Report: Hack of DOT's medical examiner registry has limited oversight, created potential for fraud

user-gravatar

The seven-month outage of the Federal Motor Carrier Safety Administration’s National Registry of Certified Medical Examiners in late 2017 and half of 2018 has limited the agency's ability to properly oversee its medical certificate program due to missing driver records and outdated medical examiner credentials, according to the U.S. DOT’s Office of Inspector General, who this month released the results of an audit of the program.

Without proper oversight, OIG says FMCSA could be missing medical certificate fraud indicators or other risks, and has less assurance that drivers are physically qualified to drive a commercial vehicle.

"Without fully implementing its requirements for monitoring medical examiner eligibility and performance, including a representative sample of driver examinations, FMCSA may be missing fraud indicators or other risks that may require mitigation," OIG says.

The agency is still working to rebuild the registry after it was hit with a malware attack in 2017. The goals of the audit, OIG said, were to analyze FMCSA’s procedures for overseeing its medical certificate program, specifically for validating and maintaining data quality in the registry and monitoring medical examiner eligibility and performance and reviewing driver exams. OIG initiated the audit in 2019.

Before the seven-month outage, FMCSA required medical examiners to submit driver exam results to the registry once every month. However, during the outage, the agency instructed examiners to hold their results until functionality to the database was restored. The lengthy outage resulted in a backlog of approximately 780,000 driver examination results that were not entered into the registry.

The audit notes that FMCSA is in the process of rebuilding the registry, but it’s unclear when it will be complete, putting the agency’s June 2021 compliance date for the Medical Examiner’s Certification Integration final rule in jeopardy.

FMCSA says it plans to award a contract to rebuild the registry in the second quarter of fiscal year 2021. When the rebuilt registry is complete, OIG says FMCSA plans to publish a Federal Register notice requiring medical examiners upload backlogged exams with a due date. Until then, OIG adds, the information missing from the registry "limits FMCSA’s ability to ensure that driver medical information is valid, complete and accurate."

While there is a backlog of medical exam results yet to be uploaded into the registry, drivers who received their medical certificate whose exams were not uploaded to the database are still in the clear. States are still using hard copy medical certificates from drivers to issue or renew CDLs and update driver records, and the requirement for medical examiners to upload exam results to the database is part of a transition period until the registry is complete. Once the registry is rebuilt and fully functional, medical examiners will submit drivers' exam results to the registry, FMCSA will transmit them electronically to states, and states will then use the information in the database, in lieu of hard copy medical certificates, to issue or renew CDLs and update driver records.

In addition to the missing records, OIG's audit also found weaknesses in the accuracy and completeness of data in the registry. As of May 2019, 46% of the registry’s 70,208 records of certified medical examiners had outdated medical license information, according to OIG’s analysis. Additionally, an OIG review of two separate samples totaling 452 driver exams from three states found that 21% were not recorded in the registry. 

"The National Registry data quality issues occurred in part because of data availability and monitoring limitations resulting from the outage in December 2017," OIG says. "Without quality data, FMCSA cannot effectively ensure that drivers meet physical qualification standards to operate a commercial vehicle safely."

OIG says that while FMCSA has conducted initial certification reviews of medical examiners’ eligibility qualifications since establishing the registry, the agency has not fully implemented a requirement to conduct annual eligibility audits after initial certification. The audit also found that FMCSA had only conducted 12 random performance reviews of medical examiners in 2015 and 2016 before the outage, which is also a requirement for the registry.

OIG did find, however, that FMCSA has analyzed data from the registry to find trends, such as pass/fail rates for drivers and to detect examiners who conduct an excessively large number of exams.

“According to FMCSA, the agency has not fully met its requirements for conducting medical examiner eligibility and performance monitoring reviews because it has limited staff to carry out a sustained process to analyze data and conduct these reviews,” OIG’s report says. “Without these oversight reviews, FMCSA may be missing fraud indicators or other risks that may require mitigation and has less assurance that drivers are physically qualified to safely operate a commercial vehicle.”

In order to improve FMCSA’s oversight of its medical certificate program, OIG recommends the agency do the following:

  1. Implement plans for eliminating the backlog of driver exam results held by medical examiners
  2. Develop a plan to allocate resources to the Medical Programs Division to fully implement requirements for medical examiner eligibility audits and random selection performance monitoring
  3. Update procedures for conducting periodic medical examiner eligibility audits and random selection performance monitoring as needed to incorporate upgraded National Registry tools
  4. Reinstate the conduct of eligibility audits and random selection performance monitoring of medical examiners

FMCSA agreed with the four recommendations after reviewing the report and proposed actions and compliance dates for completing the recommendations. The agency says it will address the first recommendation by March 31, 2021; the second by Jan. 31, 2022; and the third and fourth recommendations by June 30, 2023.