The purpose of the presentation is to share how Stanford University’s Internal Audit (IA) conducted an audit of physician credentialing and privileging in our complex/vast hospital structures and clinical-based physician groups.

Stanford University’s IA conducts financial, operational, and information technology audits to provide optimal audit coverage to the University (including the School of Medicine), Hospitals (including Stanford Health Care, Stanford Medicine Children’s Health, Stanford Health Care Tri-Valley), and clinical-based physician groups (Stanford Medicine Partners and Packard Children’s Health Alliance). Stanford University is a large enterprise and we have different IA teams that are cross-functionally trained to support the University, Medicine/Healthcare, and our National Accelerator Laboratory.

Physician credentialing is the process of obtaining, verifying, and assessing a practitioner’s qualifications to provide care or services. Physicians must obtain clinical privileges to provide patient care, treatment, and services. After obtaining our Audit Committee’s approval for the audit, we began our efforts in pre-planning the audit to include background research. Since the Stanford Health Care organization is complex, we found that research assisted in understanding who the stakeholders were and which departments to coordinate with. As part of the audit planning, Stanford IA obtained an understanding of potential risks/vulnerabilities and possible areas for fraud and developed a risk control matrix that captures business risks and expected controls to mitigate business risk. The Stanford Health Care system has over 2,300 medical staff that require credentialing (and subject to periodic re-credentialing), therefore appropriate audit scoping was vital and scope exclusion need to be defined and communicated effectively to our stakeholders. After determining the objective, scope, and scope exclusions, Stanford IA coordinated with our Office of General Counsel (OGC) partners and leadership - such as each hospital/clinical physician group’s Chief Medical Officer to obtain their input and concerns.

We obtained relevant policies and procedures and evaluated the effectiveness of the credentialing/privileging requirements of our hospital system. Further, Stanford IA reviewed expected controls and tailored interview questions for staff based on expected controls to determine if the design of that control was adequate. After obtaining an understanding of the processes, Stanford IA designed fieldwork. To design the fieldwork, we obtained information that was within the audit scope and selected a representative sample of physicians to include in audit testing. We identified what are the key components of physician credentialing including verification of education, training, licenses, certifications, background checks, and attestations. Also, we identified what information is required to substantiate physician privileges. We designed fieldwork to assess the adequacy and completeness of the required information. The audit team ensured that documentation was validated and checked against the source of truth.

Through the course of fieldwork, we identified any areas for improvement in the credentialing/privileging process or any instances where explanations were required for missing credentialing/privileging documentation. After communicating the results of fieldwork, Stanford IA coordinated with their OGC partners and stakeholders, drafted a report and proceeded to schedule exit conferences. Overall, if audit findings are identified, obtain management consensus and their proposed plans for risk mitigation or risk acceptance and a time frame for estimated completion, if applicable.