Law Articles

Return to Law Dictionary Index

New Federal Patient Safety Law Leaves Many Issues Unresolved

Health Care Update
Mark Kadzielski

The Patient Safety and Quality Improvement Act of 2005 (PSQIA), signed into law on July 29, 2005, was enacted in response to the Institute of Medicine's 1999 report To Err is Human: Building a Safer Health System, which found that medical errors led to as many as 98,000 deaths each year in the United States. PSQIA establishes organizations to analyze medical error data reported by health care providers and protects voluntary provider reports from further disclosure. Those protections do not reduce the information already available to prosecutors, private litigants, and licensing and peer review bodies. While this new law solves certain problems, it raises many new questions.

The Key Players

* Patient Safety Organization (PSO):a private or public entity or component thereof whose PSO certification has been accepted by the Secretary of Health and Human Services (HHS).

PSOs collect and aggregate health care provider reports, analyze the aggregate data and propose measures to eliminate medical errors. Although PSOs must have more than one contract with reporting providers, PSQIA does not indicate if a contract is always required for a provider to report to the PSO.

* Provider: an individual (such as a physician, nurse practitioner or registered dietician) or entity (including a hospital, pharmacy, physician�s office or clinical laboratory) authorized by state law to provide health care services.

Providers are authorized to make voluntary reports to PSOs. However, PSQIA does not specify (1) which providers may report each medical error, (2) when reports may be made, (3) whether individual providers who are also employees of institutional providers may report on their own, or (4) how a provider determines to which PSO it will report.

The Key Information

* Patient Safety Evaluation System (PSES): the collection, management, or analysis of information for reporting to or by a PSO.

If a Provider can characterize its information-gathering functions as part of a PSES, it may be able to obtain PSQIA protection for such data.

* Patient Safety Work Product (PSWP): information in written or oral form that may result in improved patient safety, health care quality, or health care outcomes and is either (1) gathered by a Provider for PSO reporting and actually reported, or (2) developed by a PSO for patient safety activities. Information about the activities of a PSES, or that indicates a report has been made, is also PSWP.

PSWP does not include original patient or Provider records, or information that is collected, maintained, or developed separately, or exists separately, from a PSES. If separate information is reported to a PSO, it does not become PSWP by reason of that reporting.

The distinction between PSWP and �separate information,� and the explicit exclusion of non-PSWP from PSQIA protection are meant to preserve the status quo regarding information compiled by Providers as part of quality assurance, risk management, peer review, and other functions. Information gathered as part of those functions will not automatically be protected as PSWP simply because it is reported to a PSO.

The Key Protections

PSQIA defines PSWP and creates privilege and confidentiality protections for it. PSWP is "privileged" because it is not subject to discovery, may not be admitted as evidence in connection with any civil, criminal, or administrative action, and may not be disclosed pursuant to the Freedom of Information Act. PSWP is "confidential" because it "shall not be disclosed."

There are, however, a number of exceptions to these protections. PSWP may be disclosed (and used in a legal or administrative action): (1) in a criminal proceeding after in camera review, (2) if authorized by each of the Providers identified therein, and (3) in a proceeding against an employer for retaliating against an employee who reported PSWP. Additionally, PSWP may be disclosed (but not used in a legal or administrative action): (1) to carry out patient safety activities, (2) if it is non-identifiable, (3) for HHS-sanctioned research, (4) by a Provider to the Food and Drug Administration, (5) by a Provider to an accrediting body, (6) as HHS determines is necessary to carry out business operations, (7) to law enforcement authorities relating to the commission of a crime, and (8) to non-PSOs if the information does not include material that relates to an identifiable provider.

If PSWP is disclosed under these exceptions, the protection is not waived for subsequent disclosures. Also, in most cases a PSO cannot be compelled to disclose information obtained under these exceptions, unless the information is identified, is not PSWP, and is not available from another source.

The Key Problems

* Because reporting to PSOs is still voluntary, there is no guarantee that any reports will actually be made.
* Since certain information reported to PSOs has now been given legal protection under PSQIA, PSOs may pressure Providers to report a substantial amount of information beyond the PSWP that the Provider chose to report.
* Since the scope of the protection afforded PSWP is uncertain, Providers will likely remain hesitant to share their mistakes openly; thus, PSOs may prove to be ineffective.
* PSQIA�s broad definitions and imprecise provisions create too much ambiguity with regard to who should report, to whom reports should be made, who will have access to reported information, what information should be reported, the level of protection that various types of information will receive, what information is "separate," and what can be characterized as PSWP.
* PSQIA does not preempt more stringent laws that mandate the reporting of medical errors. In the approximately 22 states with mandatory error reporting, some, such as Colorado and Massachusetts , disclose the names of hospitals at which reported medical errors occur, while others, such as Florida and Texas, keep that data confidential. The different federal and state reporting procedures may result in confusing and inaccurate data.
* HHS may assess civil monetary penalties of up to $10,000 per violation for any person who knowingly or recklessly violates the confidentiality or privilege protections. Because the "knowing or reckless" standard requires a high degree of culpability, it is likely that few such penalties will be assessed.

Conclusion

These issues and many others will only be resolved as HHS, through regulations, and the courts clarify PSQIA. If you have any questions about PSQIA, please contact Mark A. Kadzielski at (213) 892-9306 or [email protected].

Return to Health Law

Return to Law Dictionary Index