b.) EXCEPTIONS TO PRIVILEGE AND CONFIDENTIALITY REQUIREMENTS
The privilege and confidentiality requirements surrounding PSWP are not applicable in certain situations; all PSWP may be disclosed when use of the PWSP falls into any of the following categories:
- For use in a criminal proceeding if a court makes a determination in camera84 that the PSWP contains evidence of a criminal act, is material to the proceeding and is not reasonably available from any other source;85
- To the extent necessary to carry out86 equitable relief in a civil action brought by any aggrieved individual to redress or enjoin an adverse employment action,87 if the court or administrative tribunal has issued a protective order to protect the confidentiality of PSWP in the course of the proceeding;88
- When authorized by each identified provider89 via a signed writing that contains enough detail to fairly inform the provider(s) of the nature and scope of the disclosure being authorized;90
- Voluntary disclosure of non-identifiable patient safety work product;91 and/or
- To or by HHS in investigating or determining compliance, imposition of civil money penalties, or making or supporting decisions with respect to listing of a PSO,92 which may be subsequently disclosed by HHS for use by HHS in any of its activities and for use as evidence in any administrative or judicial proceeding.93
The following disclosures are exceptions only to the confidentiality requirements applicable to PSWP. They are not available to circumvent the privilege requirements. Disclosure of PSWP may occur in the following circumstances:
- To carry out patient safety activities94 when such disclosure is between a provider and a PSO,95 to a contractor of a provider or a PSO,96 or among affiliated providers;97
- To carry out patient safety activities when such disclosure is to another PSO or provider, if thirteen specific identifiers98 of any providers or affiliated organizations, corporate parents, subsidiaries, practice partners, employers, members of the workforce or household members of such providers are removed,99 and direct identifiers100 in any individually identifiable health information are removed;101
- If the PSWP is non-identifiable, whether voluntarily disclosed or not;102
- To entities carrying out research, evaluation, or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by HHS, for the purpose of conducting research;103
- By a provider to the FDA with respect to a product or activity regulated by the FDA;104
- Voluntary disclosure by a provider to an accrediting body that accredits that provider;105
- For business operations to attorneys, accounts and other professionals,106 or other business operations prescribed by HHS, if disclosure is consistent with the goals of patient safety improvement;107
- To law enforcement authorities relating to the commission of a crime (or to an event reasonably believed to be a crime), if the person making the disclosure reasonably believes, under the circumstances, that the disclosure is necessary for criminal law enforcement purposes;108
- The disclosure does not include materials that assess the quality of care of an identifiable provider,109 or do not include materials that describe or pertain to one or more actions or failures to act by an identifiable provider,110 if the entity or individual making the disclosure is not a PSO.111
In addition to these disclosure exceptions, a component PSO may provide individuals in or units of its parent organization with access to identifiable PSWP in the following situation:
- There is an agreement that access to such work product will be limited to what is necessary to assist the component in the conduct of patient safety activities;112 and
- Those given access will not use or disclose such information beyond what is required to assist the component PSO, will take appropriate security measures to prevent unauthorized disclosures, and will comply with the general certifications the component PSO made regarding unauthorized disclosures.113
If any PSWP is disclosed via an authorized exception, the PSWP will continue to be confidential and privileged after such disclosure, and the confidentiality and privilege requirements will apply in equal measure to the person to whom the information was disclosed.114 However, if the PSWP is disclosed in accordance with the exception provided for criminal proceedings, the confidentiality protection will no longer apply to the PSWP.115 Additionally, if the PSWP disclosed is non-identifiable, neither the privilege nor the confidentiality protections will continue to apply to the non-identifiable PSWP.116
Footnotes
- 84. In camera means privately in front of a judge; not in open court.
- 85. PSQIA, 42 U.S.C. § 299b-22(c)(1)(A).
- 86. PSQIA, 42 U.S.C. § 299b-22(c)(1)(B).
- 87. PSQIA, 42 U.S.C. § 299b-22(e). Note: States or agencies of state governments may not assert any of the privilege protections described unless before such assertion, the state has consented to be subject to the equitable relief remedies for employers, and such consent has remained in effect.[4]
- 88. 42 CFR § 3.206(b)(2).
- 89. PSQIA, 42 U.S.C. § 299b-22(c)(1)(C).
- 90. 42 CFR § 3.206(b)(3)(i).
- 91. PSQIA, 42 U.S.C. § 299b-22(c)(3); PSQIA, 42 U.S.C. § 299b-22(c)(2)(A).
- 92. 42 CFR § 3.204(c); 42 CFR § 3.206(d).
- 93. 42 CFR § 3.312(c)(2).
- 94. PSQIA, 42 U.S.C. § 299b-22(c)(2)(A).
- 95. 42 CFR § 3.206(b)(4)(i).
- 96. 42 CFR § 3.206(b)(4)(ii).
- 97. 42 CFR § 3.206(b)(4)(iii).
- 98. Direct identifiers are listed in 42 CFR § 3.206(b)(4)(iv)(A)
- 99. 42 CFR § 3.206(b)(4)(iv)(A).
- 100. Listed at 45 CFR 164.514(e)(2).
- 101. 42 CFR § 3.206(b)(4)(iv)(B).
- 102. PSQIA, 42 U.S.C. § 299b-22(c)(2)(B).
- 103. PSQIA, 42 U.S.C. § 299b-22(c)(2)(C). Note: if work product disclosed for research is by a HIPAA-covered entity (defined at 45 CFR 160.103) and contains HIPAA-defined protected health information (defined at 45 CFR 160.103), disclosure is only permissible to the same extent as it would be permissible under HIPAA (42 CFR § 3.206(b)(6)(ii)).
- 104. PSQIA, 42 U.S.C. § 299b-22(c)(2)(D). Note: any person permitted to receive patient safety work product pursuant to this exception may only further disclose such work product for the purpose of evaluating the quality, safety, or effectiveness of that product or activity to another such person or the disclosing provider (42 CFR § 3.206(b)(7)(ii)).
- 105. PSQIA, 42 U.S.C. § 299b-22(c)(2)(E). Note: an accrediting body may not further disclose patient safety work product it receives pursuant to this exception (42 CFR § 3.206(b)(8)(ii), and may not take an accrediting action against a provider based on good faith participation of the provider in the collection, development, reporting or maintenance of patient safety work product in accordance with these rules nor require a provider to reveal its communications with any PSO (42 CFR § 3.206(b)(8)(iii)).
- 106. 42 CFR § 3.206(b)(9)(i). Note: such contractors may not further disclose patient safety work product except to the entity from which they received the information.
- 107. PSQIA, 42 U.S.C. § 299b-22(c)(2)(F).
- 108. PSQIA, 42 U.S.C. § 299b-22(c)(2)(G). Note: law enforcement personnel receiving work product pursuant to this exception may only disclose such work product to other law enforcement authorities as needed for law enforcement activities related to the event that gave rise to the initial disclosure (42 CFR § 3.206(b)(10)(ii).
- 109. PSQIA, 42 U.S.C. § 299b-22(c)(2)(H)(i).
- 110. PSQIA, 42 U.S.C. § 299b-22(c)(2)(H)(ii).
- 111. Note: this is referred to the “safe harbor” provision in the implementing regulations (42 CFR § 3.206(c)).
- 112. 42 CFR § 3.102(c)(3)(i).
- 113. 42 CFR § 3.102(c)(3)(ii).
- 114. PSQIA, 42 U.S.C. § 299b-22(d)(1).
- 115. PSQIA, 42 U.S.C. § 299b-22(d)(2)(A).
- 116. PSQIA, 42 U.S.C. § 299b-22(d)(2)(B).
.png)