Who should have access to credentialing files and how is access controlled?

• A. Public access for all hospital staff
• B. Authorized personnel (MSSD staff, MEC) with role-based access and strict confidentiality
• C. Only the CEO can view credentialing files
• D. Credentialing files are public records

Answer: (B)

Access to credentialing files must be strictly limited to individuals who have a legitimate need to know as part of the credentialing and privileging process. The people typically authorized are the Medical Staff Services Department staff and members of the Medical Executive Committee, and access should be governed by role-based controls so each user can see only what is necessary for their duties. This protects highly sensitive information found in credentialing records—licensure details, education, work history, background checks, malpractice history, and other identifiers—while supporting compliance with privacy laws and professional standards.

Key elements include formal confidentiality practices, ongoing training on handling sensitive information, and robust technical and physical safeguards. Electronic systems should use secure logins, and ideally multi-factor authentication, with audit logs to track who accesses what data. Paper files, if any, require secure storage and controlled access. Access should be reviewed regularly and updated promptly when roles change or employment ends. Public access or exclusive access by a single executive would compromise privacy and security, so those options are not appropriate.