42 U.S.C. § 299b–22: Privilege and confidential…

Summary

Protects patient safety work product by making it privileged and private. That means these records generally cannot be forced out by subpoenas or court orders, used in civil, criminal, or government proceedings, demanded under public-record laws, or used in professional licensing or discipline against a provider. There are limited exceptions. A judge can order specific records for a criminal case if they are key evidence and not available elsewhere. Nonidentifiable information, disclosures needed for patient-safety activities, certain research approved under HIPAA rules, FDA reports, voluntary sharing with an accreditor, and some law-enforcement disclosures are allowed. If a provider agrees, identifiable material can be shared. Sharing certain items does not wipe out protections for other materials. Patient safety organizations generally cannot be forced to hand over protected materials. Workers who report in good faith are protected from retaliation. Knowingly or recklessly disclosing identifiable protected material can carry a civil penalty of up to $10,000. After a safety database network starts, the Secretary must issue a draft report within 18 months and a final report to Congress within 1 year after that.

Title 42, §299b–22

The Public Health and Welfare, Source: USLM XML via OLRC

(a)Privilege

Notwithstanding any other provision of Federal, State, or local law, and subject to subsection (c), patient safety work product shall be privileged and shall not be—

(1)subject to a Federal, State, or local civil, criminal, or administrative subpoena or order, including in a Federal, State, or local civil or administrative disciplinary proceeding against a provider;

(2)subject to discovery in connection with a Federal, State, or local civil, criminal, or administrative proceeding, including in a Federal, State, or local civil or administrative disciplinary proceeding against a provider;

(3)subject to disclosure pursuant to section 552 of title 5 (commonly known as the Freedom of Information Act) or any other similar Federal, State, or local law;

(4)admitted as evidence in any Federal, State, or local governmental civil proceeding, criminal proceeding, administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such proceeding against a provider; or

(5)admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under State law.

(b)Confidentiality of patient safety work product

Notwithstanding any other provision of Federal, State, or local law, and subject to subsection (c), patient safety work product shall be confidential and shall not be disclosed.

(c)Exceptions

Except as provided in subsection (g)(3)—

(1)Exceptions from privilege and confidentiality

Subsections (a) and (b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:

(A)Disclosure of relevant patient safety work product for use in a criminal proceeding, but only after a court makes an in camera determination that such patient safety work product contains evidence of a criminal act and that such patient safety work product is material to the proceeding and not reasonably available from any other source.

(B)Disclosure of patient safety work product to the extent required to carry out subsection (f)(4)(A).

(C)Disclosure of identifiable patient safety work product if authorized by each provider identified in such work product.

(2)Exceptions from confidentiality

Subsection (b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:

(A)Disclosure of patient safety work product to carry out patient safety activities.

(B)Disclosure of nonidentifiable patient safety work product.

(C)Disclosure of patient safety work product to grantees, contractors, or other entities carrying out research, evaluation, or demonstration projects authorized, funded, certified, or otherwise sanctioned by rule or other means by the Secretary, for the purpose of conducting research to the extent that disclosure of protected health information would be allowed for such purpose under the HIPAA confidentiality regulations.

(D)Disclosure by a provider to the Food and Drug Administration with respect to a product or activity regulated by the Food and Drug Administration.

(E)Voluntary disclosure of patient safety work product by a provider to an accrediting body that accredits that provider.

(F)Disclosures that the Secretary may determine, by rule or other means, are necessary for business operations and are consistent with the goals of this part.

(G)Disclosure of patient safety work product to law enforcement authorities relating to the commission of a crime (or to an event reasonably believed to be a crime) if the person making the disclosure believes, reasonably under the circumstances, that the patient safety work product that is disclosed is necessary for criminal law enforcement purposes.

(H)With respect to a person other than a patient safety organization, the disclosure of patient safety work product that does not include materials that—

(i)assess the quality of care of an identifiable provider; or

(ii)describe or pertain to one or more actions or failures to act by an identifiable provider.

(3)Exception from privilege

Subsection (a) shall not apply to (and shall not be construed to prohibit) voluntary disclosure of nonidentifiable patient safety work product.

(d)Continued protection of information after disclosure

(1)In general

Patient safety work product that is disclosed under subsection (c) shall continue to be privileged and confidential as provided for in subsections (a) and (b), and such disclosure shall not be treated as a waiver of privilege or confidentiality, and the privileged and confidential nature of such work product shall also apply to such work product in the possession or control of a person to whom such work product was disclosed.

(2)Exception

Notwithstanding paragraph (1), and subject to paragraph (3)—

(A)if patient safety work product is disclosed in a criminal proceeding, the confidentiality protections provided for in subsection (b) shall no longer apply to the work product so disclosed; and

(B)if patient safety work product is disclosed as provided for in subsection (c)(2)(B) (relating to disclosure of nonidentifiable patient safety work product), the privilege and confidentiality protections provided for in subsections (a) and (b) shall no longer apply to such work product.

(3)Construction

Paragraph (2) shall not be construed as terminating or limiting the privilege or confidentiality protections provided for in subsection (a) or (b) with respect to patient safety work product other than the specific patient safety work product disclosed as provided for in subsection (c).

(4)Limitations on actions

(A)Patient safety organizations

(i)In general

A patient safety organization shall not be compelled to disclose information collected or developed under this part whether or not such information is patient safety work product unless such information is identified, is not patient safety work product, and is not reasonably available from another source.

(ii)Nonapplication

The limitation contained in clause (i) shall not apply in an action against a patient safety organization or with respect to disclosures pursuant to subsection (c)(1).

(B)Providers

An accrediting body shall not take an accrediting action against a provider based on the good faith participation of the provider in the collection, development, reporting, or maintenance of patient safety work product in accordance with this part. An accrediting body may not require a provider to reveal its communications with any patient safety organization established in accordance with this part.

(e)Reporter protection

(1)In general

A provider may not take an adverse employment action, as described in paragraph (2), against an individual based upon the fact that the individual in good faith reported information—

(A)to the provider with the intention of having the information reported to a patient safety organization; or

(B)directly to a patient safety organization.

(2)Adverse employment action

For purposes of this subsection, an “adverse employment action” includes—

(A)loss of employment, the failure to promote an individual, or the failure to provide any other employment-related benefit for which the individual would otherwise be eligible; or

(B)an adverse evaluation or decision made in relation to accreditation, certification, credentialing, or licensing of the individual.

(f)Enforcement

(1)Civil monetary penalty

Subject to paragraphs (2) and (3), a person who discloses identifiable patient safety work product in knowing or reckless violation of subsection (b) shall be subject to a civil monetary penalty of not more than $10,000 for each act constituting such violation.

(2)Procedure

The provisions of section 1320a–7a of this title, other than subsections (a) and (b) and the first sentence of subsection (c)(1), shall apply to civil money penalties under this subsection in the same manner as such provisions apply to a penalty or proceeding under section 1320a–7a of this title.

(3)Relation to HIPAA

Penalties shall not be imposed both under this subsection and under the regulations issued pursuant to section 264(c)(1) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note) for a single act or omission.

(4)Equitable relief

(A)In general

Without limiting remedies available to other parties, a civil action may be brought by any aggrieved individual to enjoin any act or practice that violates subsection (e) and to obtain other appropriate equitable relief (including reinstatement, back pay, and restoration of benefits) to redress such violation.

(B)Against State employees

An entity that is a State or an agency of a State government may not assert the privilege described in subsection (a) unless before the time of the assertion, the entity or, in the case of and with respect to an agency, the State has consented to be subject to an action described in subparagraph (A), and that consent has remained in effect.

(g)Rule of construction

Nothing in this section shall be construed—

(1)to limit the application of other Federal, State, or local laws that provide greater privilege or confidentiality protections than the privilege and confidentiality protections provided for in this section;

(2)to limit, alter, or affect the requirements of Federal, State, or local law pertaining to information that is not privileged or confidential under this section;

(3)except as provided in subsection (i), to alter or affect the implementation of any provision of the HIPAA confidentiality regulations or section 1320d–5 of this title (or regulations promulgated under such section);

(4)to limit the authority of any provider, patient safety organization, or other entity to enter into a contract requiring greater confidentiality or delegating authority to make a disclosure or use in accordance with this section;

(5)as preempting or otherwise affecting any State law requiring a provider to report information that is not patient safety work product; or

(6)to limit, alter, or affect any requirement for reporting to the Food and Drug Administration information regarding the safety of a product or activity regulated by the Food and Drug Administration.

(h)Clarification

Nothing in this part prohibits any person from conducting additional analysis for any purpose regardless of whether such additional analysis involves issues identical to or similar to those for which information was reported to or assessed by a patient safety organization or a patient safety evaluation system.

(i)Clarification of application of HIPAA confidentiality regulations to patient safety organizations

For purposes of applying the HIPAA confidentiality regulations—

(1)patient safety organizations shall be treated as business associates; and

(2)patient safety activities of such organizations in relation to a provider are deemed to be health care operations (as defined in such regulations) of the provider.

(j)Reports on strategies to improve patient safety

(1)Draft report

Not later than the date that is 18 months after any network of patient safety databases is operational, the Secretary, in consultation with the Director, shall prepare a draft report on effective strategies for reducing medical errors and increasing patient safety. The draft report shall include any measure determined appropriate by the Secretary to encourage the appropriate use of such strategies, including use in any federally funded programs. The Secretary shall make the draft report available for public comment and submit the draft report to the Institute of Medicine for review.

(2)Final report

Not later than 1 year after the date described in paragraph (1), the Secretary shall submit a final report to the Congress.

Notes & Related Subsidiaries

Editorial Notes

References in Text

section 264(c)(1) of the Health Insurance Portability and Accountability Act of 1996, referred to in subsec. (f)(3), is section 264(c)(1) of Pub. L. 104–191, which is set out as a note under section 1320d–2 of this title.

Prior Provisions

A prior section 922 of act

July 1, 1944, was renumbered section 942 and is classified to section 299c–1 of this title. Another prior section 922 of act

July 1, 1944, was classified to section 299c–1 of this title prior to the general amendment of this subchapter by Pub. L. 106–129.

§299b–22 Privilege and Confidentiality Protections