agencies, authorities, and officials may obtain data for the purposes of determining the fitness of individuals to provide health care services, protecting the health and safety of individuals receiving health care through programs administered by the requesting agency, and protecting the fiscal integrity of these programs.

(i) Agencies administering (including those providing payment for services) Federal health care programs, including private entities administering such programs under contract,

(ii) State licensing or certification agencies and Federal agencies responsible for the licensing and certification of health care practitioners, providers, or suppliers,

(iii) State agencies administering or supervising the administration of state health care programs (as defined in 42 U.S.C. 1128(h)),

(iv) State law or fraud enforcement agencies,

(v) Law enforcement officials and agencies such as:

(A) United States Attorney General,

(B) United States Chief Postal Inspector,

(C) United States Inspectors General;

(D) United States Attorneys,

(E) United States Comptroller General,

(F) United States Drug Enforcement Administration,

(G) United States Nuclear Regulatory Commission, or

(H) Federal Bureau of Investigation,

(vi) Utilization and quality control peer review organizations described in part B of title XI and to appropriate entities with contracts under section 1154(a)(4)(C) of the Social Security Act with respect to eligible organizations reviewed under the contracts, but only with respect to information provided pursuant to §§ 60.9, 60.10, and 60.11 of this part, as well as information provided pursuant to §§ 60.13, 60.14, 60.15, and 60.16 of this part by Federal agencies and health plans,

(vii) Hospitals and other health care entities (as defined in section 431 of the Health Care Quality Improvement Act of 1986), with respect to health care practitioners who have entered (or may be entering) into employment or affiliation relationships with, or have applied for clinical privileges or appointments to the medical staff of such hospitals or other health care entities, but only with respect to information provided pursuant to §§ 60.9, 60.10, and 60.11, as well as information provided pursuant to §§ 60.13, 60.14, 60.15, and 60.16 by Federal agencies and health plans,

(viii) Health plans,

(ix) A health care practitioner, health care entity, provider, or supplier who requests information concerning himself, herself, or itself, and

(x) A person or entity requesting statistical information, in a form which does not permit the identification of any individual or entity. (For example, researchers may use statistical information to identify the total number of nurses with adverse licensure actions in a specific state. Similarly, researchers may use statistical information to identify the total number of health care entities denied accreditation.)

(b) Procedures for obtaining NPDB information. Persons and entities may obtain information from the NPDB by submitting a request in such form and manner as the Secretary may prescribe. These requests are subject to fees as described in § 60.19 of this part.

(a) Policy on fees. The fees described in this section apply to all requests for information from the NPDB. The amount of such fees will be sufficient to recover the full costs of operating the NPDB. The actual fees will be announced by the Secretary in periodic notices in the Federal Register. However, for purposes of verification and dispute resolution at the time the report is accepted, the NPDB will provide a copy—at the time a report has been submitted, automatically, without a request and free of charge, of the record to the health care practitioner, entity, provider, or supplier who is the subject of the report and to the reporter.

(b) Criteria for determining the fee. The amount of each fee will be determined based on the following criteria:

(1) Direct and indirect personnel costs, including salaries and fringe benefits such as medical insurance and retirement,

(2) Physical overhead, consulting, and other indirect costs (including materials and supplies, utilities, insurance, travel, and rent and depreciation on land, buildings, and equipment),

(3) Agency management and supervisory costs,

(4) Costs of enforcement, research, and establishment of regulations and guidance,

(5) Use of electronic data processing equipment to collect and maintain information—the actual cost of the service, including computer search time, runs and printouts, and

(6) Any other direct or indirect costs related to the provision of services.

(c) Assessing and collecting fees. The Secretary will announce through notice in the Federal Register from time to time the methods of payment of NPDB fees. In determining these methods, the Secretary will consider efficiency, effectiveness, and convenience for the NPDB users and the Department. Methods may include: credit card, electronic fund transfer, and other methods of electronic payment.

(a) Limitations on disclosure. Information reported to the NPDB is considered confidential and shall not be disclosed outside the Department of Health and Human Services, except as specified in §§ 60.17, 60.18, and 60.21 of this part. Persons and entities receiving information from the NPDB, either directly or from another party, must use it solely with respect to the purpose for which it was provided. The Data Bank report may not be disclosed, but nothing in this section will prevent the disclosure of information by a party from its own files used to create such reports where disclosure is otherwise authorized under applicable state or Federal law.

(b) Penalty for violations. Any person who violates paragraph (a) of this section shall be subject to a civil money penalty of up to $11,000 for each violation. This penalty will be imposed pursuant to procedures at 42 CFR part 1003.

(a) Who may dispute the NPDB information. The NPDB will routinely mail or transmit electronically to the subject a copy of the report filed in the NPDB. In addition, as indicated in § 60.18, the subject may also request a copy of such report. The subject of the report or a designated representative may dispute the accuracy of a report concerning himself, herself, or itself as set forth in paragraph (b) of this section.

(b) Procedures for disputing a report with the reporting entity. (1) If the subject disagrees with the reported information, the subject must request in the format as determined by the Secretary that the NPDB enter the report into “disputed status.”

(2) The NPDB will send the report, with a notation that the report has been placed in “disputed status,” to queriers (where identifiable), the reporting entity and the subject of the report.

(3) The subject must attempt to enter into discussion with the reporting entity to resolve the dispute. If the reporting entity revises the information originally submitted to the NPDB, the NPDB will notify the subject and all entities to whom reports have been sent that the original information has been revised. If the reporting entity does not revise the reported information, or does not respond to the subject within 60 days, the subject may request that the Secretary review the report for accuracy. The Secretary will decide whether to correct the report within 30 days of the request. This time frame may be extended for good cause. The subject also may provide a statement to the NPDB, either directly or through a designated representative that will permanently append the report.

(c) Procedures for requesting a review of a disputed report. (1) The subject must request, in the format as determined by the Secretary, that the Secretary review the report for accuracy. The subject must return this request to the NPDB along with appropriate materials that support the subject's position. The Secretary will only review the accuracy of the reported information, and will not consider the merits or appropriateness of the action or the due process that the subject received.

(2) After the review, if the Secretary:

(i) Concludes that the information is accurate and reportable to the NPDB, the Secretary will inform the subject and the NPDB of the determination. The Secretary will include a brief statement (Secretarial Statement) in the report that describes the basis for the decision. The report will be removed from “disputed status.” The NPDB will distribute the corrected report and statement(s) to previous queriers (where identifiable), the reporting entity and the subject of the report.

(ii) Concludes that the information contained in the report is inaccurate, the Secretary will inform the subject of the determination and direct the NPDB or the reporting entity to revise the report. The Secretary will include a brief statement (Secretarial Statement) in the report describing the findings. The NPDB will distribute the corrected report and statement(s) to previous queriers (where identifiable), the reporting entity and the subject of the report.

(iii) Determines that the disputed issues are outside the scope of the Department's review, the Secretary will inform the subject and the NPDB of the determination. The Secretary will include a brief statement (Secretarial Statement) in the report describing the findings. The report will be removed from “disputed status.” The NPDB will distribute the report and the statement(s) to previous queriers (where identifiable), the reporting entity and the subject of the report.

(iv) Determines that the adverse action was not reportable and therefore should be removed from the NPDB, the Secretary will inform the subject and direct the NPDB to void the report. The NPDB will distribute a notice to previous queriers (where identifiable), the reporting entity and the subject of the report that the report has been voided.

Individuals, entities or their authorized agents, and the NPDB shall not be held liable in any civil action filed by the subject of a report unless the individual, entity, or authorized agent submitting the report has actual knowledge of the falsity of the information contained in the report.