---

Back to Patient Safety Organizations Home

Patient Safety and Quality Improvement. Final Rule (Continued)

Given the strong support for our flexible and scalable framework, we have not adopted recommendations of two commenters to substitute the HIPAA Security Rule for these provisions. We would expect that PSOs that are familiar with, and have existing rules that implement, the HIPAA Security Rule will incorporate those standards as appropriate, when they develop their written policies and procedures to implement security for the patient safety work product they receive, access and handle. The security framework presented here does not impose any limitations on the ability of PSOs to incorporate or address additional security requirements or issues as the PSO determines to be appropriate. The flexible approach we have adopted should minimize the potential for conflict with the requirements of other programs. By taking advantage of this flexibility, and ensuring that its security requirements also address the requirements of the HIPAA Security Rule, a PSO should be able to meet its obligations as a business associate of any provider that is also a "covered entity" under HIPAA regulations.

4. Section 3.108—Correction of Deficiencies, Revocation and Voluntary Relinquishment

Section 3.108 establishes the processes and procedures related to correction of deficiencies, revocation, and voluntary relinquishment. Section 3.108(a) establishes the processes and procedures for correction of deficiencies by PSOs and, when deficiencies have not been timely corrected, the process leading to a decision by the Secretary to revoke his acceptance of the entity's certification and delist a PSO. Section 3.108(b) sets forth the actions that the Secretary and a PSO must take following a decision by the Secretary to revoke his acceptance of the entity's certification and delist the entity. Section 3.108(c) establishes the process by which an entity can voluntarily relinquish its status as a PSO. Section 3.108(d) requires publication of notices in the Federal Register whenever an entity is being removed from listing. New § 3.108(e) establishes an expedited process for revoking the Secretary's acceptance of the entity's certification under certain circumstances.

(A) Section 3.108(a)—Process for Correction of a Deficiency and Revocation

Proposed Rule: Section 3.108(a) listed in paragraph (a)(1) the circumstances that could lead to revocation and delisting and the remaining subsections set forth our proposed process for correction by a PSO of a deficiency identified by the Secretary and, if the deficiencies are not timely corrected or cannot be "cured," the process that could lead to the revocation and delisting. We review the entirety of § 3.108(a) here.

Once the Secretary believes that a PSO is deficient in meeting its requirements, proposed § 3.108(a)(2) outlined the processes he would follow. First, the Secretary would send a written notice of a preliminary finding of deficiency; the contents of the deficiency notice are specified in the rule. Following receipt of the notice, a PSO would have 14 days to correct the record by submitting evidence that the information on which the preliminary finding had been based was factually incorrect. The Secretary could then withdraw the notice or require the PSO to proceed with correction. The preamble sought comment on whether there should be an expedited revocation process when deficiencies are not, or cannot, be cured. Public comment and the provisions of the final rule are discussed below in new subsection (e), expedited revocation.

Following the correction period, proposed § 3.108(a)(3) would have required the Secretary to determine whether a deficiency has been corrected. The Secretary could determine: (1) the deficiency is corrected and withdraw the notice of deficiency; (2) additional time for, or modification of, the required corrective action is warranted; or (3) the deficiency is not corrected, the PSO has not acted with reasonable diligence or timeliness, and issue a Notice of Proposed Revocation and Delisting.

Section 3.108(a)(4) would have provided an automatic 30 calendar day period, unless waived by the PSO, for it to respond in writing to the proposed revocation and delisting. If a PSO fails to submit a written response, the Secretary would revoke his acceptance of its certification, and delist the entity. After review of the response and other relevant information, § 3.108(a)(5) proposed that the Secretary could affirm, reverse, or modify the notice of proposed revocation and delisting, and notify the PSO in writing of his decision with respect to any revocation of his prior acceptance of its certification and delisting. We noted that the proposed rule did not include an administrative process for appealing the Secretary's decision to revoke his acceptance of the entity's certification and delist a PSO, and specifically sought public comment on our approach.

Overview of Public Comments: Commenters focused on the due process aspects of subsection (a). While most commenters commended the proposed rule for its focus on working with PSOs to resolve deficiencies and its inclusion of due process elements throughout the process, the commenters recommended that the final rule incorporate an additional opportunity for an administrative appeal of a revocation and delisting decision and expressed concern that the final rule should not limit the due process rights and opportunities that had been proposed.

For example, while several commenters endorsed our overall approach, no commenter specifically stated agreement with our decision not to include an administrative appeal mechanism following a decision by the Secretary to revoke his acceptance of the entity's certification and delist a PSO for cause. The eight commenters that specifically addressed the issue recommended inclusion of such a mechanism.

Final Rule: The final rule incorporates only technical modifications to the text of subsection 3.108(a). The deletion of text in § 3.108(a)(1)(ii) is intended to clarify that the basis for revocation and delisting matches our intent in the proposed rule, i.e., the failure to meet the two-contract requirement, not the failure to timely notify the Secretary that the requirement had been met. In addition, we have incorporated a related new § 3.108(e) that establishes a new expedited revocation process to be used in exceptional circumstances.

Despite the strong support by commenters that we incorporate in the final rule an opportunity for an administrative appeal when the Secretary decides to revoke his acceptance of a PSO's certification and delist a PSO for cause, we have not modified the rule. The process described in § 3.108(a) permits an early response to findings of deficiency and where facts cited by the Secretary are correct, the process emphasizes the Department will work with PSOs to correct deficiencies, rather than punishing PSOs for deficiencies. Given the flexibility and extensive nature of the communication and correction opportunities and procedures outlined in 3.108(a), we expect that the revocation process will be utilized rarely, and only after significant efforts have been made to bring a PSO back into compliance. However, if a PSO is not working with us in good faith to correct any remaining deficiencies, there must be a timely finality to the process. For this system to work, providers must have confidence that the Department will act in a timely manner when a PSO chooses not to meet its statutory and regulatory obligations.

Response to Other Public Comments

Comment: One commenter recommended that the rule provide some degree of transparency regarding PSOs that have received notice of deficiencies by posting some limited information about this on the PSO Web site.

Response: The Department gave careful consideration to this comment because of our overall commitment to providing transparency wherever possible. Our conclusion is that we will not post information on deficiencies because of our concern that this will undermine another of our objectives, which is to promote and permit correction of deficiencies in a non-punitive manner. Providers considering entering a contract with a specific PSO are, of course, free to seek information from the PSO regarding whether it has received deficiency notices and is currently under an obligation to take corrective actions.

Comment: Another commenter suggested that the final rule specifically recognize the authority of the Secretary, if warranted by the circumstances that led to the delisting of a PSO, to debar the entity from seeking a new listing for a period of time.

Response: We have not adopted this specific suggestion, but we note that the Secretary is not required to relist an entity automatically. The Secretary can and will take into account the reasons for the revocation and delisting and the entity's compliance with its obligations following revocation and delisting.

Comment: Several commenters suggested that the period of time provided to the PSO to submit a written response to a notice of proposed revocation and delisting should be expanded from 30 days to 45 days.

Response: We have not accepted this recommendation. We recognize the importance of striking a balance between providing an entity sufficient time to respond to such a notice and ensuring that providers can have confidence that the Department will act in a timely manner when a PSO do not meet its obligations. It is important to realize that by the time the PSO receives a notice of proposed revocation and delisting under the process set forth in § 3.108(a)(3), the Department has already worked with the PSO to correct the deficiencies and has indicated remaining problems so the PSO will have reason to anticipate any such notice of proposed revocation in advance of its issuance. Thus the PSO, realistically, will have more than 30 days to prepare its response to a proposed revocation.

Comment: One commenter suggested that, if the Secretary determines that the PSO has conflicts of interest, this should serve as a basis for proceeding directly to revocation.

Response: The Department recognizes the commenter's underlying point that conflicts of interest may, in fact, not be curable and thus, in certain circumstances, may warrant proceeding directly to revocation. To the extent that such a conflict of interest provides a basis for the Secretary determining that continued listing would have serious adverse consequences, we could address it under § 3.108(e), the subsection establishing the new expedited revocation process. We should note that, in crafting that new authority, the Department believed that it had an obligation to establish a process for truly exceptional circumstances. We do not intend to use this authority as a substitute for the normal process established by subsection (a). Thus, if a conflict-of-interest does not raise the prospect of serious adverse consequences for providers or others, it is our intention to use the correction processes of subsection (a).

Comment: Would a provider's patient safety work product be at risk if the Department failed to alert the provider in a timely manner of a deficiency in its PSO?

Response: No. As we pointed out in the preamble discussion of § 3.108 in the proposed rule, the presence of deficiencies or the fact that an entity is undergoing revocation has no impact on the information submitted to the entity by providers until the date and time that an entity is revoked and removed from listing. If the PSO is revoked and delisted for cause, the statute provides an additional 30-day period that begins at the time of delisting during which data reported to the former PSO receives the same protections as patient safety work product.

(B) Section 3.108(b)—Revocation of the Secretary's Acceptance of a PSO's Certification

Proposed Rule: When the Secretary makes a determination to remove the listing of a PSO for cause, proposed § 3.108(b)(1) required the Secretary to establish, and notify the entity, of the effective date and time of its delisting and inform the entity of its obligations under §§ 3.108(b)(2) and 3.108(b)(3).

Section 3.108(b)(2) proposed to implement two statutory provisions. First, the former PSO would be required to notify providers with which it has been working of its removal from listing and confirm to the Secretary within 15 days of the date of revocation and delisting that it has done so. In light of the brief notification period, we sought comment on whether there are other steps the Secretary should take to ensure that affected providers receive timely notice. Second, this subsection would have reaffirmed the continued protection of patient safety work product received while the entity was listed. In addition, any data received by the former PSO from a provider in the 30 days following the date of revocation and delisting would be accorded the same protections as patient safety work product. We noted that this additional period of protection was only for the benefit of providers reporting data; it would not permit a former PSO to continue to generate new patient safety work product.

Section 3.108(b)(3) proposed to implement the statutory requirements regarding the disposition of patient safety work product or data following revocation and delisting of a PSO. The three alternatives provided by the statute are: transfer of the patient safety work product with the approval of the source from which it was received to a PSO which has agreed to accept it; return of the patient safety work product or data to the source from which it was received; or, if return is not practicable, destruction of such work product or data. We noted that the text of the proposed rule refers to the "source" of the patient safety work product or data; this would be a broader formulation than the statutory language and includes individuals. The statute does not establish a time frame for a PSO to comply with disposition requirements; we sought comment on setting a deadline.

Overview of Public Comments: Most commenters addressed the specific questions raised in the proposed rule, although a few commenters raised questions and offered recommendations related to the requirements for disposition of patient safety work product. In response to the Department's question in the proposed rule of whether there were other steps that the Secretary could take to ensure that providers were informed when a PSO to which they reported data was revoked and delisted, many commenters concluded that the statutory requirement for notification by the former PSO was sufficient. Others urged AHRQ to post notices of revocation and delisting on the PSO Web site. Several commenters urged the Secretary to require the former PSO to provide AHRQ with a list of its providers when it submits its required confirmation 15 days after revocation that it has notified providers. Presumably, the intent was to permit the Secretary to follow up with these providers to confirm that they had been notified.

There were only three comments in response to our question in the proposed rule whether it was appropriate to require disposition of patient safety work product that was received from all sources. Two comments supported our interpretation of the statutory requirement. One commenter raised concerns that this requirement could be difficult to accomplish.

Commenters strongly supported inclusion in the final rule of a deadline by which former PSOs needed to complete their disposition of patient safety work product. Some commenters suggested that we follow existing HIPAA guidelines and others suggested that the rule set a deadline, ranging from 90 days to 180 days following the date of revocation. One commenter suggested setting standards linked to the volume of patient safety work product held by the former PSO.

The options for disposition of patient safety work product elicited a number of comments. Some noted the difficulty of returning patient safety work product to its source as the former PSO closes its operations and expressed concern that destruction was not an option until the PSO concluded that returning the work product was not possible. In the view of this commenter, this could lead a PSO to simply abandon the patient safety work product since it may have neither time nor resources to contact the sources of the work product. However, most commenters focused on the importance of identifying ways to avoid destruction of patient safety work product.

Final Rule: Section 3.108(b) has been modified in several ways. The first changes, in § 3.108(b)(1), are technical changes. The first change renames the section to more accurately describe its provisions. The second technical change incorporates two additional cross-references to the ability of the Secretary to revoke his acceptance of a PSO's certifications and delist an entity pursuant to the new expedited revocation process established in § 3.108(e).

We have not imposed any new requirements on the Department in § 3.108(b)(2) to notify providers. Many commenters did not see the need for additional intervention by the Department and several commenters suggested additional steps that we can and will take independent of the rule. For example, AHRQ has already established an e-mail based listserve for individuals interested in electronic alerts regarding the agency's implementation of the Patient Safety Act. Following publication of the final rule, AHRQ will encourage all interested providers and PSOs to add their names to the listserv, which will provide immediate notification when the Secretary takes actions related to the listing and delisting of PSOs or posts significant new information on AHRQ's PSO Web site. Providers will also be able to signup on the Web site to receive individual e-mails if their PSO becomes delisted.

We have modified § 3.108(b)(2) in another way. This paragraph retains the restatement that was in the proposed rule of the statutory assurances regarding the continued protections for patient safety work product reported to a PSO before the effective date of a revocation and delisting action by the Secretary and the protections for data reported to the former PSO during the 30-day period following the date of delisting. The modification requires the former PSO to include this information in its notices to providers regarding its delisting. We incorporated this modification to better effectuate the statutory purpose by ensuring that the providers contacted by the former PSO are aware of these protections for the data they may still want to report during the 30-day period.

Several commenters sought ways to preserve patient safety work product and data for continued learning. However, the requirements for disposition of patient safety work product and "data" in the final regulation follow the statutory formulation. We note that "data" in this context refers to information submitted to a former PSO in the 30 days following its delisting. Some amount of patient safety work product can be preserved if the PSO shares or discloses this information prior to the effective date of its revocation as permitted by the rule, e.g., to other PSOs in non-identifiable or anonymized form.

We have modified the text of § 3.108(b)(3) in one respect. In response to comments, we require the disposition requirement to be completed within 90 days. Some commenters suggested that we follow existing HIPAA guidelines in establishing deadlines for the disposition of patient safety work product. Neither the HIPAA Privacy Rule nor the HIPAA Security Rule have deadlines for the disposition of protected health information. Providers are, of course, free to establish in their contracts an earlier date for disposition of their patient safety work product or data and may provide prior authorization for transfer to another PSO.

Response to Other Public Comments

Comment: One commenter asked whether the disposition requirement applies to non-identifiable patient safety work product, such as data reported anonymously by hospitals.

Response: The statutory section on disposition of patient safety work product does not make an explicit distinction between disposition of identifiable and non-identifiable patient safety work product and data, nor does the final rule in the disposition requirements. The Department reads this disposition requirement as applying to both identifiable and non-identifiable patient safety work product and data. We note that Subpart C permits disclosure of non-identifiable patient safety work product at any time by a PSO. However, after the date and time that the Secretary sets for revocation and delisting, the former PSO must follow the prescribed disposition requirements. Thus, prior to the effective date and time of a PSO's delisting, the PSO can transfer to another PSO non-identifiable and anonymized patient safety work product, without consent of the source(s) of that information.

Comment: One commenter suggested that there may be good business reasons for a former PSO that has been delisted to retain patient safety work product and asked that we provide that option.

Response: The statutory disposition requirement does not permit such an option for an entity that is revoked and delisted for cause, and the final rule mirrors this limitation. A PSO that voluntarily relinquishes its status is required to attest that it has made all reasonable efforts to comply with the disposition requirements.

Comment: One commenter noted that the disposition options appear to be premised on a concept of the source's ownership interest in the patient safety work product provided to the PSO. Noting that as PSOs continue to aggregate data from multiple providers or through the sharing of work product with other PSOs, the commenter asserted that at some point the PSO's work product becomes its own. The question to consider is whether this distinction can be made in applying the disposition requirement.

Response: The Department reads the disposition requirement of the Patient Safety Act to apply to all patient safety work product and data held by an involuntarily delisted former PSO. Most work product created by PSOs will be based upon reports from providers. While the commenter points to repeated aggregation of data from larger and larger numbers of providers as making the linkage to the reporting providers more tenuous, in our view the linkage remains as long as there is information that identifies any source of the data in the analysis. The linkage is only broken when the source(s) is (are) truly non-identifiable. As we noted above, the statute does not make a distinction between identifiable and non-identifiable information, so the disposition requirements apply to both.

Comment: One commenter noted that certain public PSO entities may face conflicts with state laws or regulations that establish requirements for the disposition of information that they hold.

Response: The final rule's requirements for disposition of patient safety work product would preempt conflicting state statutory requirements for disposition of information when it is patient safety work product.

Comment: What are the responsibilities of a contractor holding patient safety work product under contract with a PSO that is revoked and delisted for cause?

Response: The contractor must return the former PSO's patient safety work product that it is holding for disposition as required by the rule.

(C) Section 3.108(c)—Voluntary Relinquishment

Proposed Rule: Section 3.108(c)(1) proposed two circumstances under which a PSO would be considered to have voluntarily relinquished its status as a PSO: when a PSO advises the Secretary in writing that it no longer wishes to be a PSO, and when a PSO permits its three-year period of listing to expire. To ensure that such a lapse is not inadvertent, the proposed rule would require the Secretary to send a notice of imminent expiration 45 calendar days before the expiration of its period of listing.

We proposed in § 3.108(c)(2) that a PSO seeking to relinquish its listing should include in its notification to the Secretary attestations regarding its compliance with the provider notification and patient safety work product disposition requirements, and would have required appropriate contact information for further communications from the Secretary. The Secretary would be authorized by § 3.108(c)(3) to accept or reject the PSO's notification. We sought comment on our preliminary conclusion that, when a PSO voluntarily relinquishes its status, the statutory provisions providing protections for an additional 30 days for data submitted to the former PSO by providers do not apply.

Section 3.108(c)(4) would have enabled the Secretary to determine that implied voluntary relinquishment has taken place when a PSO permits its listing to expire. The Secretary would remove the entity from the list of PSOs at midnight on that day, notify the entity, and request that the entity make reasonable efforts to comply with the provider notification and patient safety work product disposition requirements, and to provide appropriate contact information. Finally, § 3.108(c)(5) proposed that voluntary relinquishment would not constitute a deficiency as referenced in subsection (a).

Overview of Public Comments: Public comment on the proposed provisions for voluntary relinquishment focused primarily on the two questions raised in the proposed rule.

Two commenters agreed with our interpretation that the statute limited the application of the additional protections for data submitted by providers to a former PSO in the 30-day period following the date and time of revocation and delisting to situations in which the PSO had been revoked and delisted for cause. A number of commenters argued for inclusion of a 30-day period of continued reporting for PSOs that voluntarily relinquished their status. They noted the importance of comparability but did not provide a legal rationale for reading the statute differently.

The second question posed by the proposed rule was the appropriateness of paragraph (c)(5) which would eliminate the right to challenge any decision by the Secretary regarding voluntary relinquishment. Several large provider groups supported our position while others argued that a PSO should always have the right to challenge or appeal any decision by the Secretary.

Final Rule: We have modified and narrowed the scope of voluntary relinquishment in the final rule. We have eliminated from this section the application of voluntary relinquishment to situations in which a PSO has let its certifications lapse. As noted above, we have modified § 3.104(e) to make expiration of a PSO's listing automatic in these circumstances. Revised § 3.108(c) provides for voluntary relinquishment in only one circumstance: when a PSO writes the Secretary seeking to relinquish its listing as a PSO.

We have carefully reviewed again the statutory authority that enables PSOs that have their listing revoked for cause to continue to receive data for 30 days following the date and time of revocation and delisting that will be treated as patient safety work product. We reaffirm our interpretation that the statutory authority does not apply to an entity seeking to voluntarily relinquish its status as a PSO. Commenters provided no basis for a different reading of the statute. Accordingly, we have not incorporated any change in the rule.

We have also deleted inappropriate references to "patient safety work product and data" in § 3.108(c)(2) and replaced them with a reference only to patient safety work product. As we noted above, the term "data" in this context refers only to information received by a former PSO in the 30-day period following revocation for cause and is not applicable here. The only other modifications are deletions of text relating to implied voluntary relinquishment and a conforming change in a cross-reference.

We have not accepted the views of commenters supporting appeals of relinquishment determinations by the Secretary in light of our decision to narrow the scope of voluntary relinquishment to situations in which the PSO has requested relinquishment. The comments regarding due process for those who voluntarily relinquish their status would no longer be apt.

(D) Section 3.108(d)—Public Notice of Delisting Regarding Removal From Listing

Proposed Rule: Proposed § 3.108(d) would have incorporated the statutory requirement that the Secretary must publish a notice in the Federal Register regarding the revocation of acceptance of certification of a PSO and its removal from listing. The proposed rule would have broadened the requirement to include publication of such a notice if delisting results from a determination of voluntary relinquishment.

Overview of Public Comments: We received no comments on this subsection.

Final Rule: We have modified § 3.108(d) in the final rule to reflect our changes to subsection (c) that narrowed the scope of voluntary relinquishment. We also added a new reference that requires the Secretary to publish a notice when a PSO's listing terminates automatically at the end of the statutorily based three-year period, pursuant to § 3.104(e).

(E) Section 3.108(e)—Expedited Revocation

Proposed Rule: The proposed rule did not contain a proposed § 3.108(e). The proposed rule did include in subsection (a) a request for comment about the possible inclusion in the final rule of an expedited revocation process. We noted that, while we anticipate that in the vast majority of circumstances, the PSO's deficiency(ies) can and will be corrected, there may be situations in which a PSO's conduct is so egregious that the Secretary's acceptance of the PSO's certification should be revoked without the opportunity to cure because there is no meaningful cure. We invited comments regarding this approach and how best to characterize the situations in which the opportunity to "cure," e.g., to change policies, practices or procedures, sanction employees, send out correction notices, would not be sufficient, meaningful, or appropriate.

Overview of Public Comments: Several commenters expressed concern, requested that we define the term "egregious," and opposed the elimination of a right for the PSO to respond to the proposed expedited revocation action. One commenter suggested that our proposal was appropriate in situations involving multiple willful violations and in which immediate action is necessary to protect patients and providers from further improper actions by the PSO.

Only one commenter addressed, and opposed, our suggestion that we might eliminate in the final rule the opportunity for a PSO to contest revocation when the entity had verifiably failed to meet the statutory minimum contract requirement.

Final Rule: The Department has modified the rule to include a new § 3.108(e) to provide for expedited revocation in a limited number of circumstances. In deciding to include this new subsection, we considered all of the comments received regarding Subpart B, not only those discussed here. There was a strong overall sentiment that the Secretary must be vigilant in ensuring that PSOs meet their obligations to protect the confidentiality of patient safety work product. These concerns were especially strong in response to our proposal to permit components of excluded entities to seek listing. We also received support for prompt Secretarial action for multiple willful violations and when providers and patients are at risk because of a PSO's actions. Accordingly, we have incorporated an expedited revocation process based around these concerns.

Return to Table of Contents
Return to Previous Section
Continue to Next Section