The entities impacted by the PSQIA include patient safety organizations and providers.2  A provider is an individual or entity authorized under state law to provide health care services.3 This definition includes affiliated providers, which are legally separate providers that fall into one of three categories:4

• The parent organization of the provider;
• Entities under common ownership, management, or control with the provider; or
• Entities owned, managed, or controlled by the provider.

A patient safety organization, or PSO, is a public or private entity (or component thereof) listed by the Secretary of HHS (“the Secretary”) as a PSO.5  In order to be listed as a PSO, an entity must initially certify to the Secretary that it has policies and procedures in place necessary for performance of each of eight patient safety activities,6 and that it will comply with all other relevant criteria once listed as a PSO.7 The eight patient safety activities a PSO must be able to perform include:

• Efforts to improve patient safety and the quality of health care delivery;8
• The collection and analysis of patient safety work product;9
• The development and dissemination of information with respect to improving patient safety, such as recommendations, protocols, or information regarding best practices;10
• The utilization of PSWP for the purposes of encouraging a culture of safety and providing feedback and assistance to effectively minimize patient risk;11
• The maintenance of procedures to preserve confidentiality with respect to PSWP;12
• The provision of appropriate security measures with respect to PSWP;13
• The utilization of qualified staff;14 and
• Activities related to the operation of a patient safety evaluation system and to the provision of feedback to participants in a patient safety evaluation system.15

The additional criteria with which a PSO must comply include:

• Its mission and primary activity are to improve patient safety and the quality of health care delivery;16
• Has appropriately qualified staff, including licensed or certified medical professionals;17
• Has with more than one provider for the purpose of reviewing and receiving PSWP;18
• Fully disclose any financial, reporting, or contractual relationship between it and any provider with which it contracts;19
• Fully disclose, if applicable, the fact that it is not managed, controlled, and operated independently from any provider with which it contracts;20
• To the extent practicable, it collects PSWP from providers in a standardized manner that permits valid comparisons of similar cases among similar providers;21 and
• It utilizes PSWP for the purpose of providing direct feedback and assistance to providers to effectively minimize patient risk.22

Certain entities cannot be PSOs, including health insurance issuers and any affiliated divisions or entities.23  Components of certain non-qualifying organizations may be certified as a PSO if the component is part of any of the following organizations:24

·      Provider licensing or accrediting organizations;25

·      An entity or agent of an entity providing oversight/enforcement of statutory or regulatory requirements governing the delivery of health care services;26 and

·      An entity operating a Federal, state, local or Tribal patient safety reporting system to which health care providers are required to report information by law or regulation.27

In order to operate as a PSO, components of such organizations must meet all the certification requirements applicable to PSOs as well as satisfy the following requirements:28

• Certify that it maintains PSWP separately from the rest of its parent organization, and has established appropriate security measures to maintain the confidentiality of the work product;29
• Certify that members of its workforce and any other contractor staff will not  make an unauthorized disclosure to the rest of its parent organization in breach of confidentiality;30
• Certify that its mission does not create a conflict of interest with the rest of its parent organization;31 and
• Comply with additional required attestations, information and operational limitations,32 including not sharing staff with its parent organization,33 and submitting a statement describing the parent organization’s role and the scope of the parent organization’s authority with respect to a number of operational activities.34

Providers and PSOs participating in the program will operate patient safety evaluation systems, which collect, manage and/or analyze information for reporting to or by a PSO.35  The Secretary will maintain a network of patient safety databases that provides an interactive evidence-based management resource for providers, PSOs and other entities; the network will have the capacity to accept, aggregate across the network, and analyze non-identifiable PSWP voluntarily reported by PSOs, providers or other entities.36  Information reported to and among the network of patient safety databases will be used to analyze national and regional statistics, including trends and patterns of health care errors; the information resulting from such analyses will be made available to the public and included in annual quality reports.37

PSWP is privileged information, which means it is unavailable for disclosure in the following circumstances, subject to limited exceptions:

·      A judicial or administrative court subpoena or order;38

·      Discovery in connection with a judicial or administrative proceeding against a provider,39

·      Disclosure under the Freedom of Information Act40 or any similar Federal, State or local law;41 and/or

·      Admission as evidence in any civil, criminal or administrative proceeding,42 including a professional disciplinary.43

PSWP is also considered confidential and may not be disclosed, subject to limited exceptions.

In addition to the privilege and confidentiality requirements surrounding PSWP, a PSO cannot be compelled to disclose information it collects or develops, even if the information is not PSWP, unless such information is identified, is not PSWP, and is not reasonably available from another source.44  PSOs may, of course, be subject to any of the disclosure exceptions applicable to PSWP.45 Accrediting bodies may not take accrediting actions against providers who participate in the good faith collection, development, reporting, or maintenance of patient safety work product, and may not require providers to reveal their communications with any PSO.46  Employers may not take an adverse employment action47 against an individual based on the following:

• The individual in good faith reported information to the provider with the intent of having the information reported to a PSO;48 or
• The individual in good faith reported information directly to a PSO.49

Every PSO must comply with standard security requirements at all times and in any location in which the PSO, its workforce members, or its contractors receive, access, or handle PSWP.50  This requires maintaining policies and procedures that address a number of considerations, including all of the following:

·      Properly training workforce and contractors on security protocols and confidentiality measures;51

·      Distinguishing PSWP from non-PSWP;52

·      Protecting the media that contains PSWP;53

·      Employment of physical and environmental protections to control and limit physical and virtual access to places and equipment where PSWP is received, access, or handled;54

·      Proper identification of those authorized to receive, access or handle PSWP;55

·      Utilization of an audit to detect inappropriate receipt, access, or handling of PSWP;56

·      Implementation of methods to prevent unauthorized receipt, access or handling of PSWP;57 and

·      Conducting periodic security assessments to ensure that its security protocols are effective, to correct any identified deficiencies, and to reduce or eliminate any vulnerability.58

If an entity’s certification as a PSO is revoked, it must notify each provider whose PSWP was collected or analyzed of such revocation within fifteen days.59  For the first thirty days after removal from the accredited PSO list, any data submitted to the entity will remain protected under the relevant privilege and confidentiality requirements.60  If the privilege and confidentiality requirements applied to data while the entity was listed (or to data received within thirty days after its removal), those protections continue to apply after the entity is removed from the listing.61 A de-accredited entity must comply with the following requirements with respect to any data it receives within thirty days of its removal from the listing:

• The former PSO will transfer such work product or data to another PSO;62
• The former PSO will return such work product or data to whatever entity originally submitted it;63 or
• If returning the product or data to the original submitting entity is not practicable, the former PSO will destroy such work product or data.64

The privilege and confidentiality requirements surrounding PSWP are not applicable in certain situations; all PSWP may be disclosed when use of the PWSP falls into any of the following categories:

·      For use in a criminal proceeding if a court makes a determination in camera65 that the PSWP contains evidence of a criminal act, is material to the proceeding and is not reasonably available from any other source;66

·      To the extent necessary to carry out67 equitable relief in a civil action brought by any aggrieved individual to redress or enjoin an adverse employment action,68 if the court or administrative tribunal has issued a protective order to protect the confidentiality of PSWP in the course of the proceeding;69

·      When authorized by each identified provider70 via a signed writing that contains enough detail to fairly inform the provider(s) of the nature and scope of the disclosure being authorized;71

·      Voluntary disclosure of non-identifiable patient safety work product;72 and/or

·      To or by the Secretary in investigating or determining compliance, imposition of civil money penalties, or making or supporting decisions with respect to listing of a PSO,73 which may be subsequently disclosed by the Secretary for use by HHS in any of its activities and for use as evidence in any administrative or judicial proceeding.74

The following disclosures are exceptions only to the confidentiality requirements applicable to PSWP.  They are not available to circumvent the privilege requirements.  Disclosure of PSWP may occur in the following circumstances:

• To carry out patient safety activities75 when such disclosure is between a provider and a PSO,76 to a contractor of a provider or a PSO,77 or among affiliated providers;78
• To carry out patient safety activities when such disclosure is to another PSO or provider, if thirteen specific identifiers79 of any providers or affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce or household members of such providers are removed,80 and direct identifiers81 in any individually identifiable health information are removed;82
• If the PSWP is non-identifiable, whether voluntarily disclosed or not;83
• To entities carrying out research, evaluation, or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by the Secretary, for the purpose of conducting research;84
• By a provider to the FDA with respect to a product or activity regulated by the FDA;85
• Voluntary disclosure by a provider to an accrediting body that accredits that provider;86
• For business operations to attorneys, accounts and other professionals,87 or other business operations prescribed by the Secretary, if disclosure is consistent with the goals of patient safety improvement;88
• To law enforcement authorities relating to the commission of a crime (or to an event reasonably believed to be a crime), if the person making the disclosure reasonably believes, under the circumstances, that the disclosure is necessary for criminal law enforcement purposes;89
• The disclosure does not include materials that assess the quality of care of an identifiable provider,90 or do not include materials that describe or pertain to one or more actions or failures to act by an identifiable provider,91 if the entity or individual making the disclosure is not a PSO.92

In addition to these disclosure exceptions, a component PSO may provide individuals in or units of its parent organization with access to identifiable PSWP in the following situation:

·      There is an agreement that access to such work product will be limited to what is necessary to assist the component in the conduct of patient safety activities;93 and

·      Those given access will not use or disclose such information beyond what is required to assist the component PSO, will take appropriate security measures to prevent unauthorized disclosures, and will comply with the general certifications the component PSO made regarding unauthorized disclosures.94

If any PSWP is disclosed via an authorized exception, the PSWP will continue to be confidential and privileged after such disclosure, and the confidentiality and privilege requirements will apply in equal measure to the person to whom the information was disclosed.95  However, if the PSWP is disclosed in accordance with the exception provided for criminal proceedings, the confidentiality protection will no longer apply to the PSWP.96  Additionally, if the PSWP disclosed is non-identifiable, neither the privilege nor the confidentiality protections will continue to apply to the non-identifiable PSWP.97