CMSP cheat sheet

Bylaws, rules/regulations, and policies form a three-tier hierarchy: bylaws require the highest approval threshold (typically two-thirds of voting staff plus governing body), rules/regulations a lower bar, policies often delegated to a committee or MSO.

The medical staff must be self-governing and organized to advise the governing body; ultimate authority for appointment, reappointment, and privilege granting rests with the governing body, not the medical staff.

A medical staff must be organized under a single set of bylaws; the medical executive committee (MEC) is the executive body that acts between staff meetings and reports to the governing body.

Categories of staff membership and their voting/due-process rights must be defined in bylaws; non-voting categories (e.g., affiliate, consulting) must still be credentialed if they provide patient care.

Officer terms, election method, meeting frequency, quorum, and amendment procedures are mandatory bylaw content; Joint Commission requires bylaws to be reviewed at least every 2 years or when standards change.

Conflicts of interest: bylaws must require disclosure and recusal of any practitioner involved in reviewing or voting on his or her own case, including peer review and privileging decisions.

Fair hearing and appeal rights attach to adverse actions that affect appointment, reappointment, or clinical privileges; denial of initial appointment may be handled by a lesser process if bylaws so state.

Emergency or disaster privileges may be granted by the CEO or designee without prior verification, with a defined window (commonly 72 hours) to complete primary source verification.

Primary source verification is required for licensure, DEA registration, board certification, and medical education; the NPDB, OIG exclusion list, and state license board are queried directly or through an approved CVO.

Core credentialing documents: application, attestation, NPDB query, OIG/SAM exclusion screening, malpractice history, peer references, CME, and current clinical competence evidence.

Privileges must be based on documented training, experience, and current competence; privilege delineation should be specific enough to be measurable, not blanket 'full privileges'.

FPPE is required when a practitioner is new to the organization, requests a new privilege, or a concern arises; proctoring or chart review must be time-limited and documented.

Telemedicine privileging may rely on the originating site's credentialing if the distant-site hospital is Joint Commission accredited and the practitioner is privileged there, per CMS requirements.

Locum tenens and temporary privileges are time-limited (often 120 days aggregate) and require a complete application, current license, and NPDB query before care is delivered.

Reappointment cycles are typically every 2 years; the file must show continuous competence, current licensure, and updated malpractice and health status.

Credentialing files must be retained per state and federal law; a common minimum is 10 years after termination, with peer review records protected separately.

FPPE confirms competence at entry and after new privileges; OPPE monitors ongoing performance using objective data such as infection rates, readmissions, mortality, and patient complaints.

OPPE metrics must be defined in advance, measured at least every 6-12 months, and reviewed by the department chair; results feed reappointment and privilege decisions.

Peer review is protected under state peer review statutes and the Health Care Quality Improvement Act (HCQIA) if conducted in good faith with due process and confidentiality.

The HCQIA immunity test: reasonable belief the action was in the furtherance of quality health care, reasonable effort to obtain facts, adequate notice and hearing, and reasonable belief warranted by the facts.

Peer review records should be segregated from the credentialing file and labeled as confidential to preserve privilege; sharing outside the committee can waive protection.

Focused review triggers include sentinel events, high-risk procedures, complaints, and adverse outcomes; the review must be timely (often within 30 days) and documented.

Peer review committees must include a mix of specialties and be free of conflicts; the reviewed practitioner cannot sit on the panel reviewing his or her case.

Peer review findings can lead to corrective action, education, monitoring, or privilege modification; the action must be reported to the NPDB if it adversely affects clinical privileges for more than 30 days.

CMS Conditions of Participation (42 CFR 482) require a governing body, organized medical staff, and a credentialing and privileging process; Joint Commission standards are deemed to meet CMS requirements.

Joint Commission Medical Staff (MS) standards cover organization, bylaws, credentialing, privileging, and peer review; they are surveyed on a triennial cycle with unannounced surveys possible.

NPDB reporting is mandatory for malpractice payments, adverse licensure actions, and adverse clinical privilege actions lasting more than 30 days; failure to report can result in civil money penalties.

OIG exclusion screening must be done at hire and monthly thereafter; billing for services by an excluded provider can result in repayment and CMP liability.

The Health Care Quality Improvement Act (HCQIA) provides immunity for peer review but does not preempt state reporting requirements or state peer review statutes.

HIPAA privacy rules apply to credentialing and peer review records; minimum necessary and authorized access policies must be in place, and breach notification is required for unauthorized disclosure.

State medical board reporting requirements vary; most require reporting of adverse actions, license restrictions, and malpractice payments within a defined window (often 30 days).

Accreditation readiness includes mock surveys, tracer audits, and a document control system that ensures current bylaws and policies are accessible to surveyors.

A culture of safety requires non-punitive reporting, just culture principles, and leadership commitment; the medical staff plays a key role in safety event review.

Root cause analysis (RCA) is required for sentinel events; the analysis must identify system failures and lead to an action plan with measurable outcomes.

Failure mode and effects analysis (FMEA) is proactive; it scores severity, occurrence, and detection to prioritize risk reduction.

The Plan-Do-Study-Act (PDSA) cycle is a common QI framework; improvement projects should have a clear aim, measure, and change theory.

Quality metrics should be evidence-based, benchmarked, and reported to the medical staff and governing body; OPPE data is a core source.

Patient safety organizations (PSOs) provide federal privilege protection for patient safety work product under the Patient Safety and Quality Improvement Act (PSQIA).

Just culture distinguishes human error, at-risk behavior, and reckless behavior; the response should match the behavior, not the outcome.

Handoff communication, medication reconciliation, and surgical safety checklists are high-yield safety interventions with proven impact.

Informed consent requires disclosure of risks, benefits, alternatives, and the patient's right to refuse; the standard is what a reasonable patient would want to know.

Medical malpractice elements: duty, breach, causation, and damages; the plaintiff must prove all four by a preponderance of the evidence.

Statute of limitations varies by state (commonly 2-3 years from injury or discovery); tolling rules may apply for minors or fraudulent concealment.

Peer review privilege protects committee deliberations but not the underlying facts; courts may order production of the credentialing file.

Antitrust risk arises when medical staff decisions unreasonably restrain trade; peer review must be based on objective, documented criteria, not anticompetitive motives.

The HCQIA provides immunity from damages for peer review actions that meet its four conditions; it does not provide immunity from injunctive relief.

Documentation is the best defense: contemporaneous, objective, and complete records; late entries must be clearly labeled and dated.

Employment vs. independent contractor status affects liability; credentialing should confirm malpractice coverage and tail coverage.

The medical staff services office (MSO) manages credentialing, privileging, meeting logistics, and regulatory compliance; it must maintain a secure, auditable credentialing database.

Credentialing software should support primary source verification, expiration tracking, and automated reminders; data must be backed up and access-controlled.

Meeting management includes agenda preparation, minutes, quorum verification, and tracking of action items; minutes are legal documents and must be retained.

Confidentiality agreements and role-based access controls protect peer review and credentialing data; audit trails should log who accessed what and when.

Expirables management (licenses, DEA, board certification, malpractice) requires a tickler system with advance notice (often 90-120 days) to avoid lapses.

The credentialing file should be organized by category (application, verification, privileging, peer review) and indexed for rapid retrieval during surveys or litigation.

Performance dashboards track turnaround time, incomplete applications, and expirables; benchmarks help identify process bottlenecks.

Retention schedules must align with state law, CMS, and accreditation requirements; peer review records are often retained longer than credentialing files.