NPRM February 12, 2008 (Volume 73, Number 29) [Page 8111-8183]

Back to Patient Safety Organizations Home

[Continued from previous section]

Sec. 3.206 Confidentiality of Patient Safety Work Product.

Confidentiality. Subject to paragraphs (b) through (e) of this section, and Sec. Sec. 3.208 and 3.210 of this subpart, patient safety work product shall be confidential and shall not be disclosed.
Exceptions to confidentiality. The confidentiality provisions shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
1. Criminal proceedings. Disclosure of relevant patient safety work product for use in a criminal proceeding, but only after a court makes an in camera determination that:
  1. Such patient safety work product contains evidence of a criminal act;
  2. Such patient safety work product is material to the proceeding; and
  3. Such patient safety work product is not reasonably available from any other source.
2. Equitable relief for reporters. Disclosure of patient safety work product to the extent required to permit equitable relief under section 922 (f)(4)(A) of the Public Health Service Act.
3. Authorized by identified providers.
  1. Disclosure of identifiable patient safety work product consistent with a valid authorization if such authorization is obtained from each provider identified in such work product prior to disclosure. A valid authorization must:
    1. Be in writing and signed by the provider from whom authorization is sought; and
    2. Contain sufficient detail to fairly inform the provider of the nature and scope of the disclosures being authorized;
  2. A valid authorization must be retained by the disclosing entity for six years from the date of the last disclosure made in reliance on the authorization and made available to the Secretary upon request.
4. Patient safety activities--
  1. Disclosure between a provider and a PSO. Disclosure of patient safety work product for patient safety activities by a provider to a PSO or by a PSO to that disclosing provider.
  2. Disclosure to a contractor of a provider or a PSO. A provider or a PSO may disclose patient safety work product for patient safety activities to an entity with which it has contracted to undertake patient safety activities on its behalf. A contractor receiving patient safety work product for patient safety activities may not further disclose patient safety work product, except to the entity with which it is contracted.
  3. Disclosure by a PSO to another PSO or by a provider to another provider. Disclosure of patient safety work product for patient safety activities by a PSO to another PSO or to another provider that has reported to the PSO, or by a provider to another provider, provided:
    1. The following direct identifiers of any providers and of affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce, or household members of such providers are removed:
      1. Names;
      2. Postal address information, other than town or city, State and zip code;
      3. Telephone numbers;
      4. Fax numbers;
      5. Electronic mail addresses;
      6. Social security numbers or taxpayer identification numbers;
      7. Provider or practitioner credentialing or DEA numbers;
      8. National provider identification number;
      9. Certificate/license numbers;
      10. Web Universal Resource Locators (URLs);
      11. Internet Protocol (IP) address numbers;
      12. Biometric identifiers, including finger and voice prints; and
      13. Full face photographic images and any comparable images; and
    2. With respect to any individually identifiable health information in such patient safety work product, the direct identifiers listed at 45 CFR 164.514(e)(2) have been removed.
5. Disclosure of nonidentifiable patient safety work product. Disclosure of nonidentifiable patient safety work product when patient safety work product meets the standard for nonidentification in accordance with Sec. 3.212 of this subpart.
6. For research.
  1. Disclosure of patient safety work product to persons carrying out research, evaluation or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by the Secretary, for the purpose of conducting research.
  2. If the patient safety work product disclosed pursuant to paragraph (b)(6)(i) of this section is by a HIPAA covered entity as defined at 45 CFR 160.103 and contains protected health information as defined by the HIPAA Privacy Rule at 45 CFR 160.103, such patient safety work product may only be disclosed under this exception in the same manner as would be permitted under the HIPAA Privacy Rule at 45 CFR 164.512(i).
7. To the Food and Drug Administration (FDA).
  1. Disclosure by a provider of patient safety work product concerning an FDA-regulated product or activity to the FDA or to an entity required to report to the FDA concerning the quality, safety, or effectiveness of an FDA-regulated product or activity.
  2. The FDA and any entity receiving patient safety work product pursuant to paragraph (b)(7)(i) of this section may only further disclose such patient safety work product for the purpose of evaluating the quality, safety, or effectiveness of that product or activity between each other, their contractors, and the disclosing provider. A contractor receiving patient safety work product pursuant to this paragraph may not further disclose patient safety work product, except to the entity from which it received the patient safety work product.
8. Voluntary disclosure to an accrediting body.
  1. Voluntary disclosure by a provider of patient safety work product that identifies that provider to an accrediting body that accredits that provider. Such accrediting body may not further disclose such patient safety work product.
  2. An accrediting body may not take an accrediting action against a provider based on a good faith participation of the provider in the collection, development, reporting, or maintenance of patient safety work product in accordance with this Part. An accrediting body may not require a provider to reveal its communications with any PSO.
9. Business operations.
  1. Disclosure of patient safety work product by a provider or a PSO for business operations to attorneys, accountants, and other professionals. Such contractors may not further disclose patient safety work product, except to the entity from which they received the information.
  2. Disclosure of patient safety work product for such other business operations that the Secretary may prescribe by regulation as consistent with the goals of this part.
10. Disclosure to law enforcement.
  1. Disclosure of patient safety work product to an appropriate law enforcement authority relating to an event that either constitutes the commission of a crime, or for which the disclosing person reasonably believes constitutes the commission of a crime, provided that the disclosing person believes, reasonably under the circumstances, that the patient safety work product that is disclosed is necessary for criminal law enforcement purposes.
  2. Law enforcement personnel receiving patient safety work product pursuant to paragraph (b)(10)(i) of this section may disclose that patient safety work product to other law enforcement authorities as needed for law enforcement activities related to the event that gave rise to the disclosure under paragraph (b)(10)(i) of this section.
Safe harbor. A provider or responsible person, but not a PSO, is not considered to have violated the requirements of this subpart if a member of its workforce discloses patient safety work product, provided that the disclosure does not include materials, including oral statements, that:
1. Assess the quality of care of an identifiable provider; or
2. Describe or pertain to one or more actions or failures to act by an identifiable provider.
Implementation and Enforcement of the Patient Safety Act. The confidentiality provisions shall not apply to (and shall not be construed to prohibit) disclosures of relevant patient safety work product to or by the Secretary if such patient safety work product is needed to investigate or determine compliance with this part or is needed in seeking and imposing civil money penalties, or in making or supporting PSO certification or listing decisions, under the Patient Safety Act.
No limitation on authority to limit or delegate disclosure or use. Nothing in subpart C of this part shall be construed to limit the authority of any person to enter into a contract requiring greater confidentiality or delegating authority to make a disclosure or use in accordance with this subpart.

Return to top

Sec. 3.208 Continued protection of Patient Safety Work Product.

Except as provided in paragraph (b) of this section, patient safety work product disclosed in accordance with this subpart, or disclosed impermissibly, shall continue to be privileged and confidential.
1. Patient safety work product disclosed for use in a criminal proceeding pursuant to section 922(c)(1)(A) of the Public Health Service Act and/or pursuant to Sec. 3.206(b)(1) of this subpart continues to be privileged, but is no longer confidential.
2. Non-identifiable patient safety work product that is disclosed is no longer privileged or confidential and not subject to the regulations under this part. (3) Paragraph (b) of this section applies only to the specific patient safety work product disclosed.

Return to top

Sec. 3.210 Required disclosure of Patient Safety Work Product to the Secretary.

Providers, PSOs, and responsible persons must disclose patient safety work product upon request by the Secretary when the Secretary determines such patient safety work product is needed to investigate or determine compliance with this part or is needed in seeking and imposing civil money penalties or making determinations on certifying and listing PSOs.

Return to top

Sec. 3.212 Nonidentification of Patient Safety Work Product.

Patient safety work product is nonidentifiable with respect to a particular identified provider or a particular identified reporter if:
1. A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:
  1. Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an identified provider or reporter; and
  2. Documents the methods and results of the analysis that justify such determination; or
2. 1. The following identifiers of such provider or reporter and of affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce, or household members of such providers or reporters are removed:
    1. Names;
    2. Geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code and equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census, the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people;
    3. All elements of dates (except year) for dates directly related to a patient safety incident or event;
    4. Telephone numbers;
    5. Fax numbers;
    6. Electronic mail addresses;
    7. Social security numbers or taxpayer identification numbers;
    8. Provider or practitioner credentialing or DEA numbers;
    9. National provider identification number;
    10. Certificate/license numbers;
    11. Web Universal Resource Locators (URLs);
    12. Internet Protocol (IP) address numbers;
    13. Biometric identifiers, including finger and voice prints;
    14. Full face photographic images and any comparable images; and,
    15. Any other unique identifying number, characteristic, or code except as permitted for re-identification; and
  2. The provider, PSO or responsible person making the disclosure does not have actual knowledge that the information could be used, alone or in combination with other information that is reasonably available to the intended recipient, to identify the particular provider or reporter.
3. Re-identification. A provider, PSO, or responsible person may assign a code or other means of record identification to allow information made nonidentifiable under this section to be re-identified by such provider, PSO, or responsible person, provided that:
  1. The code or other means of record identification is not derived from or related to information about the provider or reporter and is not otherwise capable of being translated so as to identify the provider or reporter; and
  2. The provider, PSO, or responsible person does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.
Patient safety work product is non-identifiable with respect a particular patient only if the individually identifiable health information regarding that patient is de-identified in accordance with the HIPAA Privacy Rule standard and implementation specifications for the de-identification at 45 CFR 164.514 (a) through (c).

Return to top

Subpart D--Enforcement Program

Sec. 3.304 Principles for achieving compliance.

Cooperation. The Secretary will, to the extent practicable, seek the cooperation of providers, PSOs, and responsible persons in obtaining compliance with the applicable confidentiality provisions.
Assistance. The Secretary may provide technical assistance to providers, PSOs, and responsible persons to help them comply voluntarily with the applicable confidentiality provisions.

Return to top

Sec. 3.306 Complaints to the Secretary.

Right to file a complaint. A person who believes that patient safety work product has been disclosed in violation of the confidentiality provisions may file a complaint with the Secretary.
Requirements for filing complaints. Complaints under this section must meet the following requirements:
1. A complaint must be filed in writing, either on paper or electronically.
2. A complaint must name the person that is the subject of the complaint and describe the act(s) believed to be in violation of the applicable confidentiality provision(s).
3. A complaint must be filed within 180 days of when the complainant knew or should have known that the act complained of occurred, unless this time limit is waived by the Secretary for good cause shown.
4. The Secretary may prescribe additional procedures for the filing of complaints, as well as the place and manner of filing, by notice in the Federal Register.
Investigation. The Secretary may investigate complaints filed under this section. Such investigation may include a review of the pertinent policies, procedures, or practices of the respondent and of the circumstances regarding any alleged violation. At the time of initial written communication with the respondent about the complaint, the Secretary will describe the act(s) that are the basis of the complaint.

Return to top

Sec. 3.308 Compliance reviews.

The Secretary may conduct compliance reviews to determine whether a respondent is complying with the applicable confidentiality provisions.

Return to top

Sec. 3.310 Responsibilities of respondents.

Provide records and compliance reports. A respondent must keep such records and submit such compliance reports, in such time and manner and containing such information, as the Secretary may determine to be necessary to enable the Secretary to ascertain whether the respondent has complied or is complying with the applicable confidentiality provisions.
Cooperate with complaint investigations and compliance reviews. A respondent must cooperate with the Secretary, if the Secretary undertakes an investigation or compliance review of the policies, procedures, or practices of the respondent to determine whether it is complying with the applicable confidentiality provisions. (c) Permit access to information.
1. A respondent must permit access by the Secretary during normal business hours to its facilities, books, records, accounts, and other sources of information, including patient safety work product, that are pertinent to ascertaining compliance with the applicable confidentiality provisions. If the Secretary determines that exigent circumstances exist, such as when documents may be hidden or destroyed, a respondent must permit access by the Secretary at any time and without notice.
2. If any information required of a respondent under this section is in the exclusive possession of any other agency, institution, or person, and the other agency, institution, or person fails or refuses to furnish the information, the respondent must so certify and set forth what efforts it has made to obtain the information.

Return to top

Sec. 3.312 Secretarial action regarding complaints and compliance reviews.

Resolution when noncompliance is indicated.
1. If an investigation of a complaint pursuant to Sec. 3.306 of this subpart or a compliance review pursuant to Sec. 3.308 of this subpart indicates noncompliance, the Secretary may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means. Informal means may include demonstrated compliance or a completed corrective action plan or other agreement.
2. If the matter is resolved by informal means, the Secretary will so inform the respondent and, if the matter arose from a complaint, the complainant, in writing.
3. If the matter is not resolved by informal means, the Secretary will--
  1. So inform the respondent and provide the respondent an opportunity to submit written evidence of any mitigating factors. The respondent must submit any evidence to the Secretary within 30 days (computed in the same manner as prescribed under Sec. 3.504(l) of this subpart) of receipt of such notification; and
  2. If, following action pursuant to paragraph (a)(3)(i) of this section, the Secretary decides that a civil money penalty should be imposed, inform the respondent of such finding in a notice of proposed determination in accordance with Sec. 3.420 of this subpart.
Resolution when no violation is found. If, after an investigation pursuant to Sec. 3.306 of this subpart or a compliance review pursuant to Sec. 3.308 of this subpart, the Secretary determines that further action is not warranted, the Secretary will so inform the respondent and, if the matter arose from a complaint, the complainant, in writing.
Uses and disclosures of information obtained.
1. Identifiable patient safety work product obtained by the Secretary in connection with an investigation or compliance review under this subpart will not be disclosed by the Secretary, except in accordance with Sec. 3.206(d) of this subpart, or if otherwise permitted by this part or the Patient Safety Act.
2. Except as provided for in paragraph (c)(1) of this section, information, including testimony and other evidence, obtained by the Secretary in connection with an investigation or compliance review under this subpart may be used by HHS in any of its activities and may be used or offered into evidence in any administrative or judicial proceeding.

Return to top

Sec. 3.314 Investigational subpoenas and inquiries.

The Secretary may issue subpoenas in accordance with 42 U.S.C. 405(d) and (e), and 1320a-7a(j), to require the attendance and testimony of witnesses and the production of any other evidence including patient safety work product during an investigation or compliance review pursuant to this part. The Secretary will issue and serve subpoenas pursuant to this subpart in accordance with 45 CFR 160.314(a)(1) through (5), except the term "this part" shall refer to 42 CFR part 3.
Investigational inquiries are non-public investigational proceedings conducted by the Secretary. The Secretary will conduct investigational proceedings in accordance with 45 CFR 160.314(b)(1) through (9).

Return to top

Sec. 3.402 Basis for a civil money penalty.

General rule. A person who discloses identifiable patient safety work product in knowing or reckless violation of the confidentiality provisions shall be subject to a civil money penalty for each act constituting such violation.
Violation attributed to a principal. A principal is independently liable, in accordance with the federal common law of agency, for a civil money penalty based on the act of the principal's agent, including a workforce member, acting within the scope of the agency if such act could give rise to a civil money penalty in accordance with Sec. 3.402(a) of this subpart.

Return to top

Sec. 3.404 Amount of a civil money penalty.

The amount of a civil money penalty will be determined in accordance with paragraph (b) of this section and Sec. 3.408 of this subpart.
The Secretary may impose a civil money penalty in the amount of not more than $10,000.

Return to top

Sec. 3.408 Factors considered in determining the amount of a civil money penalty.

In determining the amount of any civil money penalty, the Secretary may consider as aggravating or mitigating factors, as appropriate, any of the following:

The nature of the violation.
The circumstances, including the consequences, of the violation, including:
1. The time period during which the violation(s) occurred; and
2. Whether the violation caused physical or financial harm or reputational damage;
The degree of culpability of the respondent, including:
1. Whether the violation was intentional; and
2. Whether the violation was beyond the direct control of the respondent.
Any history of prior compliance with the Patient Safety Act, including violations, by the respondent, including:
1. Whether the current violation is the same or similar to prior violation(s);
2. Whether and to what extent the respondent has attempted to correct previous violations;
3. How the respondent has responded to technical assistance from the Secretary provided in the context of a compliance effort; and
4. How the respondent has responded to prior complaints.
The financial condition of the respondent, including:
1. Whether the respondent had financial difficulties that affected its ability to comply;
2. Whether the imposition of a civil money penalty would jeopardize the ability of the respondent to continue to provide health care or patient safety activities; and
3. The size of the respondent.
Such other matters as justice may require.

Return to top

Sec. 3.414 Limitations.

No action under this subpart may be entertained unless commenced by the Secretary, in accordance with Sec. 3.420 of this subpart, within 6 years from the date of the occurrence of the violation.

Return to top

Sec. 3.416 Authority to settle.

Nothing in this subpart limits the authority of the Secretary to settle any issue or case or to compromise any penalty.

Return to top

Sec. 3.418 Exclusivity of penalty.

(a) Except as otherwise provided by paragraph (b) of this section, a penalty imposed under this part is in addition to any other penalty prescribed by law. (b) Civil money penalties shall not be imposed both under this part and under the HIPAA Privacy Rule (45 CFR parts 160 and 164).

Return to top

Sec. 3.420 Notice of proposed determination.

If a penalty is proposed in accordance with this part, the Secretary must deliver, or send by certified mail with return receipt requested, to the respondent, written notice of the Secretary's intent to impose a penalty. This notice of proposed determination must include:
1. Reference to the statutory basis for the penalty;
2. A description of the findings of fact regarding the violations with respect to which the penalty is proposed;
3. The reason(s) why the violation(s) subject(s) the respondent to a penalty;
4. The amount of the proposed penalty;
5. Any factors described in Sec. 3.408 of this subpart that were considered in determining the amount of the proposed penalty; and
6. Instructions for responding to the notice, including a statement of the respondent's right to a hearing, a statement that failure to request a hearing within 60 days permits the imposition of the proposed penalty without the right to a hearing under Sec. 3.504 of this subpart or a right of appeal under Sec. 3.504(v) of this subpart, and the address to which the hearing request must be sent.
The respondent may request a hearing before an ALJ on the proposed penalty by filing a request in accordance with Sec. 3.504 of this subpart.

Return to top

Sec. 3.422 Failure to request a hearing.

If the respondent does not request a hearing within the time prescribed by Sec. 3.504 of this subpart and the matter is not settled pursuant to Sec. 3.416 of this subpart, the Secretary may impose the proposed penalty or any lesser penalty permitted by 42 U.S.C. 299b-21 through 299b-26. The Secretary will notify the respondent by certified mail, return receipt requested, of any penalty that has been imposed and of the means by which the respondent may satisfy the penalty, and the penalty is final on receipt of the notice. The respondent has no right to appeal a penalty under Sec. 3.504(v) of this subpart with respect to which the respondent has not timely requested a hearing.

Return to top

Sec. 3.424 Collection of penalty.

Once a determination of the Secretary to impose a penalty has become final, the penalty will be collected by the Secretary in accordance with 45 CFR 160.424, except the term "this part" shall refer to 42 CFR Part 3.

Return to top

Sec. 3.426 Notification of the public and other agencies.

Whenever a proposed penalty becomes final, the Secretary will notify, in such manner as the Secretary deems appropriate, the public and the following organizations and entities thereof and the reason it was imposed: The appropriate State or local medical or professional organization, the appropriate State agency or agencies administering or supervising the administration of State health care programs (as defined in 42 U.S.C. 1320a-7(h)), the appropriate utilization and quality control peer review organization, and the appropriate State or local licensing agency or organization (including the agency specified in 42 U.S.C. 1395aa(a), 1396a(a)(33)).

Return to top

Sec. 3.504 Procedures for hearings.

Hearings before an ALJ. A respondent may request a hearing before an ALJ. Hearings must be requested in accordance with 45 CFR 160.504(a) through (c), except the language in paragraph (c) following and including "except that" shall not apply. The ALJ must dismiss a hearing request in accordance with 45 CFR 160.504(d).
Rights of the parties. The hearing rights of the parties will be determined in accordance with 45 CFR 160.506.
Authority of the ALJ. The ALJ will conduct a fair and impartial hearing in accordance with 45 CFR 160.508(a) through (c)(4).
Ex parte contacts. Ex parte contacts are prohibited in accordance with 45 CFR 160.510.
Prehearing conferences. Prehearing conferences will be conducted in accordance with 45 CFR 160.512, except the term "identifiable patient safety work product" shall apply in place of the term "individually identifiable health information."
Authority to settle. The Secretary has authority to settle issues in accordance with 45 CFR 160.514.
Discovery. Discovery will proceed in accordance with 45 CFR 160.516.
Exchange of witness lists, witness statements, and exhibits. The parties will exchange hearing material in accordance with 45 CFR 160.518, except the language in paragraph (a) following and including "except that" shall not apply.
Subpoenas for attendance at hearing. The ALJ will issue a subpoena for the appearance and testimony of any person at the hearing in accordance with 45 CFR 160.520.
Fees. Fees and mileage for subpoenaed witnesses will be paid in accordance with 45 CFR 160.522.
Form, filing, and service of papers. Hearing documents will be filed and serviced in accordance with 45 CFR 160.524.
Computation of time. Computation of time shall be in accordance with 45 CFR 160.526, except the term "this subpart" shall refer to 42 CFR part 3, Subpart D, and the citation "Sec. 3.504(a) of 42 CFR part 3" shall apply in place of the citation "Sec. 160.504."
Motions. Procedures for the filing and disposition of motions will be in accordance with 45 CFR 160.528.
Sanctions. The ALJ may sanction a person in accordance with authorities at 45 CFR 160.530.
Collateral estoppel. Collateral estoppel will apply to hearings conducted pursuant to this subpart in accordance with 45 CFR 160.532, except the term "a confidentiality provision" shall apply in place of the term "an administrative simplification provision."
The hearing. Hearings will be conducted in accordance with 45 CFR 160.534, except the following text shall apply in place of Sec. 160.534(b)(1): "The respondent has the burden of going forward and the burden of persuasion with respect to any challenge to the amount of a proposed penalty pursuant to Sec. Sec. 3.404-3.408 of 42 CFR part 3, including any factors raised as mitigating factors." Good cause shown under 45 CFR 160.534(c) may be that identifiable patient safety work product has been introduced into evidence or is expected to be introduced into evidence.
Witnesses. The testimony of witnesses will be handled in accordance with 45 CFR 160.538, except that the citation "Sec. 3.504(h) of 42 CFR part 3" shall apply in place of the citation "Sec. 160.518."
Evidence. The ALJ will determine the admissibility of evidence in accordance with 45 CFR 160.540, except that the citation "Sec. 3.420 of 42 CFR part 3" shall apply in place of the citation "Sec. 160.420 of this part."
The record. The record of the hearing will be created and made available in accordance with 45 CFR 160.542. Good cause under 45 CFR 160.542(c) through (d) may include the presence in the record of identifiable patient safety work product.
Post hearing briefs. Post-hearing briefs, if required by the ALJ, will be filed in accordance with 45 CFR 160.544.
ALJ's decision. The ALJ will issue a decision in accordance with 45 CFR 160.546, except the citation "Sec. 3.504(v) of 42 CFR part 3" shall apply in place of "Sec. 160.548."
Appeal of the ALJ's decision. Any party may appeal the decision of the ALJ in accordance with 45 CFR 160.548, except the following language in paragraph (e) shall not apply: "Except for an affirmative defense under Sec. 160.410(b)(1) of this part."
Stay of the Secretary's decision. Pending judicial review, a stay of the Secretary's decision may be requested in accordance with 45 CFR 160.550.
Harmless error. Harmless errors will be handled in accordance with 45 CFR 160.552.

Return to top
Return to Table of Contents
Return to previous section

Dated: October 7, 2007.

Michael O. Leavitt,
Secretary, Department of Health and Human Services.

[FR Doc. E8-2375 Filed 2-11-08; 8:45 am]
BILLING CODE 4153-01-P