CMS Conditions for Coverage: What ASCs Must Verify
- 42 CFR 416.45 requires ASCs to have a governing body that grants surgical privileges to practitioners based on documented evidence of training, experience, and current competence. The governing body (or its designee, typically a medical director or credentials committee) must evaluate each practitioner's credentials before granting initial privileges and at least every 2 years at reappointment. CMS surveyors review a sample of credentialing files during certification and recertification surveys.
- Primary source verification (PSV) is the cornerstone of credentialing. CMS and all major accreditors require direct verification from the original issuing source for: medical school graduation, residency/fellowship completion, board certification status, state medical license, DEA registration, malpractice claims history, and National Practitioner Data Bank (NPDB) query. Verification letters, faxes, or electronic confirmations from the original source must be on file. A photocopy of a license provided by the practitioner is not primary source verification.
- The NPDB query is required at initial credentialing and every 2 years at reappointment. The NPDB contains malpractice payment reports, adverse licensure actions, adverse clinical privilege actions, and Medicare/Medicaid exclusion actions. ASCs must have a process for evaluating NPDB findings and documenting the decision to grant or deny privileges based on those findings. Failure to query the NPDB is a frequent CMS deficiency citation.
- CMS does not prescribe a specific privilege delineation format, but surveyors expect procedure-specific privileges (not just broad categories like 'general surgery'). Each practitioner's privilege list should specify the procedures they are authorized to perform at the facility. The governing body must evaluate the practitioner's training and demonstrated competence for each procedure before granting the privilege. Proctoring requirements (supervised cases before independent privileges) should be documented in the credentialing policy.
Accreditation Standards: TJC and AAAHC Specifics
- The Joint Commission (TJC) Medical Staff Standard MS.06.01.01 requires verification of: license to practice, relevant education and training, current competence, health status sufficient to perform privileges, and queries to the NPDB. TJC surveys evaluate whether the organized medical staff (or medical director in ASC settings) applies defined criteria consistently across all practitioners. Inconsistent application (granting privileges to one practitioner without the documentation required of another) is a frequent finding.
- AAAHC (Accreditation Association for Ambulatory Health Care) Chapter 10 (Clinical Records and Health Information) and Chapter 11 (Professional Improvement) require credentialing files to include: a completed application with attestation of no impairment, ability to perform privileges, no loss of licensure, and no malpractice history; verification of education, training, licensure, and board status; NPDB query; malpractice insurance certificate; peer references (at least 2 from practitioners in the same specialty); and a signed delineation of privileges.
- AAAHC requires Ongoing Professional Practice Evaluation (OPPE) between reappointment cycles. OPPE involves periodic review of each practitioner's clinical performance indicators: complication rates, unplanned transfers to hospitals, patient complaints, infection rates, and peer evaluations. The data must be documented and reviewed at least semiannually. Focused Professional Practice Evaluation (FPPE) is required for all newly privileged practitioners and any practitioner whose OPPE reveals performance concerns.
- For office-based surgery (OBS) practices that are not accredited as ASCs, state regulations vary significantly. States including California, Florida, New York, Texas, and Ohio have specific OBS credentialing requirements that may include mandatory accreditation from AAAHC, AAAASF, or TJC for procedures performed under moderate sedation, deep sedation, or general anesthesia. Check your state medical board's OBS regulations. Performing surgery in an unaccredited office setting when accreditation is required can result in license suspension.
Common Credentialing Deficiencies and How to Avoid Them
- Expired verifications: PSV of licenses, DEA registration, board certification, and malpractice insurance must be current at all times. Set automated alerts for expiration dates at 90, 60, and 30 days before expiration. If a practitioner's license expires and is not renewed before the expiration date, privileges must be automatically suspended until the license is reinstated. CMS surveyors check active dates on all verifications against the survey date. A single expired license in the credentialing file can trigger a deficiency.
- Missing NPDB queries: the NPDB Continuous Query enrollment program provides automatic alerts whenever a new report is filed against an enrolled practitioner. The cost is $4 per practitioner per year (NPDB fee schedule, 2024). Continuous Query satisfies the biennial query requirement for TJC and AAAHC and eliminates the risk of a missed 2-year requery. CMS accepts Continuous Query enrollment as meeting the NPDB query requirement.
- Privilege creep: practitioners performing procedures not listed on their approved privilege form. Conduct a quarterly audit comparing OR logs and billing records against each practitioner's privilege delineation. Any procedure performed without a corresponding privilege is an immediate patient safety and liability issue. The fix is retroactive: the governing body reviews the practitioner's qualifications, grants the privilege prospectively, and documents the corrective action.
- Incomplete applications: credentialing applications must include attestation questions about physical and mental health status, substance abuse history, malpractice claims and settlements, loss or restriction of clinical privileges at any institution, and loss or restriction of licensure or DEA registration. Blank or unsigned attestation sections make the file incomplete. Use a credentialing checklist and review each file for completeness before the credentials committee meeting. Return incomplete files to the applicant with specific deficiency notices.
Building an Audit-Ready Credentialing System
- Centralized credentialing software (CredentialStream by HealthStream, Modio Health, IntelliSoft) automates PSV, tracks expiration dates, generates reappointment reminders, and creates audit-ready reports. The cost ranges from $100 to $400 per provider per month depending on the platform and feature set. For practices with more than 5 providers, the time savings and compliance assurance typically justify the cost. Smaller practices can use structured spreadsheets with calendar alerts, but manual systems require disciplined oversight.
- Maintain a credentialing policy and procedure document that specifies: who is responsible for credentialing (credentials coordinator, office manager, medical director), the timeline for processing initial applications (typically 60 to 90 days), the timeline for reappointment (every 2 years), the escalation process for adverse findings, and the appeals process for denied or restricted privileges. CMS and accreditors will ask for this document during surveys. Update it annually and have the governing body sign and date the approval.
- Peer reference letters should come from practitioners who have directly observed the applicant's clinical work within the past 2 years and are in the same or a closely related specialty. Generic reference letters ('I have known Dr. Smith for 10 years and recommend them highly') do not meet accreditation standards. Structured reference forms that ask about specific competencies (clinical judgment, technical skill, communication, professionalism) produce more useful and defensible evaluations.
- Delegate file audits: conduct internal audits of 100% of credentialing files annually, not just at reappointment time. Assign a credentials coordinator or office manager to review 2 to 3 files per week using a standardized checklist. This spreads the workload evenly and catches problems (approaching expirations, missing documents) before they become survey deficiencies. Document each audit with the reviewer's name, date, findings, and corrective actions taken.