External peer review for hospital risk teams

By Ahmed Jemaa, Co-Founder and CEO of Medrecords AI. Updated 2026-11-15.

Limits: Prices, turnarounds and claims come from each provider's own pages or the cited survey and statute, read 2026-11-14. We bought no review from anyone listed and cannot vouch for the quality of any reviewer, and nothing here is legal advice on who may testify in your state.

4 cases where in-house peer review cannot work

A reviewer has a conflict. The reviewer shares an office, a call group or a partner with the practitioner, competes for the same referrals, or chairs the department that will act. In a small hospital the conflict is arithmetic: if the specialty has 2 members and 1 is the subject, there is no unconflicted peer.

The specialty is missing. No one on staff performs the procedure: pediatric cardiac surgery, complex skull base work, a device the hospital does not implant. Naming the nearest specialty is worse, because a reviewer outside it invites a qualification challenge at the hearing.

The case is already in litigation. Once a claim is filed, defense counsel usually retains the expert, which is how the analysis stays inside attorney work product. The peer review and the litigation review run as 2 tracks, and merging them is how a peer review file ends up produced in discovery.

The committee needs an outside opinion. A tie, a recusal chain that leaves no qualified quorum, or a committee reviewing its own earlier decision. Add the case where the practitioner also holds privileges at the only other hospital in the county: outside has to mean outside that market.

What HCQIA protection depends on

42 USC 11112(a) lists 4 conditions. The action must be taken in the reasonable belief that it furthered quality health care, after a reasonable effort to obtain the facts, after adequate notice and hearing procedures (or other procedures fair to the physician), and in the reasonable belief that it was warranted by the facts known after that effort. The action is presumed to meet those standards unless a plaintiff rebuts it by a preponderance of the evidence (42 USC 11112, read 2026-11-14).

An external review feeds element 2, the effort to obtain the facts, and the factual basis for element 4. It does nothing for elements 1 and 3: the quality purpose is the body's to establish, and the notice and hearing procedure is the body's to run.

Adequate notice and hearing has a defined shape. The notice states the action, its reasons, the right to request a hearing, the time limit (not less than 30 days), and a summary of hearing rights. The hearing is set not less than 30 days after the notice, before an arbitrator, hearing officer or panel with no direct economic competitor of the physician. The physician may have counsel, a record, witnesses and a written statement, then gets the decision with reasons (42 USC 11112(b), read 2026-11-14).

Be careful with the 90-day figure. Some summaries say the practitioner has 90 days to request a hearing. That number is not in this section: the floor is 30 days, and 90 comes from bylaws or state law if it applies at all. The safe harbors in subsection (c) are procedural: none are required where there is no adverse action, or for a suspension of 14 days or less during an investigation. This is a summary, and counsel should read 42 USC 11111 and 11112 before the notice goes out.

Credentialing evidence under 42 CFR 482.22

The Medicare condition requires an organized medical staff under bylaws the governing body approves, responsible for the quality of care. The staff must periodically appraise its members and examine credentials before recommending appointments, and the bylaws must set criteria for privileges and how they are applied (42 CFR 482.22, read 2026-11-14).

The rule text does not use the words OPPE or FPPE. Those are the medical staff's own mechanisms in the bylaws, and they are where the periodic appraisal in 482.22(a)(1) happens. OPPE looks at performance across a period; FPPE is focused, triggered by a new privilege or a concern.

An external review supplies 3 things for that file: a specialty-matched read of a defined set of cases, a case-level judgment on departures, and a documented list of missing records. It cannot supply the OPPE numbers, because rates and trends come from your own data, not from a reviewer reading 1 case. It cannot supply your committee's chart sample, the monitoring an FPPE needs, or the decision that a privilege should be restricted. That decision belongs to the body, and a report should not read as if the reviewer made it.

What to send, and what to leave out

Send a packet a stranger could work from:

• The complete record for the date range, every source, with an index, page count and 1 pagination scheme. If partial, say what is missing before the reviewer finds it.
• The questions, numbered, in the committee's words. "Was care appropriate" does not produce an answer a committee can act on.
• The standard in force on the date of care, with edition or policy numbers.
• Any prior review and its conclusion.
• Privileges and context: what the practitioner may do here, the department, call status.
• The deadline and the person who can answer record questions.

Leave out what creates a problem without helping. Redact other patients and non-parties. Keep the incident investigation, root cause analysis and safety huddle notes out of the clinical packet, and do not co-mingle them in 1 PDF with the chart: a combined file is hard to un-combine later. Leave out billing and HR files, and the committee's preferred conclusion, its votes and any draft action.

Privilege and confidentiality, a question for counsel

Peer review privilege is state law and it varies. Some states protect the proceedings, some the documents, some both. Federal protection under the Patient Safety and Quality Improvement Act depends on a patient safety evaluation system and a written contract with a listed patient safety organization (42 USC 299b-21 and 299b-22, read 2026-11-14). The medical record is expressly excluded from patient safety work product, so calling the chart safety work does not make it confidential.

Sending records to an outside reviewer can waive a protection if it is done without counsel, and a contract that says "confidential" does not create privilege. Before the packet leaves, counsel should answer 3 questions: which protection applies, who retains the reviewer, and how the report comes back. Nothing here is legal advice.

The 4 routes a hospital uses, and what the board gets

A sequence that fits a 90-day cycle:

1. Days 0 to 10: scope, conflict screen, packet assembly, record request and redaction.
2. Days 10 to 20: the reviewer returns a missing-records list; the hospital answers it.
3. Days 20 to 45: clinical review: chronology, the standard in force, then 1 row per decision point.
4. Day 45: draft opinion; the hospital checks the facts, not the conclusion.
5. Days 45 to 60: final report.
6. Days 60 to 90: committee action, notice, the 30-day request window, the hearing at least 30 days after the notice, then the written decision.

Those are planning intervals, not medians. The fixed numbers are the notice and hearing windows in 42 USC 11112(b). Indiana adds a statutory outer limit of 180 days from the last panelist's selection (IC 34-18-10-13, read 2026-11-14).

For the committee to use the report it needs 6 things:

1. The questions as asked, restated in the committee's words.
2. The records reviewed, with date ranges and page count, and the records requested but not received.
3. The standard applied, with its source and the edition in force on the date of care.
4. Each finding with the page behind it, in a grid the committee can read without the reviewer.
5. Causation as a separate finding, with the limits of the opinion stated.
6. What would change the opinion, plus the reviewer's qualifications, signature and date.

The 9-step process page is the reviewer's checklist, the who reviews page covers which route can sign what, and the directory lists the outside options with their published terms.