You Are Here: PSO Home > Legislation, Regulations and Guidance > Patient Safety and Quality Improvement: Final rule

Patient Safety and Quality Improvement. Final Rule (Continued)

(3) Determination of correction of a deficiency. (i) Unless the Secretary specifies another date, the Secretary must receive documentation to demonstrate that the PSO has corrected any deficiency cited in the preliminary finding of deficiency no later than five calendar days following the last day of the correction period that is specified by the Secretary in such notice.

(ii) In making a determination regarding the correction of any deficiency, the Secretary will consider the documentation submitted by the PSO, any assessments under § 3.110, recommendations of program staff, and any other information available regarding the PSO that the Secretary deems appropriate and relevant to the PSO's implementation of the terms of its certification.

(iii) After completing his review, the Secretary may make one of the following determinations:

(A) The action(s) taken by the PSO have corrected any deficiency, in which case the Secretary will withdraw the notice of deficiency and so notify the PSO;

(B) The PSO has acted in good faith to correct the deficiency, but the Secretary finds an additional period of time is necessary to achieve full compliance and/or the required corrective action specified in the notice of a preliminary finding of deficiency needs to be modified in light of the experience of the PSO in attempting to implement the corrective action, in which case the Secretary will extend the period for correction and/or modify the specific corrective action required; or

(C) The PSO has not completed the corrective action because it has not acted with reasonable diligence or speed to ensure that the corrective action was completed within the allotted time, in which case the Secretary will issue to the PSO a notice of proposed revocation and delisting.

(iv) When the Secretary issues a written notice of proposed revocation and delisting, the notice will specify the deficiencies that have not been timely corrected and will detail the manner in which the PSO may exercise its opportunity to be heard in writing to respond to the deficiencies specified in the notice.

(4) Opportunity to be heard in writing following a notice of proposed revocation and delisting. The Secretary will afford a PSO an opportunity to be heard in writing, as specified in paragraph (a)(4)(i) of this section, to provide a substantive response to the deficiency finding(s) set forth in the notice of proposed revocation and delisting.

(i) The notice of proposed revocation and delisting is presumed received five days after it is sent, absent evidence of actual receipt. The Secretary will provide a PSO with a period of time, beginning with the date of receipt of the notice of proposed revocation and delisting of which there is evidence, or the presumed date of receipt if there is no evidence of earlier receipt, and ending at midnight 30 calendar days thereafter, during which the PSO may submit a substantive response to the deficiency findings in writing.

(ii) The Secretary will provide to the PSO any rules of procedure governing the form or transmission of the written response to the notice of proposed revocation and delisting. Such rules may also be posted on the AHRQ PSO Web site or published in the Federal Register.

(iii) If a PSO does not submit a written response to the deficiency finding(s) within 30 calendar days of receipt of the notice of proposed revocation and delisting, the notice of proposed revocation becomes final as a matter of law and the basis for Secretarial action under paragraph (b)(1) of this section.

(5) The Secretary's decision regarding revocation. The Secretary will review the entire administrative record pertaining to a notice of proposed revocation and delisting and any written materials submitted by the PSO under paragraph (a)(4) of this section. The Secretary may affirm, reverse, or modify the notice of proposed revocation and delisting and will make a determination with respect to the continued listing of the PSO.

(b) Revocation of the Secretary's acceptance of a PSO's certifications—(1) Establishing the date and time of revocation and delisting. When the Secretary concludes, in accordance with a decision made under paragraphs (a)(5), (e)(3)(iii) or (e)(3)(iv)(C) of this section, that revocation of the acceptance of a PSO's certification is warranted for its failure to comply with requirements of the Patient Safety Act or of this Part, the Secretary will establish the effective time and date for such prompt revocation and removal of the entity from the list of PSOs, so notify the PSO in writing, and provide the relevant public notice required by § 3.108(d) of this subpart.

(2) Required notification of providers and status of data. (i) Upon being notified of the Secretary's action pursuant to paragraph (b)(1) of this section, the former PSO will take all reasonable actions to notify each provider, whose patient safety work product it collected or analyzed, of the Secretary's action(s) and the following statutory information: Confidentiality and privilege protections that applied to patient safety work product while the former PSO was listed continue to apply after the entity is removed from listing. Data submitted by providers to the former PSO for 30 calendar days following the date and time on which the entity was removed from the list of PSOs pursuant to paragraph (b)(1) of this section will have the same status as data submitted while the entity was still listed.

(ii) Within 15 days of being notified of the Secretary's action pursuant to paragraph (b)(1) of this section, the former PSO shall submit to the Secretary confirmation that it has taken the actions in paragraph (b)(2)(i) of this section.

(3) Disposition of patient safety work product and data. Within 90 days following the effective date of revocation and delisting pursuant to paragraph (b)(1) of this section, the former PSO will take one or more of the following measures in regard to patient safety work product and data described in paragraph (b)(2)(i) of this section:

(i) Transfer such patient safety work product or data, with the approval of the source from which it was received, to a PSO that has agreed to receive such patient safety work product or data;

(ii) Return such work product or data to the source from which it was submitted; or

(iii) If returning such patient safety work product or data to its source is not practicable, destroy such patient safety work product or data.

(c) Voluntary relinquishment—(1) Circumstances constituting voluntary relinquishment. A PSO will be considered to have voluntarily relinquished its status as a PSO if the Secretary accepts a notification from a PSO that it wishes to relinquish voluntarily its listing as a PSO.

(2) Notification of voluntary relinquishment. A PSO's notification of voluntary relinquishment to the Secretary must include the following:

(i) An attestation that all reasonable efforts have been made, or will have been made by a PSO within 15 calendar days of this statement, to notify the sources from which it received patient safety work product of the PSO's intention to cease PSO operations and activities, to relinquish voluntarily its status as a PSO, to request that these other entities cease reporting or submitting any further information to the PSO as soon as possible, and inform them that any information reported after the effective date and time of delisting that the Secretary sets pursuant to paragraph (c)(3) of this section will not be protected as patient safety work product under the Patient Safety Act.

(ii) An attestation that the entity has established a plan, or within 15 calendar days of this statement, will have made all reasonable efforts to establish a plan, in consultation with the sources from which it received patient safety work product, that provides for the disposition of the patient safety work product held by the PSO consistent with, to the extent practicable, the statutory options for disposition of patient safety work product as set out in paragraph (b)(3) of this section; and

(iii) Appropriate contact information for further communications from the Secretary.

(3) Response to notification of voluntary relinquishment. (i) After a PSO provides the notification required by paragraph (c)(2) of this section, the Secretary will respond in writing to the entity indicating whether the proposed voluntary relinquishment of its PSO status is accepted. If the voluntary relinquishment is accepted, the Secretary's response will indicate an effective date and time for the entity's removal from the list of PSOs and will provide public notice of the voluntary relinquishment and the effective date and time of the delisting, in accordance with § 3.108(d) of this subpart.

(ii) If the Secretary receives a notification of voluntary relinquishment during or immediately after revocation proceedings for cause under paragraphs (a)(4) and (a)(5) of this section, the Secretary, as a matter of discretion, may accept voluntary relinquishment in accordance with the preceding paragraph or decide not to accept the entity's proposed voluntary relinquishment and proceed with the revocation for cause and delisting pursuant to paragraph (b)(1) of this section.

(4) Non-applicability of certain procedures and requirements. (i) A decision by the Secretary to accept a request by a PSO to relinquish voluntarily its status as a PSO pursuant to paragraph (c)(2) of this section does not constitute a determination of a deficiency in PSO compliance with the Patient Safety Act or with this Subpart.

(ii) The procedures and requirements of § 3.108(a) of this subpart regarding deficiencies including the opportunity to correct deficiencies and to be heard in writing, and the procedures and requirements of § 3.108(b) are not applicable to determinations of the Secretary made pursuant to this subsection.

(d) Public notice of delisting regarding removal from listing. If the Secretary removes an entity from the list of PSOs following revocation of acceptance of the entity's certification pursuant to § 3.108(b)(1), voluntary relinquishment pursuant to § 3.108(c)(3), or expiration of an entity's period of listing pursuant to § 3.104(e)(1), the Secretary will promptly publish in the Federal Register and on the AHRQ PSO Web site, or in a comparable future form of public notice, a notice of the actions taken and the effective dates.

(e) Expedited revocation and delisting—(1) Basis for expedited revocation. Notwithstanding any other provision of this section, the Secretary may use the expedited revocation process described in paragraph (e)(3) of this section if he determines—

(i) The PSO is not in compliance with this Part because it is or is about to become an entity described in § 3.102(a)(2).

(ii) The parent organization of the PSO is an entity described in § 3.102(a)(2) and requires or induces health care providers to report patient safety work product to its component PSO; or

(iii) The circumstances for revocation in paragraph (a)(1) of this section exist, and the Secretary has determined that there would be serious adverse consequences if the PSO were to remain listed.

(2) Applicable provisions. If the Secretary uses the expedited revocation process described in paragraph (e)(3) of this section, the procedures in paragraphs (a)(2) through (5) of this section shall not apply and paragraph (a)(1) and paragraphs (b) and (d) of this section shall apply.

(3) Expedited revocation process. (i) The Secretary must send the PSO a written notice of deficiency that:

(A) Identifies the evidence that the circumstances for revocation and delisting under paragraph (a)(1) of this section exist, and any corrective action that the PSO must take if the Secretary determines that corrective action may resolve the matter so that the entity would not be delisted; and

(B) Provides an opportunity for the PSO to respond in writing to correct the facts or the legal bases for delisting found in the notice, and to offer any other grounds for its not being delisted.

(ii) The notice of deficiency will be presumed to be received five days after it is sent, absent evidence of the actual receipt date.

(iii) If the PSO does not submit a written response to the Secretary within 14 calendar days of actual or constructive receipt of such notice, whichever is longer, the Secretary may revoke his acceptance of the PSO's certifications and remove the entity from the list of PSOs.

(iv) If the PSO responds in writing within the required 14-day time period, the Secretary may take any of the following actions:

(A) Withdraw the notice of deficiency;

(B) Provide the PSO with more time to resolve the matter to the Secretary's satisfaction; or

§ 3.110 Assessment of PSO compliance.

The Secretary may request information or conduct announced or unannounced reviews of, or site visits to, PSOs, to assess or verify PSO compliance with the requirements of this subpart and for these purposes will be allowed to inspect the physical or virtual sites maintained or controlled by the PSO. The Secretary will be allowed to inspect and/or be given or sent copies of any PSO records deemed necessary and requested by the Secretary to implement the provisions of this subpart. Such PSO records may include patient safety work product in accordance with § 3.206(d) of this part.

§ 3.112 Submissions and forms.

(a) Forms referred to in this subpart may be obtained on the PSO Web site (http://www.pso.ahrq.gov) maintained for the Secretary by AHRQ or a successor agency or on successor publication technology or by requesting them in writing by email at pso@ahrq.hhs.gov, or by mail from the Agency for Healthcare Research and Quality, CQuIPS, PSO Liaison, 540 Gaither Road, Rockville, MD 20850. A form (including any required attachments) must be submitted in accordance with the accompanying instructions.

(b) Information submitted to AHRQ in writing, but not required to be on or attached to a form, and requests for information from AHRQ, may be submitted by mail or other delivery to the Agency for Healthcare Research and Quality, CQuIPS, PSO Liaison, 540 Gaither Road, Rockville, MD 20850, by facsimile at (301) 427-1341, or by email at pso@ahrq.hhs.gov.

(c) If a submission to the Secretary is incomplete or additional information is needed to allow a determination to be made under this subpart, the submitter will be notified if any additional information is required.

Subpart C—Confidentiality and Privilege Protections of Patient Safety Work Product

§ 3.204 Privilege of patient safety work product.

(a) Privilege. Notwithstanding any other provision of Federal, State, local, or Tribal law and subject to paragraph (b) of this section and § 3.208 of this subpart, patient safety work product shall be privileged and shall not be:

(1) Subject to a Federal, State, local, or Tribal civil, criminal, or administrative subpoena or order, including in a Federal, State, local, or Tribal civil or administrative disciplinary proceeding against a provider;

(2) Subject to discovery in connection with a Federal, State, local, or Tribal civil, criminal, or administrative proceeding, including in a Federal, State, local, or Tribal civil or administrative disciplinary proceeding against a provider;

(3) Subject to disclosure pursuant to section 552 of Title 5, United States Code (commonly known as the Freedom of Information Act) or any other similar Federal, State, local, or Tribal law;

(4) Admitted as evidence in any Federal, State, local, or Tribal governmental civil proceeding, criminal proceeding, administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such proceeding against a provider; or

(5) Admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under State law.

(b) Exceptions to privilege. Privilege shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:

(1) Disclosure of relevant patient safety work product for use in a criminal proceeding, subject to the conditions at § 3.206(b)(1) of this subpart.

(2) Disclosure to the extent required to permit equitable relief subject to the conditions at § 3.206(b)(2) of this subpart.

(3) Disclosure pursuant to provider authorizations subject to the conditions at § 3.206(b)(3) of this subpart.

(4) Disclosure of non-identifiable patient safety work product subject to the conditions at § 3.206(b)(5) of this subpart.

(c) Implementation and enforcement by the Secretary. Privilege shall not apply to (and shall not be construed to prohibit) disclosures of relevant patient safety work product to or by the Secretary if such patient safety work product is needed to investigate or determine compliance, or to seek or impose civil money penalties, with respect to this part or the HIPAA Privacy Rule, or to make or support decisions with respect to listing of a PSO.

§ 3.206 Confidentiality of patient safety work product.

(a) Confidentiality. Subject to paragraphs (b) through (e) of this section, and §§ 3.208 and 3.210 of this subpart, patient safety work product shall be confidential and shall not be disclosed.

(b) Exceptions to confidentiality. The confidentiality provisions shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:

(1) Disclosure in criminal proceedings. Disclosure of relevant patient safety work product for use in a criminal proceeding, but only after a court makes an in camera determination that:

(i) Such patient safety work product contains evidence of a criminal act;

(ii) Such patient safety work product is material to the proceeding; and

(iii) Such patient safety work product is not reasonably available from any other source.

(2) Disclosure to permit equitable relief for reporters. Disclosure of patient safety work product to the extent required to permit equitable relief under section 922 (f)(4)(A) of the Public Health Service Act, provided the court or administrative tribunal has issued a protective order to protect the confidentiality of the patient safety work product in the course of the proceeding.

(3) Disclosure authorized by identified providers. (i) Disclosure of identifiable patient safety work product consistent with a valid authorization if such authorization is obtained from each provider identified in such work product prior to disclosure. A valid authorization must:

(A) Be in writing and signed by the provider from whom authorization is sought; and

(B) Contain sufficient detail to fairly inform the provider of the nature and scope of the disclosures being authorized;

(ii) A valid authorization must be retained by the disclosing entity for six years from the date of the last disclosure made in reliance on the authorization and made available to the Secretary upon request.

(4) Disclosure for patient safety activities—(i) Disclosure between a provider and a PSO. Disclosure of patient safety work product for patient safety activities by a provider to a PSO or by a PSO to that disclosing provider.

(ii) Disclosure to a contractor of a provider or a PSO. A provider or a PSO may disclose patient safety work product for patient safety activities to an entity with which it has contracted to undertake patient safety activities on its behalf. A contractor receiving patient safety work product for patient safety activities may not further disclose patient safety work product, except to the provider or PSO with which it is contracted.

(iii) Disclosure among affiliated providers. Disclosure of patient safety work product for patient safety activities by a provider to an affiliated provider.

(iv) Disclosure to another PSO or provider. Disclosure of patient safety work product for patient safety activities by a PSO to another PSO or to another provider that has reported to the PSO, or, except as otherwise permitted in paragraph (b)(4)(iii) of this section, by a provider to another provider, provided:

(A) The following direct identifiers of any providers and of affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce, or household members of such providers are removed:

(1) Names;

(2) Postal address information, other than town or city, State and zip code;

(3) Telephone numbers;

(4) Fax numbers;

(5) Electronic mail addresses;

(6) Social security numbers or taxpayer identification numbers;

(7) Provider or practitioner credentialing or DEA numbers;

(8) National provider identification number;

(9) Certificate/license numbers;

(10) Web Universal Resource Locators (URLs);

(11) Internet Protocol (IP) address numbers;

(12) Biometric identifiers, including finger and voice prints; and

(13) Full face photographic images and any comparable images; and

(B) With respect to any individually identifiable health information in such patient safety work product, the direct identifiers listed at 45 CFR 164.514(e)(2) have been removed.

(5) Disclosure of nonidentifiable patient safety work product. Disclosure of nonidentifiable patient safety work product when patient safety work product meets the standard for nonidentification in accordance with § 3.212 of this subpart.

(6) Disclosure for research. (i) Disclosure of patient safety work product to persons carrying out research, evaluation or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by the Secretary, for the purpose of conducting research.

(ii) If the patient safety work product disclosed pursuant to paragraph (b)(6)(i) of this section is by a HIPAA covered entity as defined at 45 CFR 160.103 and contains protected health information as defined by the HIPAA Privacy Rule at 45 CFR 160.103, such patient safety work product may only be disclosed under this exception in the same manner as would be permitted under the HIPAA Privacy Rule.

(7) Disclosure to the Food and Drug Administration (FDA) and entities required to report to FDA. (i) Disclosure by a provider of patient safety work product concerning an FDA-regulated product or activity to the FDA, an entity required to report to the FDA concerning the quality, safety, or effectiveness of an FDA-regulated product or activity, or a contractor acting on behalf of FDA or such entity for these purposes.

(ii) Any person permitted to receive patient safety work product pursuant to paragraph (b)(7)(i) of this section may only further disclose such patient safety work product for the purpose of evaluating the quality, safety, or effectiveness of that product or activity to another such person or the disclosing provider.

(8) Voluntary disclosure to an accrediting body. (i) Voluntary disclosure by a provider of patient safety work product to an accrediting body that accredits that provider, provided, with respect to any identified provider other than the provider making the disclosure:

(A) The provider agrees to the disclosure; or

(B) The identifiers at § 3.206(b)(4)(iv)(A) are removed.

(ii) An accrediting body may not further disclose patient safety work product it receives pursuant to paragraph (b)(8)(i) of this section.

(iii) An accrediting body may not take an accrediting action against a provider based on a good faith participation of the provider in the collection, development, reporting, or maintenance of patient safety work product in accordance with this Part. An accrediting body may not require a provider to reveal its communications with any PSO.

(9) Disclosure for business operations. (i) Disclosure of patient safety work product by a provider or a PSO for business operations to attorneys, accountants, and other professionals. Such contractors may not further disclose patient safety work product, except to the entity from which they received the information.

(ii) Disclosure of patient safety work product for such other business operations that the Secretary may prescribe by regulation as consistent with the goals of this part.

(10) Disclosure to law enforcement. (i) Disclosure of patient safety work product to an appropriate law enforcement authority relating to an event that either constitutes the commission of a crime, or for which the disclosing person reasonably believes constitutes the commission of a crime, provided that the disclosing person believes, reasonably under the circumstances, that the patient safety work product that is disclosed is necessary for criminal law enforcement purposes.

(ii) Law enforcement personnel receiving patient safety work product pursuant to paragraph (b)(10)(i) of this section only may disclose that patient safety work product to other law enforcement authorities as needed for law enforcement activities related to the event that gave rise to the disclosure under paragraph (b)(10)(i) of this section.

(c) Safe harbor. A provider or responsible person, but not a PSO, is not considered to have violated the requirements of this subpart if a member of its workforce discloses patient safety work product, provided that the disclosure does not include materials, including oral statements, that:

(1) Assess the quality of care of an identifiable provider; or

(2) Describe or pertain to one or more actions or failures to act by an identifiable provider.

(d) Implementation and enforcement by the Secretary. The confidentiality provisions shall not apply to (and shall not be construed to prohibit) disclosures of relevant patient safety work product to or by the Secretary if such patient safety work product is needed to investigate or determine compliance or to seek or impose civil money penalties, with respect to this part or the HIPAA Privacy Rule, or to make or support decisions with respect to listing of a PSO.

(e) No limitation on authority to limit or delegate disclosure or use. Nothing in subpart C of this part shall be construed to limit the authority of any person to enter into a contract requiring greater confidentiality or delegating authority to make a disclosure or use in accordance with this subpart.

§ 3.208 Continued protection of patient safety work product.

(a) Except as provided in paragraph (b) of this section, patient safety work product disclosed in accordance with this subpart, or disclosed impermissibly, shall continue to be privileged and confidential.

(b)(1) Patient safety work product disclosed for use in a criminal proceeding pursuant to section 922(c)(1)(A) of the Public Health Service Act, 42 U.S.C. 299b-22(c)(1)(A), and/or pursuant to § 3.206(b)(1) of this subpart continues to be privileged, but is no longer confidential.

(2) Non-identifiable patient safety work product that is disclosed is no longer privileged or confidential and not subject to the regulations under this part.

(3) Paragraph (b) of this section applies only to the specific patient safety work product disclosed.

§ 3.210 Required disclosure of patient safety work product to the Secretary.

Notwithstanding any other provision in this part, providers, PSOs, and responsible persons must disclose patient safety work product upon request by the Secretary when the Secretary determines such patient safety work product is needed to investigate or determine compliance or to seek or impose civil money penalties, with respect to this part or the HIPAA Privacy Rule, or to make or support decisions with respect to listing of a PSO.

§ 3.212 Nonidentification of patient safety work product.

(a) Patient safety work product is nonidentifiable with respect to a particular identified provider or a particular identified reporter if:

(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an identified provider or reporter; and

(ii) Documents the methods and results of the analysis that justify such determination; or

(2)(i) The following identifiers of such provider or reporter and of affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce, or household members of such providers or reporters are removed:

(A) The direct identifiers listed at § 3.206(b)(4)(iv)(A)(1) through (13) of this subpart;

(B) Geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code and equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census, the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people;

(D) Any other unique identifying number, characteristic, or code except as permitted for re-identification; and

(ii) The provider, PSO or responsible person making the disclosure does not have actual knowledge that the information could be used, alone or in combination with other information that is reasonably available to the intended recipient, to identify the particular provider or reporter.

(3) Re-identification. A provider, PSO, or responsible person may assign a code or other means of record identification to allow information made nonidentifiable under this section to be re-identified by such provider, PSO, or responsible person, provided that:

(i) The code or other means of record identification is not derived from or related to information about the provider or reporter and is not otherwise capable of being translated so as to identify the provider or reporter; and

(ii) The provider, PSO, or responsible person does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(b) Patient safety work product is non-identifiable with respect to a particular patient only if the individually identifiable health information regarding that patient is de-identified in accordance with the HIPAA Privacy Rule standard and implementation specifications for the de-identification at 45 CFR 164.514(a) through (c).

Return to Table of Contents
Return to Previous Section
Continue to Next Section