---

Back to Patient Safety Organizations Home

[Continued from previous section]

Sec. 3.104 Secretarial actions.

1. Actions in response to certification submissions for initial and continued listing as a PSO.
   1. In response to an initial or continued certification submission by an entity, pursuant to the requirements of Sec. 3.102 of this subpart, the Secretary may--
      1. Accept the certification submission and list the entity as a PSO, or maintain the listing of a PSO, if the Secretary determines that the entity meets the applicable requirements of the Patient Safety Act and this subpart;
      2. Deny acceptance of a certification submission and, in the case of a currently listed PSO, remove the entity from the list if the entity does not meet the applicable requirements of the Patient Safety Act and this subpart; or
      3. Condition the listing of an entity, or continued listing of a PSO, following a determination made pursuant to paragraph (c) of this section.
   2. Basis of determination. In making a determination regarding listing, the Secretary will consider the certification submission; any prior actions by the Secretary regarding the entity or PSO including delisting; any history of or current non-compliance by the entity or the PSO with statutory or regulatory requirements or requests from the Secretary; the relationships of the entity or PSO with providers; and any findings made by the Secretary in accordance with paragraph (c) of this section.
   3. Notification. The Secretary will notify in writing each entity of action taken on its certification submission for initial or continued listing. The Secretary will provide reasons when an entity's certification is conditionally accepted and the entity is conditionally listed, when an entity's certification is not accepted and the entity is not listed, or when acceptance of its certification is revoked and the entity is delisted.
2. Actions regarding PSO compliance with the minimum contract requirement. When the Secretary receives notification required by Sec. 3.102(d)(1) of this subpart that the PSO has met the minimum contract requirement, the Secretary will acknowledge in writing receipt of the notification and add information to the list established pursuant to paragraph (d) of this section stating that the PSO has certified that it has met the requirement. If the PSO states that it has not yet met the minimum contract requirement, or if notice is not received by the date specified in Sec. 3.102(d)(1) of this subpart, the Secretary will issue to the PSO a notice of a preliminary finding of deficiency as specified in Sec. 3.108(a)(2) and establish a period for correction that extends until midnight of the last day of the PSO's applicable 24- month period of assessment. Immediately thereafter, if the requirement has not been met, the Secretary will provide the PSO a written notice of proposed revocation and delisting in accordance with Sec. 3.108(a)(3) of this subpart.
3. Actions regarding required disclosures by PSOs of relationships with contracting providers. The Secretary will review and make findings regarding each disclosure statement submitted by a PSO, pursuant to Sec. 3.102(d)(2) of this subpart, regarding its relationships with contracting provider(s), determine whether such findings warrant action regarding the listing of the PSO, and make the findings public.
   1. Basis of findings regarding PSO disclosure statements. In reviewing disclosure statements, submitted pursuant to Sec. 3.102(d)(2) of this subpart, the Secretary will consider the nature, significance, and duration of the disclosed relationship(s) between the PSO and the contracting provider and will determine whether the PSO can fairly and accurately perform the required patient safety activities.
   2. Determination by the Secretary. Based on the Secretary's review and findings, he may choose to take any of the following actions:
      1. For an entity seeking an initial or continued listing, the Secretary may list or continue the listing of an entity without conditions, list the entity subject to conditions, or deny the entity's certification for initial or continued listing; or
      2. For a listed PSO, the Secretary may determine that the entity will remain listed without conditions, continue the entity's listing subject to conditions, or remove the entity from listing.
   3. Release of disclosure statements and Secretarial findings.
      1. Subject to paragraph (c)(3)(ii) of this section, the Secretary will make disclosure statements available to the public along with related findings that are made available in accordance with paragraph (c) of this section.
      2. The Secretary may withhold information that is exempt from public disclosure under the Freedom of Information Act.
4. Maintaining a list of PSOs. The Secretary will compile and maintain a publicly available list of entities whose certifications as PSOs have been accepted. The list will include contact information for each entity, a copy of all certification forms and disclosure statements submitted by each entity, the effective date of the PSO's listing, and information on whether a PSO has certified that it has met the two-contract requirement. The list also will include a copy of the Secretary's findings regarding each disclosure statement submitted by an entity, information describing any related conditions that have been placed by the Secretary on the listing of an entity as a PSO, and other information that this Subpart states may be made public. AHRQ will establish a PSO Web site (or a comparable future form of public notice) and may post the list on this Web site.
5. Three-year period of listing.
   1. The period of listing of a PSO will be for a three-year period, unless the listing is revoked or relinquished prior to the expiration of the three-year period, in accordance with Sec. 3.108 of this subpart.
   2. The Secretary will send a written notice of imminent expiration to a PSO at least 45 calendar days prior to the date on which its three-year period of listing expires if the Secretary has not received a certification for continued listing.
6. Effective dates of Secretarial actions. Unless otherwise stated, the effective date of each action by the Secretary pursuant to this subpart will be specified in the written notice of such action that is sent to the entity. When the Secretary sends a notice that addresses acceptance or revocation of an entity's certifications or voluntary relinquishment by an entity of its status as a PSO, the notice will specify the effective date and time of listing or delisting.

Return to top

Sec. 3.106 Security requirements.

1. Application. A PSO must provide security for patient safety work product that conforms to the security requirements of paragraph (b) of this section. These requirements must be met at all times and at any location at which the PSO, its workforce members, or its contractors hold patient safety work product.
2. Security framework. PSOs must consider the following framework for the security of patient safety work product. The framework includes four elements: security management, separation of systems, security monitoring and control, and system assessment. To address the four elements of this framework, a PSO must develop appropriate and scalable security standards, policies, and procedures that are suitable for the size and complexity of its organization.
   1. Security management. A PSO must address:
1. Maintenance and effective implementation of written policies and procedures that conform to the requirements of this section to protect the confidentiality, integrity, and availability of the patient safety work product that is processed, stored, and transmitted; and to monitor and improve the effectiveness of such policies and procedures, and
2. Training of the PSO workforce and PSO contractors who access or hold patient safety work product regarding the requirements of the Patient Safety Act, this Part, and the PSO's policies and procedures regarding the confidentiality and security of patient safety work product.
2. Separation of Systems. A PSO must address:
1. Maintenance of patient safety work product, whether in electronic or other media, physically and functionally separate from any other system of records;
2. Protection of the media, whether in electronic, paper, or other format, that contain patient safety work product, limiting access to authorized users, and sanitizing and destroying such media before disposal or release for reuse; and
3. Physical and environmental protection, to control and limit physical and virtual access to places and equipment where patient safety work product is stored or used.
3. Security control and monitoring. A PSO must address:
1. Identification of those authorized to have access to patient safety work product and an audit capacity to detect unlawful, unauthorized, or inappropriate access to patient safety work product, and
2. Measures to prevent unauthorized removal, transmission or disclosure of patient safety work product.
4. Security assessment. A PSO must address:
   1. Periodic assessments of security risks and controls, as determined appropriate by the PSO, to establish if its controls are effective, to correct any deficiency identified, and to reduce or eliminate any vulnerabilities.
   2. System and communications protection, to monitor, control, and protect PSO uses, communications, and transmissions involving patient safety work product to and from providers and any other responsible persons.

Return to top

Sec. 3.108 Correction of deficiencies, revocation, and voluntary relinquishment.

1. Process for correction of a deficiency and revocation--
   1. Circumstances leading to revocation. The Secretary may revoke his acceptance of an entity's certification and delist the entity as a PSO if he determines--
      1. The PSO is not fulfilling the certifications it made to the Secretary that are set forth in Sec. 3.102 of this subpart;
      2. The PSO has not timely notified the Secretary that it has met the two contract requirement, as required by Sec. 3.102(d)(1) of this subpart;
      3. The Secretary, based on a PSO's disclosures made pursuant to Sec. 3.102(d)(2) of this subpart, makes a public finding that the entity cannot fairly and accurately perform the patient safety activities of a PSO; or
      4. The PSO is not in compliance with any other provision of the Patient Safety Act or this Part.
   2. Notice of preliminary finding of deficiency and establishment of an opportunity for correction of a deficiency.
   1. If the Secretary determines that a PSO is not in compliance with its obligations under the Patient Safety Act or this Subpart, the Secretary must send a PSO written notice of the preliminary finding of deficiency. The notice must state the actions or inactions that encompass the deficiency finding, outline the evidence that the deficiency exists, specify the possible and/or required corrective actions that must be taken, and establish a date by which the deficiency must be corrected. The Secretary may specify in the notice the level of documentation required to demonstrate that the deficiency has been corrected.
   2. The notice of a preliminary finding of deficiency is presumed received five days after it is sent, absent evidence of the actual receipt date. If a PSO does not submit evidence to the Secretary within 14 calendar days of actual or constructive receipt of such notice, whichever is longer, which demonstrates that the preliminary finding is factually incorrect, the preliminary finding will be the basis for a finding of deficiency.
   3. Determination of correction of a deficiency.
   1. Unless the Secretary specifies another date, the Secretary must receive documentation to demonstrate that the PSO has corrected the deficiency no later than five calendar days following the last day of the correction period, that is specified by the Secretary in the notice of preliminary finding of deficiency.
   2. In making a determination regarding the correction of any deficiency, the Secretary will consider the documentation submitted by the PSO, the findings of any site visit that he determines is necessary or appropriate, recommendations of program staff, and any other information available regarding the PSO that the Secretary deems appropriate and relevant to the PSO's implementation of the terms of its certification.
   3. After completing his review, the Secretary may make one of the following determinations:
      1. The action(s) taken by the PSO have corrected any deficiency, in which case the Secretary will withdraw the notice of deficiency and so notify the PSO;
      2. The PSO has acted in good faith to correct the deficiency but the Secretary finds an additional period of time is necessary to achieve full compliance and/or the required corrective action specified in the notice of a preliminary finding of deficiency needs to be modified in light of the experience of the PSO in attempting to implement the corrective action, in which case the Secretary will extend the period for correction and/or modify the specific corrective action required; or
      3. The PSO has not completed the corrective action because it has not acted with reasonable diligence or speed to ensure that the corrective action was completed within the allotted time, in which case the Secretary will issue to the PSO a notice of proposed revocation and delisting.
   4. When the Secretary issues a written notice of proposed revocation and delisting, the notice will specify the deficiencies that have not been timely corrected and will detail the manner in which the PSO may exercise its opportunity to be heard in writing to respond to the deficiencies specified in the notice.
   4. Opportunity to be heard in writing following a notice of proposed revocation and delisting. The Secretary will afford a PSO an opportunity to be heard in writing, as specified in paragraph (a)(4)(i) of this section, to provide a substantive response to the deficiency finding(s) set forth in the notice of proposed revocation and delisting.
   1. The notice of proposed revocation and delisting is presumed received five days after it is sent, absent evidence of actual receipt. The Secretary will provide a PSO with a period of time, beginning with the date of receipt of the notice of proposed revocation and delisting of which there is evidence, or the presumed date of receipt if there is no evidence of earlier receipt, and ending at midnight 30 calendar days thereafter, during which the PSO can submit a substantive response to the deficiency findings in writing.
   2. The Secretary will provide to the PSO rules of procedure governing the form or transmission of the written response to the notice of proposed revocation and delisting. The Rules may also be posted on the AHRQ PSO Web site or published in the Federal Register.
   3. If a PSO does not submit a written response to the deficiency finding(s) within 30 calendar days of receipt of the notice of proposed revocation and delisting, the notice of proposed revocation becomes final as a matter of law and the basis for Secretarial action under paragraph (b)(1) of this section.
   5. The Secretary's decision regarding revocation. The Secretary will review the entire administrative record pertaining to a notice of proposed revocation and delisting and any written materials submitted by the PSO under paragraph (a)(4) of this section. The Secretary may affirm, reverse, or modify the notice of proposed revocation and delisting and will make a determination with respect to the continued listing of the PSO.
2. Revocation of the Secretary's acceptance of a PSO's certifications--
   1. Establishing revocation for cause. When the Secretary concludes, in accordance with a decision made under paragraph (a)(5) of this section, that revocation of the acceptance of a PSO's certification is warranted for its failure to comply with requirements of the Patient Safety Act or of this Subpart, the Secretary will establish the time and date for the prompt revocation and removal of the entity from the list of PSOs, so notify the PSO in writing, and provide the relevant public notice required by Sec. 3.108(d) of this subpart.
   2. Required notification of providers and status of data. Within 15 days of being notified of the Secretary's action pursuant to paragraph (b)(1) of this section, an entity subject to paragraph (b)(1) of this section will submit to the Secretary confirmation that it has taken all reasonable actions to notify each provider, whose patient safety work product it collected or analyzed, of the Secretary's action(s). Confidentiality and privilege protections that applied to patient safety work product while the former PSO was listed continue to apply after the entity is removed from listing. Data submitted by providers to the former PSO within 30 calendar days of the date on which it is removed from the list of PSOs pursuant to paragraph (b)(1) of this section will have the same status as data submitted while the entity was still listed.
   3. Disposition of patient safety work product and data. Following revocation and delisting pursuant to paragraph (b)(1) of this section, the former PSO will take one or more of the following measures:
1. Transfer such patient safety work product or data, with the approval of the source from which it was received, to a PSO that has agreed to receive such patient safety work product or data;
2. Return such work product or data to the source from which it was submitted; or
3. If returning such patient safety work product or data to its source is not practicable, destroy such patient safety work product or data.
3. Voluntary relinquishment--
   1. Circumstances constituting voluntary relinquishment. A PSO will be considered to have voluntarily relinquished its status as a PSO if the Secretary accepts a notification from a PSO that it wishes to relinquish voluntarily its listing as a PSO or the Secretary determines that an implied voluntary relinquishment has taken place because the period of listing of a PSO has expired without receipt of a timely submission of certifications for continued listing.
   2. Notification of voluntary relinquishment. A PSO's notification of voluntary relinquishment to the Secretary must include the following:
1. An attestation that all reasonable efforts have been made, or will have been made by a PSO within 15 calendar days of this statement, to notify the sources from which it received patient safety work product or data of the PSO's intention to cease operations, to relinquish voluntarily its status as a PSO, to request that these other entities cease reporting or submitting any further information to the PSO as soon as possible, and inform them that any data submitted after the effective date and time of delisting, that the Secretary sets pursuant to paragraph (c)(3) of this section, will not be protected as patient safety work product under the Patient Safety Act based upon such submissions;
2. An attestation that the entity has established a plan, or within 15 calendar days of this statement, will have made all reasonable efforts to establish a plan, in consultation with the sources from which it received patient safety work product or data, that provides for the disposition of such patient safety work product or data consistent with, to the extent practicable, the statutory options for disposition of patient safety work product or data as set out in paragraphs (b)(3)(i) through (iii) of this section; and
3. Appropriate contact information for further communications from the Secretary.
3. Response to notification of voluntary relinquishment.
1. After a PSO provides the notification required by paragraph (c)(2) of this section, the Secretary will respond in writing to the entity indicating whether the proposed voluntary relinquishment of its PSO status is accepted. If the voluntary relinquishment is accepted, the Secretary's response will indicate an effective date and time for the entity's removal from the list of PSOs and will provide public notice of the delisting, in accordance with Sec. 3.108(d) of this subpart.
2. If the Secretary receives a notification of voluntary relinquishment during or immediately after revocation proceedings for cause under paragraphs (a)(4) and (a)(5) of this section, the Secretary, as a matter of discretion, may accept voluntary relinquishment in accordance with the preceding paragraph or decide not to accept the entity's proposed voluntary relinquishment and proceed with the revocation for cause and delisting pursuant to paragraph (b)(1) of this section.
4. Implied voluntary relinquishment.
1. If the period of listing of a PSO lapses without timely receipt and acceptance by the Secretary of a certification seeking continued listing or timely receipt of a notification of voluntary relinquishment of its PSO status in accordance with paragraph (c)(2) of this section, the Secretary will determine that voluntary relinquishment has occurred and will remove the entity from the list of PSOs effective as of midnight on the last day of its three-year period of listing. The Secretary will take reasonable measures to notify the entity of its delisting and will provide public notice of the delisting in accordance with Sec. 3.108(d) of this subpart.
2. The Secretary will request in the notice to the entity that it make reasonable efforts to comply with the requirements of paragraph (c)(2) of this section with respect to notification, appropriate disposition of patient safety work product, and the provision of contact information to the Secretary.
5. Non-applicability of certain procedures and requirements.
1. A decision by the Secretary to accept a request by a PSO to relinquish voluntarily its status as a PSO pursuant to paragraph (c)(2) of this section or a decision that voluntary relinquishment has occurred pursuant to paragraph (c)(4) of this section does not constitute a determination of a deficiency in PSO compliance with the Patient Safety Act or with this Subpart and no opportunity for corrective action by the PSO is required.
2. The procedures and requirements of Sec. 3.108(a) of this subpart regarding deficiencies including the opportunity to be heard in writing, and those that are based upon determinations of the Secretary pursuant to Sec. 3.108(b)(1) of this subpart are not applicable to determinations of the Secretary made pursuant to paragraph (c) of this section.
4. Public notice of delisting regarding removal from listing. If the Secretary removes an entity from the list of PSOs following revocation of acceptance of the entity's certification pursuant to Sec. 3.108(b)(1) of this subpart or following a determination of voluntary relinquishment pursuant to Sec. 3.108(c)(3) or (c)(4) of this subpart, the Secretary will promptly publish in the Federal Register and on the AHRQ PSO Web site, or in a comparable future form of public notice, established pursuant to Sec. 3.104(d) of this subpart, a notice of the actions taken and the effective dates.

Return to top

Sec. 3.110 Assessment of PSO compliance.

The Secretary may request information or conduct announced or unannounced reviews of or site visits to PSOs, to assess or verify PSO compliance with the requirements of this subpart and for these purposes will be allowed to inspect the physical or virtual sites maintained or controlled by the PSO. The Secretary will be allowed to inspect and/or be given or sent copies of any PSO records deemed necessary and requested by the Secretary to implement the provisions of this subpart. Such PSO records may include patient safety work product in accordance with Sec. 3.206(d) of this subpart.

Return to top

Sec. 3.112 Submissions and forms.

1. Forms referred to in this subpart may be obtained on the AHRQ PSO Web site or a comparable future form of public notice or by requesting them in writing by e-mail at psimplement@ahrq.hhs.gov, or by mail from the Agency for Healthcare Research and Quality, CQuIPS, PSO Liaison, 540 Gaither Road, Rockville, MD 20850. A form (including any required attachments) must be submitted in accordance with the accompanying instructions.
2. Information submitted to AHRQ in writing, but not required to be on a form, and requests for information from AHRQ, may be submitted by mail or other delivery to the Agency for Healthcare Research and Quality, CQuIPS, PSO Liaison, 540 Gaither Road, Rockville, MD 20850, by facsimile at (301) 427-1341, or by e-mail at psimplement@ahrq.hhs.gov.
3. If a submission to the Secretary is incomplete or additional information is needed to allow a determination to be made under this subpart, the submitter will be notified if any additional information is required.

Return to top

Subpart C--Confidentiality and Privilege Protections of Patient Safety Work Product

Sec. 3.204 Privilege of Patient Safety Work Product

1. Privilege. Notwithstanding any other provision of Federal, State, local, or tribal law and subject to paragraph (b) of this section and Sec. 3.208 of this subpart, patient safety work product shall be privileged and shall not be:
   1. Subject to a Federal, State, local, or tribal civil, criminal, or administrative subpoena or order, including in a Federal, State, local, or tribal civil or administrative disciplinary proceeding against a provider;
   2. Subject to discovery in connection with a Federal, State, local, or tribal civil, criminal, or administrative proceeding, including in a Federal, State, local, or tribal civil or administrative disciplinary proceeding against a provider;
   3. Subject to disclosure pursuant to section 552 of Title 5, United States Code (commonly known as the Freedom of Information Act) or any other similar Federal, State, local, or tribal law;
   4. Admitted as evidence in any Federal, State, local, or tribal governmental civil proceeding, criminal proceeding, administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such proceeding against a provider; or
   5. Admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under State law.
2. Exceptions to privilege. Privilege shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
   1. Disclosure of relevant patient safety work product for use in a criminal proceeding, subject to the conditions at Sec. 3.206(b)(1) of this subpart.
   2. Disclosure to the extent required to permit equitable relief subject to the conditions at Sec. 3.206(b)(2) of this subpart.
   3. Disclosure pursuant to provider authorizations subject to the conditions at Sec. 3.206(b)(3) of this subpart.
   4. Disclosure of non-identifiable patient safety work product subject to the conditions at Sec. 3.206(b)(5) of this subpart.
3. Implementation and Enforcement of the Patient Safety Act. Privilege shall not apply to (and shall not be construed to prohibit) disclosures of relevant patient safety work product to or by the Secretary if such patient safety work product is needed to investigate or determine compliance with this part or is needed in seeking or imposing civil money penalties, or in making or supporting PSO certification or listing decisions, under the Patient Safety Act.

Return to top
Return to Table of Contents
Return to previous section
Proceed to next section