Implementing the Patient Safety and Quality Improvement Act of 2005 Including How to Become a Patient Safety Organization: Interim Guidance (Continued)

Back to Patient Safety Organizations Home

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Implementing the Patient Safety and Quality Improvement Act of 2005 Including How to Become a Patient Safety Organization: Interim Guidance (Continued)

IV. Listing of PSOs and Department Oversight of Listed PSOs

By statute, PSOs are listed for a three year period. The listing will be published on the AHRQ PSO Web site www.pso.ahrq.gov. To remain listed during that time, a PSO must comply with the Patient Safety Act. Once a final rule implementing the Patient Safety Act becomes effective, we expect that any listed PSO will promptly become and remain compliant with such rule. Until then, we are adopting, and require PSOs to follow, HHS procedures that are described in the published NPRM that reflect the provisions of the Patient Safety Act. The Secretary recommends that individuals and entities review and voluntarily adhere to other portions of the proposed rule. To the extent the terms of the proposed rule require more than the terms of the Patient Safety Act, i.e., where more than one interpretation of how to apply the Act to a particular PSO's circumstances would be reasonable, compliance with the proposed rule is voluntary.

As indicated above, the Secretary has adopted pragmatic timelines in the proposed rule for the review of required submissions necessary to meet statutory objectives. For example, the statute requires at least two bona fide contracts during each successive 24-month period starting from the date of initial listing. The Secretary's proposed timeline for reporting on compliance with this requirement coincides with the limited period for arranging the minimum number of contracts. This timeframe was chosen so that no party would benefit unfairly from a delay in reporting that the requirement has been met. Similarly, the failure to make timely certifications for continuation of listing prior to the three-year limit of the current listing of a PSO would result in delisting of a PSO by voluntary relinquishment. This would be necessary because the statute puts a three-year limit on any listing. If the prerequisites for a continued listing have not been met when the first listing ends, the PSO must be removed from the list.

A preliminary finding of deficiency will be sent to a PSO initially to provide an opportunity to correct the facts upon which HHS is relying. The Department does not intend that this notice trigger an adversarial process. Rather, this notice, if accurate, is to assist a PSO in beginning a cooperative correction period. The Secretary will provide for a reasonable period of time for correction of any deficiency in the notice, and will extend such time if justified. Only when it appears that good faith efforts to correct any deficiency have not been made will the Secretary issue a notice of proposed revocation and delisting. The NPRM sets out timelines with respect to the opportunity for a PSO to respond to this notice of proposed revocation in writing (see the NPRM at 42 CFR §3.108(a)(2)). The Secretary will adhere to the proposed timelines for purposes of implementing the Patient Safety Act. Accordingly, the Secretary will make a determination with respect to revocation and delisting at the end of the period for submission of the PSO's response. If the Secretary determines that there is cause to proceed with revocation and delisting (as the NPRM indicates at 3.108(a)(3)), the statute requires that a notice of the revocation and delisting be published.

In addition, when the Secretary determines that a PSO has violated the confidentiality provision of the Patient Safety Act, penalties may be assessed in accordance with section 922(f)(1) of the PHS Act and with the enforcement provisions described in Subpart D of the proposed rule, discussed below.

V. Public Notices

Because much of a provider's PSWP is protected only if it is sent to a PSO while it is listed (or during a statutorily provided 30-day extension period),¹⁹ providers have a significant interest in knowing if their PSO is about to lose its PSO listing and status. Accordingly, if the facts on which a proposed revocation and delisting are based are not successfully challenged or found to be incorrect, the Secretary will, pursuant to section 924(e)(3) of the PHS Act, publish a notice of a revocation decision, indicating when it will take effect. In addition, AHRQ has established an electronic mailing list that will provide automatic email notification to health care providers regarding PSOs, including notice if and when a PSO is being delisted. Health care providers can join the electronic mailing list by visiting the AHRQ PSO Web site www.pso.ahrq.gov. In the future, the AHRQ PSO Web site will be modified to allow for healthcare providers to request an e-mail notice if and when their PSO is being delisted. Interested members of the public, including providers relying on the continuing protection of their PSWP by the PSO, will thus be alerted to the imminent change in a PSO's ability to receive and analyze PSWP.

For the same reasons, the Secretary will promptly publish on the AHRQ PSO Web site, in accordance with the statutory requirement in section 924(c)(3) of the PHS Act, a notice of findings with respect to a PSO's ability to "fairly and accurately perform . patient safety activities," based upon the PSO's required disclosures²⁰ regarding any relationships with their contracting providers outside of the PSO services agreements.²¹ Failure to adequately adjust the relationships could result in a removal from the list of PSOs, and such removal would be posted on AHRQ's PSO Web site. Interested parties alerted to this possibility would be able to discuss the situation with their PSO, ask to be kept informed, or could watch for the PSO's removal from the list.

VI. Privilege

The Patient Safety Act provides²² that, subject to certain exceptions, PSWP is privileged and shall not be subject to a subpoena or order, to discovery, to disclosure pursuant to the Freedom of Information Act or any other similar Federal, State, or local law; or admitted as evidence. Once a PSO is listed by the Secretary, information that meets the definition of PSWP will be privileged. The Patient Safety Act provides that this privilege exists notwithstanding any other provision of law, and subject to the Act's exceptions. These legal prohibitions on disclosure will be important to providers that have PSWP and seek to ensure that it will not be subject to a subpoena, order, or discovery request. Others who have PSWP, or seek access to PSWP, will also need to understand these prohibitions. The privilege protections under the Patient Safety Act are self-implementing; it is anticipated that they will be applied and enforced by the tribunals in the particular proceedings in which the statutory privilege for PSWP is asserted.

VII. Confidentiality

The Patient Safety Act provides²³ that, subject to certain exceptions, PSWP is confidential and shall not be disclosed. We note that these exceptions to confidentiality are "permissions" to disclose PSWP and the holder of the PSWP retains full discretion whether or not to disclose. We are not encouraging or requiring disclosures, except to the Secretary as discussed herein. Therefore, a provider, PSO, or others, may create confidentiality policies and procedures with respect to PSWP that are more stringent than in the statute and are free to otherwise condition the release of PSWP that comes within these exceptions by contract, employment relationship, or other means. However, the Secretary will not enforce such policies or private agreements.²⁴

The Act provides for continued protection of information after disclosure. Identifiable PSWP that is disclosed continues to be privileged and confidential except if PSWP is disclosed in a criminal proceeding, the confidentiality protections provided for in the Act no longer apply to the work product so disclosed.

The HIPAA Privacy Rule requirements continue to apply to HIPAA covered entities with respect to the use and disclosure of PSWP that includes protected health information, and are not affected by this Interim Guidance.

The Patient Safety Act, at section 922(g) of the PHS Act, also provides, among other things, that the Act does not limit (a) laws that provide greater privilege or confidentiality protections than under the Act; (b) the authority of any entity (e.g., a provider) to enter into a contract requiring greater confidentiality, or delegating authority to make a disclosure in accordance with the Act; or (c) requirements for reporting to the Food and Drug Administration (FDA) information regarding the safety of a product or activity regulated by the FDA.

VIII. Enforcement Program

The Patient Safety Act, at section 922(f) of the PHS Act, provides that any person or entity who discloses identifiable PSWP in knowing or reckless violation of the Act shall be subject to a CMP of not more than $10,000 for each act constituting such violation. The Act also states that penalties shall not be imposed both under this subsection and under the HIPAA Privacy Rule for a single act or omission. Finally, the Act provides that the provisions of section 1128A of the Social Security Act, other than subsections (a) and (b) and the first sentence of subsection (c)(1), shall apply to CMPs under this Act. These provisions of section 1128A address the procedures the Secretary must follow to impose a CMP, and the right to challenge such a finding. The same provisions apply to the imposition of CMPs under the HIPAA administrative simplification rules (e.g., the Privacy Rule). The HIPAA Enforcement Rule established procedures in accordance with section 1128A, and subpart D of the NPRM mirrors the HIPAA Enforcement Rule.

The NPRM includes proposed procedures at Subpart D for the filing of complaints regarding alleged violations of the confidentiality provisions of the statute; the investigation of these complaints and the conduct of compliance reviews by the Secretary, which will be undertaken by the Office for Civil Rights (OCR); Secretarial action where noncompliance is found; the imposition of CMPs; and the conduct of hearings, which afford the opportunity to challenge any imposition of CMPs. These provisions are, to a great extent, based on Section 1128A of the Social Security Act. The corresponding preamble language also provides relevant guidance. This Interim Guidance adopts these NPRM provisions and they are binding.²⁵

IX. Other Key Statutory Provisions

The Act also prohibits certain actions by accrediting bodies. Under section 922(d)(4)(B) of the PHS Act, an accrediting body may not take an accrediting action against a provider based on the good faith participation of the provider in the collection, development, reporting, or maintenance of PSWP. Also, an accrediting body may not require a provider to reveal its communications with a PSO.

The Act also provides certain protection for persons who have reported information. See 922(e) and 922(f)(4) of the PHS Act. A provider may not take an adverse employment action against an individual based upon the fact that the individual in good faith reported information to the provider with the intention of having the information reported to a PSO or reported information directly to a PSO. A civil action may be brought by any aggrieved individual to enjoin any act or practice that violates this prohibition and to obtain other appropriate equitable relief (including reinstatement, back pay, and restoration of benefits) to redress such violation. An "adverse employment action" includes a loss of employment, the failure to promote an individual, or the failure to provide any other employment-related benefit for which the individual would otherwise be eligible; or an adverse evaluation or decision made in relation to accreditation, certification, credentialing, or licensing of the individual.

For further information regarding HHS interpretations of these provisions, see the NPRM: 73 FR 8112 - 8113.

Appendix A: The Patient Safety and Quality Improvement Act of 2005

An Act

To amend title IX of the Public Health Service Act to provide for the improvement of patient safety and to reduce the incidence of events that adversely effect patient safety.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

(a) Short Title- This Act may be cited as the `Patient Safety and Quality Improvement Act of 2005'.

(b) Table of Contents- The table of contents for this Act is as follows:

Sec. 1. Short title; table of contents.
Sec. 2. Amendments to Public Health Service Act.

Part C--Patient Safety Improvement

Sec. 921. Definitions.
Sec. 922. Privilege and confidentiality protections.
Sec. 923. Network of patient safety databases.
Sec. 924. Patient safety organization certification and listing.
Sec. 925. Technical assistance.
Sec. 926. Severability.

SEC. 2. AMENDMENTS TO PUBLIC HEALTH SERVICE ACT.

(a) In General- Title IX of the Public Health Service Act (42 U.S.C. 299 et seq.) is amended--

in section 912(c), by inserting, 'in accordance with part C', after `The Director shall';
by redesignating part C as part D;
by redesignating sections 921 through 928, as sections 931 through 938, respectively;
in section 938(1) (as so redesignated), by striking `921' and inserting `931'; and
by inserting after part B the following:

PART C--PATIENT SAFETY IMPROVEMENT

SEC. 921 [of the Public Health Service Act]. DEFINITIONS.

In this part:

HIPAA CONFIDENTIALITY REGULATIONS- The term `HIPAA confidentiality regulations' means regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191; 110 Stat. 2033).
IDENTIFIABLE PATIENT SAFETY WORK PRODUCT- The term `identifiable patient safety work product' means patient safety work product that--
1. is presented in a form and manner that allows the identification of any provider that is a subject of the work product, or any providers that participate in activities that are a subject of the work product;
2. constitutes individually identifiable health information as that term is defined in the HIPAA confidentiality regulations; or
3. is presented in a form and manner that allows the identification of an individual who reported information in the manner specified in section 922(e).
NONIDENTIFIABLE PATIENT SAFETY WORK PRODUCT- The term `nonidentifiable patient safety work product' means patient safety work product that is not identifiable patient safety work product (as defined in paragraph (2)).
PATIENT SAFETY ORGANIZATION- The term `patient safety organization' means a private or public entity or component thereof that is listed by the Secretary pursuant to section 924(d).
PATIENT SAFETY ACTIVITIES- The term `patient safety activities' means the following activities:
1. Efforts to improve patient safety and the quality of health care delivery.
2. The collection and analysis of patient safety work product.
3. The development and dissemination of information with respect to improving patient safety, such as recommendations, protocols, or information regarding best practices.
4. The utilization of patient safety work product for the purposes of encouraging a culture of safety and of providing feedback and assistance to effectively minimize patient risk.
5. The maintenance of procedures to preserve confidentiality with respect to patient safety work product.
6. The provision of appropriate security measures with respect to patient safety work product.
7. The utilization of qualified staff.
8. Activities related to the operation of a patient safety evaluation system and to the provision of feedback to participants in a patient safety evaluation system.
PATIENT SAFETY EVALUATION SYSTEM- The term `patient safety evaluation system' means the collection, management, or analysis of information for reporting to or by a patient safety organization.
PATIENT SAFETY WORK PRODUCT-
1. IN GENERAL- Except as provided in subparagraph (B), the term `patient safety work product' means any data, reports, records, memoranda, analyses (such as root cause analyses), or written or oral statements--
  1. which--
    1. are assembled or developed by a provider for reporting to a patient safety organization and are reported to a patient safety organization; or
    2. are developed by a patient safety organization for the conduct of patient safety activities; and which could result in improved patient safety, health care quality, or health care outcomes; or
  2. which identify or constitute the deliberations or analysis of, or identify the fact of reporting pursuant to, a patient safety evaluation system.
2. CLARIFICATION-
  1. Information described in subparagraph (A) does not include a patient's medical record, billing and discharge information, or any other original patient or provider record.
  2. Information described in subparagraph (A) does not include information that is collected, maintained, or developed separately, or exists separately, from a patient safety evaluation system. Such separate information or a copy thereof reported to a patient safety organization shall not by reason of its reporting be considered patient safety work product.
  3. Nothing in this part shall be construed to limit--
    1. the discovery of or admissibility of information described in this subparagraph in a criminal, civil, or administrative proceeding;
    2. the reporting of information described in this subparagraph to a Federal, State, or local governmental agency for public health surveillance, investigation, or other public health purposes or health oversight purposes; or
    3. a provider's recordkeeping obligation with respect to information described in this subparagraph under Federal, State, or local law.
3. PROVIDER- The term `provider' means--
  1. an individual or entity licensed or otherwise authorized under State law to provide health care services, including--
    1. a hospital, nursing facility, comprehensive outpatient rehabilitation facility, home health agency, hospice program, renal dialysis facility, ambulatory surgical center, pharmacy, physician or health care practitioner's office, long term care facility, behavior health residential treatment facility, clinical laboratory, or health center; or
    2. a physician, physician assistant, nurse practitioner, clinical nurse specialist, certified registered nurse anesthetist, certified nurse midwife, psychologist, certified social worker, registered dietitian or nutrition professional, physical or occupational therapist, pharmacist, or other individual health care practitioner; or
  2. any other individual or entity specified in regulations promulgated by the Secretary.

SEC. 922 [of the Public Health Service Act]. PRIVILEGE AND CONFIDENTIALITY PROTECTIONS.

Privilege- Notwithstanding any other provision of Federal, State, or local law, and subject to subsection (c), patient safety work product shall be privileged and shall not be--
1. subject to a Federal, State, or local civil, criminal, or administrative subpoena or order, including in a Federal, State, or local civil or administrative disciplinary proceeding against a provider;
2. subject to discovery in connection with a Federal, State, or local civil, criminal, or administrative proceeding, including in a Federal, State, or local civil or administrative disciplinary proceeding against a provider;
3. subject to disclosure pursuant to section 552 of title 5, United States Code (commonly known as the Freedom of Information Act) or any other similar Federal, State, or local law;
4. admitted as evidence in any Federal, State, or local governmental civil proceeding, criminal proceeding, administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such proceeding against a provider; or
5. admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under State law.
CONFIDENTIALITY OF PATIENT SAFETY WORK PRODUCT- Notwithstanding any other provision of Federal, State, or local law, and subject to subsection (c), patient safety work product shall be confidential and shall not be disclosed.
Exceptions- Except as provided in subsection (g)(3)--
1. EXCEPTIONS FROM PRIVILEGE AND CONFIDENTIALITY- Subsections (a) and (b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
  1. Disclosure of relevant patient safety work product for use in a criminal proceeding, but only after a court makes an in camera determination that such patient safety work product contains evidence of a criminal act and that such patient safety work product is material to the proceeding and not reasonably available from any other source.
  2. Disclosure of patient safety work product to the extent required to carry out subsection (f)(4)(A).
  3. Disclosure of identifiable patient safety work product if authorized by each provider identified in such work product.
EXCEPTIONS FROM CONFIDENTIALITY- Subsection (b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
1. Disclosure of patient safety work product to carry out patient safety activities.
2. Disclosure of nonidentifiable patient safety work product.
3. Disclosure of patient safety work product to grantees, contractors, or other entities carrying out research, evaluation, or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by the Secretary, for the purpose of conducting research to the extent that disclosure of protected health information would be allowed for such purpose under the HIPAA confidentiality regulations.
4. Disclosure by a provider to the Food and Drug Administration with respect to a product or activity regulated by the Food and Drug Administration.
5. Voluntary disclosure of patient safety work product by a provider to an accrediting body that accredits that provider.
6. Disclosures that the Secretary may determine, by rule or other means, are necessary for business operations and are consistent with the goals of this part.
7. Disclosure of patient safety work product to law enforcement authorities relating to the commission of a crime (or to an event reasonably believed to be a crime) if the person making the disclosure believes, reasonably under the circumstances, that the patient safety work product that is disclosed is necessary for criminal law enforcement purposes.
8. With respect to a person other than a patient safety organization, the disclosure of patient safety work product that does not include materials that--
  1. assess the quality of care of an identifiable provider; or
  2. describe or pertain to one or more actions or failures to act by an identifiable provider.
EXCEPTION FROM PRIVILEGE- Subsection (a) shall not apply to (and shall not be construed to prohibit) voluntary disclosure of nonidentifiable patient safety work product.
Continued Protection of Information After Disclosure-
1. IN GENERAL- Patient safety work product that is disclosed under subsection (c) shall continue to be privileged and confidential as provided for in subsections (a) and (b), and such disclosure shall not be treated as a waiver of privilege or confidentiality, and the privileged and confidential nature of such work product shall also apply to such work product in the possession or control of a person to whom such work product was disclosed.
2. EXCEPTION- Notwithstanding paragraph (1), and subject to paragraph (3)--
  1. if patient safety work product is disclosed in a criminal proceeding, the confidentiality protections provided for in subsection (b) shall no longer apply to the work product so disclosed; and
  2. if patient safety work product is disclosed as provided for in subsection (c)(2)(B) (relating to disclosure of nonidentifiable patient safety work product), the privilege and confidentiality protections provided for in subsections (a) and (b) shall no longer apply to such work product.
3. CONSTRUCTION- Paragraph (2) shall not be construed as terminating or limiting the privilege or confidentiality protections provided for in subsection (a) or (b) with respect to patient safety work product other than the specific patient safety work product disclosed as provided for in subsection (c).
LIMITATIONS ON ACTIONS-
1. PATIENT SAFETY ORGANIZATIONS-
  1. IN GENERAL- A patient safety organization shall not be compelled to disclose information collected or developed under this part whether or not such information is patient safety work product unless such information is identified, is not patient safety work product, and is not reasonably available from another source.
  2. NONAPPLICATION- The limitation contained in clause (i) shall not apply in an action against a patient safety organization or with respect to disclosures pursuant to subsection (c)(1).
2. PROVIDERS- An accrediting body shall not take an accrediting action against a provider based on the good faith participation of the provider in the collection, development, reporting, or maintenance of patient safety work product in accordance with this part. An accrediting body may not require a provider to reveal its communications with any patient safety organization established in accordance with this part.
Reporter Protection-
1. IN GENERAL- A provider may not take an adverse employment action, as described in paragraph (2), against an individual based upon the fact that the individual in good faith reported information--
  1. to the provider with the intention of having the information reported to a patient safety organization; or
  2. directly to a patient safety organization.
2. ADVERSE EMPLOYMENT ACTION- For purposes of this subsection, an `adverse employment action' includes--
  1. loss of employment, the failure to promote an individual, or the failure to provide any other employment-related benefit for which the individual would otherwise be eligible; or
  2. an adverse evaluation or decision made in relation to accreditation, certification, credentialing, or licensing of the individual.
Enforcement-
1. CIVIL MONETARY PENALTY- Subject to paragraphs (2) and (3), a person who discloses identifiable patient safety work product in knowing or reckless violation of subsection (b) shall be subject to a civil monetary penalty of not more than $10,000 for each act constituting such violation.
2. PROCEDURE- The provisions of section 1128A of the Social Security Act, other than subsections (a) and (b) and the first sentence of subsection (c)(1), shall apply to civil money penalties under this subsection in the same manner as such provisions apply to a penalty or proceeding under section 1128A of the Social Security Act.
3. RELATION TO HIPAA- Penalties shall not be imposed both under this subsection and under the regulations issued pursuant to section 264(c)(1) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d-2 note) for a single act or omission.
4. EQUITABLE RELIEF-
  1. IN GENERAL- Without limiting remedies available to other parties, a civil action may be brought by any aggrieved individual to enjoin any act or practice that violates subsection (e) and to obtain other appropriate equitable relief (including reinstatement, back pay, and restoration of benefits) to redress such violation.
  2. AGAINST STATE EMPLOYEES- An entity that is a State or an agency of a State government may not assert the privilege described in subsection (a) unless before the time of the assertion, the entity or, in the case of and with respect to an agency, the State has consented to be subject to an action described in subparagraph (A), and that consent has remained in effect.
Rule of Construction- Nothing in this section shall be construed--
1. to limit the application of other Federal, State, or local laws that provide greater privilege or confidentiality protections than the privilege and confidentiality protections provided for in this section;
2. to limit, alter, or affect the requirements of Federal, State, or local law pertaining to information that is not privileged or confidential under this section;
3. except as provided in subsection (i), to alter or affect the implementation of any provision of the HIPAA confidentiality regulations or section 1176 of the Social Security Act (or regulations promulgated under such section);
4. to limit the authority of any provider, patient safety organization, or other entity to enter into a contract requiring greater confidentiality or delegating authority to make a disclosure or use in accordance with this section;
5. as preempting or otherwise affecting any State law requiring a provider to report information that is not patient safety work product; or
6. to limit, alter, or affect any requirement for reporting to the Food and Drug Administration information regarding the safety of a product or activity regulated by the Food and Drug Administration.
CLARIFICATION- Nothing in this part prohibits any person from conducting additional analysis for any purpose regardless of whether such additional analysis involves issues identical to or similar to those for which information was reported to or assessed by a patient safety organization or a patient safety evaluation system.
CLARIFICATION OF APPLICATION OF HIPAA CONFIDENTIALITY REGULATIONS TO PATIENT SAFETY ORGANIZATIONS- For purposes of applying the HIPAA confidentiality regulations--
1. patient safety organizations shall be treated as business associates; and
2. patient safety activities of such organizations in relation to a provider are deemed to be health care operations (as defined in such regulations) of the provider.
Reports on Strategies to Improve Patient Safety-
1. DRAFT REPORT- Not later than the date that is 18 months after any network of patient safety databases is operational, the Secretary, in consultation with the Director, shall prepare a draft report on effective strategies for reducing medical errors and increasing patient safety. The draft report shall include any measure determined appropriate by the Secretary to encourage the appropriate use of such strategies, including use in any federally funded programs. The Secretary shall make the draft report available for public comment and submit the draft report to the Institute of Medicine for review.
2. FINAL REPORT- Not later than 1 year after the date described in paragraph (1), the Secretary shall submit a final report to the Congress.

Return to Table of Contents
Return to Previous Section
Proceed to Next Section