What Are Medical Staff Privileges and How Are They Determined?

Medical staff privileges are the formal authorization a hospital gives a practitioner to perform specific procedures and provide specific patient care services inside that facility. They are decided one hospital at a time through a process called credentialing and privileging: the institution independently verifies the practitioner’s training, licensure, and professional history, physician committees review the file, and the hospital’s governing body makes the final call on what the practitioner is allowed to do.

Privileges are not a license, and they are not portable. A surgeon cleared to perform a particular operation at one hospital has no automatic right to do the same at another. Each set of privileges is a customized scope of practice tied to a single institution.

What Privileges Actually Authorize

A practitioner’s privileges spell out which procedures and activities they can perform at that facility. A cardiologist might hold privileges for diagnostic catheterizations at Hospital A but not interventional procedures, while holding both at Hospital B. What ends up on the list depends on the applicant’s documented training, the facility’s resources, and how the medical staff defines its privilege categories.

Many hospitals organize privileges into “core” or “bundled” sets for each specialty. A core bundle lists the procedures considered standard for a board-certified practitioner in that field. Applicants can request the full bundle or ask to have items removed if they don’t intend to perform them. If the hospital’s evaluation finds the applicant isn’t competent in a specific area within the bundle, it modifies the granted privileges accordingly.

Federal Medicare rules require any participating hospital to maintain an organized medical staff operating under bylaws approved by the governing body, and those bylaws must describe the duties and privileges attached to each category of medical staff membership.¹

How Hospitals Decide Who Gets Privileges

Before a hospital grants any privileges, it runs a detailed background investigation to confirm the applicant is who they say they are and that the professional history checks out. That work happens in three stages: source verification, committee review, and governing body approval.

Primary Source Verification

Hospitals verify credentials by going directly to the original issuing body rather than relying on copies the applicant provides. They contact medical schools to confirm graduation, check residency and fellowship completion with training programs, and pull license status directly from state licensing boards. For physicians, verification sources include the AMA Physician Masterfile, the AOA Physician Profiles, and the Educational Commission for Foreign Medical Graduates for international graduates. Nurse practitioners, physician assistants, and certified nurse-midwives have their own national certifying bodies that hospitals query directly.²

Board certification, current licensure, and DEA registration (for practitioners who prescribe controlled substances) all get verified at the source. A practitioner who prescribes scheduled drugs must hold both a valid state license and a federal DEA registration, with the state license serving as a prerequisite for the DEA registration.³

Hospitals also collect professional references from peers and supervisors who can speak to the applicant’s clinical judgment, technical skill, and conduct. Many require documentation of physical and mental fitness for duty.

The National Practitioner Data Bank Query

Every credentialing process includes a query to the National Practitioner Data Bank, a confidential federal repository of malpractice payment reports and adverse professional actions. The NPDB exists specifically to prevent practitioners with serious disciplinary histories from quietly moving to a new facility and starting over. Hospitals must query it whenever a practitioner applies for appointment or privileges, and again every two years for everyone already on staff.⁴ The database covers all healthcare practitioners licensed or authorized to provide care in the United States, not just physicians.²

Committee Review and Final Approval

Once credentialing staff compile and verify the file, it moves through layers of physician-led review. A credentials committee examines the application first, comparing the applicant’s qualifications against the hospital’s criteria for the requested privileges. That committee forwards its recommendation to a medical executive committee, which conducts its own evaluation.

The final authority to grant, deny, or limit privileges belongs to the hospital’s governing body, typically the board of directors or trustees. Federal Medicare regulations place this responsibility squarely on the governing body, which acts on the medical staff’s recommendations but isn’t bound to rubber-stamp them.¹ The applicant receives written notification of the decision.

Categories of Medical Staff Membership

Most hospitals create several tiers of medical staff membership, each carrying different privileges and obligations. Federal regulations require the bylaws to spell out the duties and privileges of each category.¹ Names and rules vary by institution, but the common categories include:

Active staff. Practitioners who admit and treat patients regularly at the facility. They carry the heaviest committee and on-call obligations and usually have full voting rights in medical staff governance.
Courtesy staff. Practitioners who use the facility occasionally, often because their primary practice is elsewhere. They hold limited privileges and lighter committee duties.
Provisional staff. Newly appointed practitioners serving a probationary period, usually under closer monitoring before advancing to full active status.
Consulting staff. Specialists called in for consultations who don’t independently admit patients.

The category a practitioner falls into shapes not only clinical work but voting rights, committee assignments, and on-call requirements.

Privileges Are Not Permanent

Granting privileges is not a one-time event. Hospitals continuously evaluate whether each practitioner’s performance justifies continued authorization.

Ongoing and Focused Practice Evaluation

Ongoing Professional Practice Evaluation (OPPE) provides a steady stream of data on every privileged practitioner, typically compiled at least every six months. Data points vary by specialty but commonly include complication rates, readmission rates, mortality compared to expected benchmarks, length of stay patterns, patient complaints, and compliance with evidence-based care standards.

When something in the OPPE data raises a red flag, or when a practitioner receives new or expanded privileges, the hospital triggers a Focused Professional Practice Evaluation (FPPE). This is a time-limited, intensified review that might include chart audits, direct observation, or proctoring by another credentialed practitioner. New appointees almost always go through FPPE during their provisional period.

Reappointment

Privileges expire and must be renewed. The Joint Commission, which accredits most U.S. hospitals, requires reappointment and re-privileging no later than every three years.⁵ Federal law independently requires hospitals to query the NPDB on every medical staff member at least every two years, regardless of the reappointment cycle length, so even hospitals on a three-year cycle must run NPDB checks more frequently.⁴

Reappointment involves an updated review of clinical performance data, continuing education, malpractice history, licensure status, and any changes in health or professional standing. Hospitals regularly modify, reduce, or decline to renew privileges based on what the reappointment review reveals.

Faster Pathways: Telehealth, Temporary, and Disaster Privileges

Standard credentialing takes weeks or months. Federal rules recognize three faster pathways for situations that can’t wait.

Under “privileging by proxy,” a hospital receiving telehealth services can rely on the credentialing and privileging decisions already made by the distant-site hospital, rather than independently credentialing every remote practitioner. Several conditions apply: the distant-site hospital must participate in Medicare, the telehealth practitioner must already hold privileges there, the practitioner must hold a license recognized in the patient’s state, and the receiving hospital must feed its performance data (including adverse events and patient complaints) back to the distant site for use in periodic evaluations.¹

Temporary privileges let a hospital quickly bring in practitioners when patient volume exceeds what current staff can handle. The facility must still verify the practitioner’s current license and competence, query the NPDB, and have a designated medical staff leader recommend the appointment. The credentialing file doesn’t need to be complete before care begins, but the hospital must have a protocol for overseeing temporary appointees.

Disaster privileges go further. When a hospital activates its emergency management plan during a declared disaster, it can grant privileges based on minimal verification: a current hospital ID card, a valid state license with photo identification, credentials showing membership in a Disaster Medical Assistance Team, or attestation from a current staff member who personally knows the practitioner. Once the emergency stabilizes, the hospital begins standard credentials verification for anyone who received disaster privileges.

Due Process if Privileges Are Denied, Reduced, or Revoked

A practitioner facing denial, reduction, or revocation of clinical privileges has procedural protections under the Health Care Quality Improvement Act of 1986. These matter because losing privileges at one hospital can cascade across a career through mandatory NPDB reporting.

Before a hospital takes an adverse action against a physician’s privileges, it must send written notice describing the proposed action and the reasons, informing the physician of the right to request a hearing, and giving at least 30 days to make that request. If the physician requests a hearing, the hospital must schedule it at least 30 days after sending the hearing notice, along with a list of expected witnesses.⁶

At the hearing, the physician has the right to be represented by an attorney, to call and cross-examine witnesses, to present relevant evidence, and to have the proceedings recorded. The hearing must take place before an impartial body: a mutually agreed-upon arbitrator, a hearing officer not in economic competition with the physician, or an appointed panel of individuals without competing financial interests.⁶

Any professional review action that restricts, suspends, revokes, or denies a physician’s or dentist’s clinical privileges for more than 30 days must be reported to the NPDB. A summary suspension that stays in effect for more than 30 days triggers the same requirement, even if the final decision hasn’t been reached. Hospitals must also report when a practitioner surrenders clinical privileges while under investigation for possible incompetence or professional misconduct, or surrenders them to avoid such an investigation. The practitioner doesn’t need to know an investigation is underway for the reporting obligation to apply.⁷

One nuance worth knowing: withdrawing an initial application before a final decision generally does not trigger an NPDB report, but withdrawing a renewal application while under investigation does.⁷ An NPDB report follows a practitioner permanently and will surface every time another hospital queries the database during credentialing, which is why the hearing process should be taken seriously rather than waived.

1
eCFR. 42 CFR 482.22 – Condition of Participation: Medical Staff
2
Health Resources & Services Administration (Bureau of Primary Health Care). Health Center Program Site Visit Protocol: Examples of Credentialing and Privileging Documentation
3
Department of Justice, Drug Enforcement Administration. Practitioner’s Manual
4
National Practitioner Data Bank (NPDB). April 2023 Insights
5
The Joint Commission. Reappointment and Re-privileging – Dates
6
Office of the Law Revision Counsel. 42 USC 11112 – Standards for Professional Review Actions
7
National Practitioner Data Bank (NPDB). Reporting Adverse Clinical Privileges Actions