How provider, credentialing, and professional information is handled.

This policy applies to information about providers, provider applicants, affiliated providers, collaborating providers, referring providers, contractors, consultants, clinical partners, former provider relationships, and professional organizations whose information may be collected or maintained for provider-related purposes.

This page should be read with the Information Security & Data Protection, Provider Compliance Reporting, Conflict of Interest Policy, Web & Mobile Privacy Policy, and Legal, Privacy & Compliance pages.

Provider-related information may include:

• Name, professional title, contact information, business address, practice location, and communication preferences.
• National Provider Identifier, taxonomy, licensure information, board certification, education, training, continuing education, and professional credentials.
• Employment history, professional references, curriculum vitae, background screening, sanctions checks, exclusions checks, and disciplinary history.
• Credentialing applications, payer enrollment details, malpractice coverage, liability insurance, contracts, affiliations, referrals, and collaboration documentation.
• Quality review, peer review, incident documentation, compliance documentation, policy acknowledgments, and investigation notes when applicable.
• System access, platform activity, email communication, website communication, audit logs, device activity, and security monitoring records related to practice operations.
• Payment, tax, reimbursement, accounting, invoicing, direct deposit, and business relationship information when applicable.

Provider-related information may be used for purposes including:

• Credentialing, recredentialing, licensure verification, professional qualification review, and provider enrollment.
• Care coordination, referrals, provider collaboration, documentation, patient safety, quality improvement, and continuity of care.
• Contracting, billing, payment, accounting, tax reporting, reimbursement, vendor administration, and business operations.
• Compliance monitoring, sanctions screening, audit support, legal review, risk management, dispute resolution, and professional practice requirements.
• Training, policy acknowledgments, system access, account administration, security monitoring, fraud prevention, and technology management.
• Responding to lawful requests, professional board inquiries, payer requests, insurance questions, regulatory matters, or other authorized business needs.

Some provider information may already be available through public or official sources, such as state licensing boards, professional registries, the National Plan and Provider Enumeration System, payer directories, professional directories, public disciplinary records, business records, or public practice websites.

Public provider data may be used to verify licensure, NPI records, practice authority, credentials, professional standing, contact information, and patient-facing provider information. An NPI record does not by itself guarantee that a provider is licensed or credentialed.

Providers are responsible for keeping their own professional licenses, NPI records, registry profiles, payer profiles, professional directories, and required public information accurate and current.

Provider-related information may be shared with authorized internal personnel, credentialing organizations, licensing boards, payers, insurers, legal counsel, accountants, auditors, billing vendors, IT providers, background screening providers, regulators, government agencies, professional partners, and other service providers when appropriate for provider administration, compliance, care coordination, or business operations.

Information may also be disclosed when required or permitted by law, contract, payer requirements, credentialing requirements, court order, subpoena, regulatory request, professional board review, insurance claim, investigation, reporting obligation, safety concern, or legitimate business need.

Wells Legacy Health & Wellness aims to limit provider-related information access to individuals or service providers with an appropriate role, authorization, or need to know.

Wells Legacy Health & Wellness aims to protect provider-related information using reasonable safeguards such as role-based access, confidentiality expectations, secure storage, controlled sharing, password protection, vendor review, record retention practices, and secure disposal when appropriate.

Providers, contractors, and professional partners may be required to follow privacy, security, confidentiality, documentation, device use, system access, patient communication, and compliance expectations.

Suspected unauthorized access, improper disclosure, phishing, security incidents, credentialing concerns, or provider data concerns may be reported through the Provider Compliance Reporting, Compliance and Ethics Hotline, or Responsible Disclosure pages, depending on the issue.

Provider-related information may be retained for as long as needed for credentialing, licensure verification, provider enrollment, contracts, billing, tax, compliance, legal, accounting, safety, audit, insurance, dispute resolution, quality review, security, professional documentation, or other legitimate purposes.

Certain records may need to be retained after a provider relationship, application, referral arrangement, contract, or collaboration ends. Deletion requests may be limited when records must or may be retained for legal, credentialing, payer, professional, safety, compliance, tax, accounting, security, or administrative reasons.

Provider-related records may be securely destroyed, deleted, archived, or anonymized when retention is no longer needed and disposal is appropriate.

Providers, former providers, provider applicants, contractors, collaborators, referring providers, or authorized representatives may contact Wells Legacy Health & Wellness with questions about provider-related information, correction requests, access questions, privacy concerns, credentialing records, security concerns, or suspected improper handling of provider data.

Requests may require identity or authority verification. Wells Legacy Health & Wellness may decline, limit, or delay requests when verification is not possible, when the requester is not authorized, or when records must be retained for legal, credentialing, payer, professional, compliance, safety, tax, accounting, or business purposes.

Concerns about conflicts of interest, provider compliance, privacy, security, or ethics may also be reviewed under the Conflict of Interest Policy, Provider Compliance Reporting, and Compliance and Ethics Hotline pages.

This website, email, contact forms, policy pages, social media, provider reporting pages, and routine communication channels are not for medical emergencies, crisis situations, immediate safety threats, violence, or urgent provider safety concerns.

If you are experiencing a medical emergency, immediate danger, threats of harm, suicidal thoughts, or another urgent safety issue, call 911 or contact appropriate emergency services immediately.

Wells Legacy Health & Wellness may update this Privacy Practices for Provider Information page from time to time. The updated version will be posted on this page with a revised “Last updated” date.

Continued use of the website, online resources, provider systems, provider communication channels, or related digital tools after updates are posted means the updated policy applies going forward.