Patient Safety and Quality Improvement Act of 2005-HHS Guidance Regarding Patient Safety Work Product and Providers' External Obligations

AGENCY:

Agency for Healthcare Research and Quality (AHRQ), Office for Civil Rights (OCR), Department of Health and Human Services (HHS).

ACTION:

Guidance on Patient Safety and Quality Improvement Act of 2005.

SUMMARY:

This guidance sets forth guidance for patient safety organizations (PSOs) and providers regarding questions that have arisen about the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. 299b-21—b-26 (Patient Safety Act), and its implementing regulation, the Patient Safety and Quality Improvement Final Rule, 42 CFR part 3 (Patient Safety Rule). In particular, this Patient Safety and Quality Improvement Act of 2005—Guidance Regarding Patient Safety Work Product and Providers' External Obligations (Guidance) is intended to clarify what information that a provider creates or assembles can become patient safety work product (PSWP) in response to recurring questions. This Guidance also clarifies how providers can satisfy external obligations related to information collection activities consistent with the Patient Safety Act and Patient Safety Rule.

DATES:

The Guidance is effective on May 24, 2016.

ADDRESSES:

The Guidance can be accessed electronically at the following HHS Web site: http://www.pso.ahrq.gov.

FOR FURTHER INFORMATION CONTACT:

Susan Grinder, Center for Quality Improvement and Patient Safety, AHRQ, 5600 Fishers Lane, Mail Stop 06N100B, Rockville, MD 20857; Telephone (301) 427-1327; Email: Susan.Grinder@AHRQ.hhs.gov.

SUPPLEMENTARY INFORMATION:

Background

HHS issued the Patient Safety Rule to implement the Patient Safety Act. AHRQ administers the provisions of the Act and Rule relating to the listing and operation of PSOs. OCR, within HHS, is responsible for interpretation, administration and enforcement of the confidentiality protections and disclosure permissions of the Patient Safety Act and Patient Safety Rule.

HHS Approach to Patient Safety Act Interpretation

The Patient Safety Act is part of a larger framework envisioned by the Institute of Medicine and designed to balance two goals: 1) To improve patient safety and reduce medical errors by creating a “culture of safety” to share and learn from information related to patient safety events, and 2) to promote health care providers' accountability and transparency through mechanisms such as oversight by regulatory agencies and adjudication in the legal system. As discussed in “To Err Is Human,” in respect to reporting systems, “they can hold providers accountable for performance or, alternatively, they can provide information that leads to improved safety. Conceptually, these purposes are not incompatible, but in reality, they can prove difficult to satisfy simultaneously.”

The Patient Safety Act promotes the goal of improving patient safety and reducing medical errors by establishing a system in which health care providers can voluntarily collect and report information related to patient safety, health care quality, and health care outcomes to PSOs. The PSOs aggregate and analyze this information and give feedback to the providers to encourage learning and prevent future errors. The providers are motivated to report such information to PSOs because the Patient Safety Act provides broad privilege and confidentiality protections for information meeting the definition of PSWP, which alleviates concerns about such information being used against a provider, such as in litigation.

At the same time, providers are subject to legitimate external obligations regarding certain records about patient safety to ensure their accountability and transparency. For example, the Centers for Medicare & Medicaid Services (CMS) Hospital Condition of Participation (CoP) for Quality Assessment and Performance Improvement require hospitals to track adverse patient events. State health care regulatory agencies typically have their own separate requirements for different types of providers, with more than half of the states operating adverse event reporting systems. The legal system provides another course to pursue accountability for medical errors. If a patient is injured while under a provider's care, the tort system offers an avenue to compensate the patient for his injury. However, while a successful medical malpractice claim may help compensate one patient for his specific injury, the general threat of litigation provides a disincentive to providers from voluntarily sharing information about their mistakes.

The intent of the system established by the Patient Safety Act is to protect the additional information created through voluntary patient safety activities, not to protect records created through providers' mandatory information collection activities. For example, a provider may have an external obligation to maintain certain records about serious adverse events that result in patient harm. The document the provider prepares to meet its requirement about such adverse events is not PSWP. As such, the Patient Safety Act recognizes the goal of accountability and transparency, and it attempts to balance this goal with that of improving patient safety and reducing medical errors. While Congress was aware of the chilling effect the fear of being sued had on providers, the Patient Safety Act was not designed to prevent patients who believed they were harmed from obtaining the records about their care that they were able to obtain prior to the enactment of the Patient Safety Act. Nor was the Patient Safety Act intended to insulate providers from demonstrating accountability through fulfilling their external obligations. Therefore, when interpreting the Patient Safety Act and Patient Safety Rule, HHS does so with the objective of maintaining balance between these two policy goals, consistent with the intent of the Patient Safety Act.

How Information Becomes PSWP

Both the Notice of Proposed Rulemaking (NPRM) and the Preamble to the Patient Safety Rule (Preamble) discuss the definition of PSWP and provide examples of what information would and would not meet the definition. Because there continues to be confusion about this definition, the prior discussion will be reiterated and further clarified here. The definition of PSWP sets forth three basic ways that certain information can become PSWP: (1) The information is prepared by a provider for reporting to a PSO and it is reported to the PSO, (2) the information is developed by a PSO for the conduct of patient safety activities, or, (3) the information identifies or constitutes the deliberations or analysis of, or identifies the fact of reporting pursuant to, a patient safety evaluation system (PSES). The first way—sometimes referred to as the “reporting pathway”—is how providers generally create most of their PSWP. According to the Patient Safety Act, in order for information to become PSWP through the reporting pathway, it must be information that could improve patient safety, health care quality, or health care outcomes and be assembled or developed by a provider for reporting to a PSO and be reported to a PSO. Another way of saying that the information is assembled or developed for reporting to a PSO is that the information is prepared for the purpose of reporting it to the PSO. Under the Patient Safety Rule, the reporting pathway allows for information that is documented as collected within the provider's PSES to be PSWP and thus privileged and confidential before it is reported to a PSO. As explained in the Preamble, this interpretation addresses the concerns of significant administrative burden and an indiscriminate race to report information to the PSO if information only became protected after it was reported to a PSO. Nevertheless, a provider should only place information in its PSES if it intends to report that information to the PSO.

Information That Is Not PSWP

The definition of PSWP also describes information that is not PSWP. Specifically excluded from the definition of PSWP is, “a patient's medical record, billing and discharge information, or any other original patient or provider information.” The Patient Safety Act and Rule also exclude from the PSWP definition “information that is collected, maintained, or developed separately, or exists separately, from a patient safety evaluation system.” Put another way, information prepared for purposes other than reporting to a PSO is not PSWP under the reporting pathway.

Within the category of information prepared for a purpose other than reporting to a PSO, information that is prepared for external obligations has generated many questions. External obligations include, but are not limited to, mandatory requirements placed upon providers by Federal and state health regulatory agencies. Both the NPRM and Preamble clearly state that PSWP cannot be used to satisfy such external obligations. “As the Patient Safety Act states more than once, these external obligations must be met with information that is not patient safety work product, and, in accordance with the confidentiality provisions, patient safety work product cannot be disclosed for these purposes.” In the Preamble, HHS repeatedly stated that PSWP cannot be used to fulfill external obligations.

Purpose for Which the Information Was Assembled or Developed

As such, uncovering the purpose for which information is prepared can be a critical factor in determining whether the information is PSWP. Since some types of information can be PSWP or not depending upon why the information was assembled or developed, it is important for providers to be aware of whether information is prepared for reporting to a PSO. The chart below includes some examples.

Meeting External Obligations

The Patient Safety Act Does Not Relieve a Provider From Its External Obligations

As discussed above, the Patient Safety Act does not permit providers to use the privilege and confidentiality protections for PSWP to shield records required by external recordkeeping or reporting requirements. To this end, the Patient Safety Act specifically states that it shall not limit the reporting of non-PSWP “to a Federal, State, or local governmental agency for public health surveillance, investigation, or other public health purposes or health oversight purposes” or a provider's recordkeeping obligations under Federal, State, or local law. It further reinforces that the statute shall not be construed “to limit, alter or affect the requirements of Federal, State, or local law pertaining to information that is not” PSWP or “as preempting or otherwise affecting any State law requiring a provider to report information that is not” PSWP. The NPRM explains that “the statute is quite specific that these protections do not relieve a provider from its obligation to comply with other legal, regulatory, accreditation, licensure, or other accountability requirements that it would otherwise need to meet.” It adds that the protected system established by the Patient Safety Act, “resides alongside but does not replace other information collection activities mandated by laws, regulations, and accrediting and licensing requirements as well as voluntary reporting activities that occur for the purpose of maintaining accountability in the health care system.” As further stated in the Preamble, “nothing in the final rule or the statute relieves a provider from his or her obligation to disclose information from such original records or other information that is not patient safety work product to comply with state reporting or other laws.”

HHS reiterates that any external reporting or recordkeeping obligations—whether they require a provider to report certain information, maintain specific records, or operate a separate system—cannot be met with PSWP. We also clarify that any information that is prepared to meet any Federal, state, or local health oversight agency requirements is not PSWP. As discussed above, the Patient Safety Act was intended to spur the development of additional information created through voluntary patient safety activities and to provide privilege and confidentiality protections for such new information. It was not intended to protect records generated or maintained as part of providers' existing mandatory information collection activities. As stated in the Preamble, “The Department does not believe that the patient safety evaluation system enables providers to avoid transparency. . . . [T]he Patient Safety Act and the final rule have carefully assured that information generally available today remains available, such as medical records, original provider documents, and business records.”

HHS believes that most providers that engage with a PSO are doing so to further learning about patient safety and health care quality, consistent with the intent of the Patient Safety Act. Nevertheless, we are concerned about two ways that some providers may be attempting to misuse the Patient Safety Act protections to avoid their external obligations—in particular, to circumvent Federal or state regulatory obligations. First, some providers with recordkeeping or record maintenance requirements appear to be maintaining the required records only in their PSES and then refusing to disclose the records, asserting that the records in their PSES fulfill the applicable regulatory requirements while at the same time maintaining that the records are privileged and confidential PSWP. Second, some providers appear to develop records to meet external obligations outside of the PSES, place a duplicate copy of the required record into the PSES, then destroy the original outside of the PSES and refuse to disclose the remaining copy of the information, asserting that the copy is confidential and privileged PSWP. The Patient Safety Act was not intended to give providers such methods to evade their regulatory obligations. Here, we clarify HHS' interpretation of how the Patient Safety Act prohibits providers from using the PSES to protect from disclosure records subject to such external obligations.

Original Patient and Provider Records

As stated in the Patient Safety Act and Patient Safety Rule, original patient and provider records, such as a patient's medical record, billing information, and discharge information, are not PSWP. We now provide further clarification regarding what constitutes other types of original provider records. HHS interprets “original provider records” to include: (1) Original records (e.g., reports or documents) that are required of a provider to meet any Federal, state, or local public health or health oversight requirement regardless of whether such records are maintained inside or outside of the provider's PSES; and (2) copies of records residing within the provider's PSES that were prepared to satisfy a Federal, state, or local public health or health oversight record maintenance requirement, if while the provider is obligated to maintain such information, the information is only maintained by the provider within the PSES (e.g., if the records or documents that were being maintained outside the PSES to fulfill the external obligation were lost or destroyed). This interpretation is consistent with Congressional intent in enacting the Patient Safety Act, the text of the statute and the regulation, and HHS' prior interpretation found in the NPRM and Preamble, all discussed above, supporting that the Patient Safety Act does not allow providers to be shielded from their external obligations.

To further illustrate what information HHS would consider to be original provider records versus information that could be eligible to be PSWP, consider the following hypothetical examples in scenarios where a provider maintains specific forms regarding adverse events in order to satisfy a federal or state law obligation.

1. The provider only maintains the forms outside of the PSES: The forms are not PSWP. They are not PSWP both because they are an original provider record and because they are maintained separately from the PSES.

2. The provider maintains the original forms outside of the PSES and places duplicate copies in the PSES for reporting to the PSO, so that further analysis using information in the forms can be conducted: The forms outside of the PSES are not PSWP, for the reasons indicated above. The copies in the PSES would be PSWP, provided that: (1) The information otherwise meets the definition of PSWP and (2) the original forms continue to be maintained by the provider outside of the PSES. If, while the provider is required to maintain the forms, the forms outside of the PSES become unavailable (e.g., they are lost or destroyed), the duplicate copies of the forms in the provider's PSES will be “original provider records” that are no longer privileged and confidential PSWP so long as no duplicate copies of the forms are maintained outside of the PSES by the provider.

3. The provider only maintains the original forms in the PSES: The forms are original provider records and not privileged and confidential PSWP. We note that it would be improper to maintain records collected for external reporting purposes solely within a PSES because this scenario would be a misuse of a PSES.

4. The provider maintains the forms outside of the PSES and within the PSES extracts information from the forms to conduct further analysis: The forms outside of the PSES are not PSWP, for the reasons indicated above. The analysis conducted inside the PSES, including the information extracted from the forms, is PSWP.

This clarification should not create problems for providers who have appropriately created and retained the original records required to satisfy their external obligations outside of a PSES. Those original records would be available to meet any external reporting requirements or needs. In an effort to ensure that there is no need to obtain the copies that exist in the PSES for other purposes, providers should establish a mechanism to indicate where the original records can be located. Additionally, providers should exercise extreme caution before destroying any original records maintained outside of the PSES. A provider that destroys the original source documents upon which PSWP is based is not relieved of its obligations or any applicable consequences that may be imposed by other regulators if they fail to maintain the original records.

Copies of PSWP

To be clear, the above discussion of copies relates to information that begins as non-PSWP (i.e., original patient or provider records and/or information that was collected, maintained, developed, or exists separately from the PSES). Consistent with the Patient Safety Rule's definition of PSWP, copies of information initially prepared as PSWP within the PSES are PSWP. For example, if a provider originally develops information to improve patient safety in its PSES solely for reporting to the PSO, that information is PSWP. If the provider then makes a copy of this information for the PSO and retains another copy of it in its PSES, both the copy of the information disclosed to the PSO and the copy maintained in the provider's PSES are PSWP, and thus privileged and confidential under the Patient Safety Rule.

Separate Systems

It has come to HHS' attention that the discussion in the Preamble regarding whether providers need to maintain multiple systems may have caused some confusion. Some commenters on the NPRM expressed concern that providers would need to maintain two duplicate systems: One PSES for information that the provider assembles or develops for reporting to a PSO and a second system containing the same information if the provider is unsure at the time the information is prepared for reporting to the PSO whether that information may be required in the future to fulfill a state law obligation. In response to this concern, the Preamble discusses a way that the Patient Safety Rule allows for information that was PSWP to no longer be PSWP. This process, sometimes referred to as the “drop out” provision, provides that PSWP “assembled or developed by a provider for reporting to a PSO may be removed from” a PSES and no longer be considered PSWP if: “[t]he information has not yet been reported to a PSO” and “[t]he provider documents the act and date of removal of such information from the” PSES. Once removed from the PSES following this procedure, the information could be used for other purposes, such as to meet state law obligations.

As indicated above, the drop out provision is intended as a safety valve for providers who are unsure at the time that information is being prepared for reporting to the PSO whether similar information would, at a later time, be needed for an external obligation. It provides some flexibility for providers as they work through their various external obligations, as information assembled or developed for reporting to the PSO can reside as PSWP within the provider's PSES until the provider makes a future determination as to whether that information must be used to meet an external obligation. It is intended to be used on a case-by-case basis. Under the drop out provision, if the provider later determines the information within its PSES that had originally been assembled or developed for reporting to a PSO will be instead used for an external obligation, it is removed from the PSES and is no longer PSWP. This means it is no longer privileged or confidential under the Patient Safety Act and Patient Safety Rule. If the provider instead decides to report the information to a PSO, the information remains PSWP (so long as it meets the requirements for being PSWP, including that it is not an original patient or provider record) and cannot be permissibly disclosed for any reason, except in accordance with the disclosure permissions described in the Patient Safety Act and Patient Safety Rule. The Preamble thus explains how the drop out provision eliminates the need for a provider to maintain two systems with duplicate information: A PSES containing PSWP and a separate system containing any of that same information where the provider has yet to determine whether it will be needed in the future for another purpose.

Nevertheless, we reemphasize that where records are mandated by a Federal or State law requirement or other external obligation, they are not PSWP. Thus, a provider should maintain at least two systems or spaces: A PSES for PSWP and a separate place where it maintains records for external obligations. As discussed above, the Patient Safety Act encourages providers to prepare, analyze, and share information beyond what they are mandated to do. As such, it is expected that most of the information in a PSES would be originally created by providers as part of their voluntary participation with a PSO.

Shared Responsibility

As described above, the protected system established under the Patient Safety Act works in concert with the external obligations of providers to ensure accountability and transparency while encouraging the improvement of patient safety and reduction of medical errors through a culture of safety. It is the provider's ultimate responsibility to understand what information is required to meet all of its external obligations. If a provider is uncertain what information is required of it to fulfill an external obligation, the provider should reach out to the external entity to clarify the requirement. HHS has heard anecdotal reports of providers, PSOs, and regulators working together to ensure that the regulators can obtain the information they need without requesting that providers impermissibly disclose PSWP. HHS encourages such communication. Regulatory agencies and other entities requesting information of providers or PSOs are reminded that, subject to the limited exceptions set forth in the Patient Safety Act and Patient Safety Rule, PSWP is privileged and confidential, and it may not be used to satisfy external obligations. Therefore, such entities should not demand PSWP from providers or PSOs.

Some requirements are clear and discrete, which makes it relatively easy for providers to understand what information is mandated, determine what additional information they want to prepare for reporting to a PSO, and to separate the two categories of information. Examples of clear and discrete requirements would include requirements for a provider to fill out a particular form or to provide a document containing specified data points. However, HHS is aware that some requirements are more ambiguous or broad, thus creating uncertainty about the information required to satisfy them. Particularly where laws or regulations may be vague, it is imperative that the regulators work with providers so that the regulators obtain the information they need, and that providers sufficiently understand what is required of them so that they can satisfy their obligations and voluntarily report additional information to a PSO. Where a variety of information could potentially satisfy an external obligation, and where a provider reports similar information to the PSO, the provider may find it helpful to document which information collection activities it does to fulfill its external requirements and which other activities it does in the PSES, to help ensure confidentiality and privilege of the PSWP.

Later Developing Requirements

As discussed above, providers should work with regulatory bodies and any other entities with which they have obligations to understand in advance the exact information they will need to satisfy their external obligations. That way, providers can plan ahead to create and maintain any information needed to fulfill their obligations separately from their PSES. However, even if providers and regulators cooperate fully, HHS is aware that situations could arise where a provider has collected information for reporting to the PSO and where the records at issue were not required by any external obligation at the time they were created, but where a regulator later seeks the same information as part of its oversight or investigatory responsibilities. The information at issue would be PSWP and would be privileged and confidential, but the provider may still have several options to satisfy its obligation. If the information is eligible for the drop out provision (including that the provider has not yet reported the information to a PSO), then the provider may follow the drop out provision discussed above to remove the information from its PSES and report or maintain the information outside of the PSES, to satisfy the regulator's request. This information is no longer PSWP. If the provider has reported the information to a PSO or the information is otherwise not subject to the drop out provision, the Patient Safety Act and Patient Safety Rule provide several options that the provider may want to consider, which are discussed below.

1. Did the provider mistakenly enter information that is not PSWP into its PSES? The provider may want to first ensure that the information being requested meets the definition of PSWP. If the provider determines that the information now required is not PSWP (e.g., an original patient record was accidentally placed in the PSES), the provider can remove the information from its PSES. If the information does not meet the definition of PSWP, it is not privileged and confidential under the Patient Safety Act, and the Patient Safety Act places no limitations on the provider from further releasing it. If the information is not PSWP and the only copy of the information is in the PSO's PSES (i.e., the provider did not retain a copy outside of or in its PSES), then the Patient Safety Act places no limitations on the PSO from releasing it back to the provider.

2. Is there a disclosure exception that may be used to permissibly disclose the PSWP? For example:

• Can the provider obtain authorization from each identified provider to disclose the information, in accordance with 42 CFR 3.206(b)(3)?
• Is the information subject to the disclosure permission to the FDA at 42 CFR 3.206(b)(7)?
• Is the information being voluntarily disclosed to an accrediting body, pursuant to 42 CFR 3.206(b)(8)?

While these disclosure permissions are available in the limited circumstances described in the Patient Safety Rule, relying upon a disclosure permission should not be a provider's primary method to meet an external obligation. As stated in the Preamble, with respect to the FDA disclosure permission, “However, we emphasize that, despite this disclosure permission, we expect that most reporting to the FDA and its regulated entities will be done with information that is not patient safety work product, as is done today. This disclosure permission is intended to allow for reporting to the FDA or FDA-regulated entity in those special cases where, only after an analysis of patient safety work product, does a provider realize it should make a report.” HHS has the same expectation for other external obligations, as well.

3. Can the provider recreate the information or conduct an identical analysis from non-PSWP outside of the PSES? If a provider is instructed to compile specified information but the provider previously assembled such information within its PSES and reported it to a PSO, this does not prevent a provider from creating the requested information using non-PSWP. As indicated in the NPRM, “[t]hose who participated in the collection, development, analysis, or review of the missing information or have knowledge of its contents can fully disclose what they know . . .” Similarly, although an analysis originally conducted in the PSES cannot become non-PSWP under the drop out provision, if a provider is informed that a certain analysis is needed to meet an external obligation, the Patient Safety Act indicates that a provider could conduct a new analysis with non-PSWP to satisfy this requirement, “regardless of whether such additional analysis involves issues identical to or similar to those for which information was reported to or assessed by” a PSO or PSES.

Providers are reminded that they should exercise care to ensure that even if the information is not privileged and confidential under the Patient Safety Act or if a permissible disclosure of PSWP has been identified, the intended disclosure of the information is not impermissible under any other law (e.g., the HIPAA Privacy Rule.)