42 U.S.C. § 299b-22 : US Code - Section 299B-22: Privilege and confidentiality protections

Search 42 U.S.C. § 299b-22 : US Code - Section 299B-22: Privilege and confidentiality protections

(a) Privilege
Notwithstanding any other provision of Federal, State, or local
law, and subject to subsection (c) of this section, patient safety
work product shall be privileged and shall not be - 
(1) subject to a Federal, State, or local civil, criminal, or
administrative subpoena or order, including in a Federal, State,
or local civil or administrative disciplinary proceeding against
a provider;
(2) subject to discovery in connection with a Federal, State,
or local civil, criminal, or administrative proceeding, including
in a Federal, State, or local civil or administrative
disciplinary proceeding against a provider;
(3) subject to disclosure pursuant to section 552 of title 5
(commonly known as the Freedom of Information Act) or any other
similar Federal, State, or local law;
(4) admitted as evidence in any Federal, State, or local
governmental civil proceeding, criminal proceeding,
administrative rulemaking proceeding, or administrative
adjudicatory proceeding, including any such proceeding against a
provider; or
(5) admitted in a professional disciplinary proceeding of a
professional disciplinary body established or specifically
authorized under State law.
(b) Confidentiality of patient safety work product
Notwithstanding any other provision of Federal, State, or local
law, and subject to subsection (c) of this section, patient safety
work product shall be confidential and shall not be disclosed.
(c) Exceptions
Except as provided in subsection (g)(3) of this section - 
(1) Exceptions from privilege and confidentiality
Subsections (a) and (b) of this section shall not apply to (and
shall not be construed to prohibit) one or more of the following
disclosures:
(A) Disclosure of relevant patient safety work product for
use in a criminal proceeding, but only after a court makes an
in camera determination that such patient safety work product
contains evidence of a criminal act and that such patient
safety work product is material to the proceeding and not
reasonably available from any other source.
(B) Disclosure of patient safety work product to the extent
required to carry out subsection (f)(4)(A) of this section.
(C) Disclosure of identifiable patient safety work product if
authorized by each provider identified in such work product.
(2) Exceptions from confidentiality
Subsection (b) of this section shall not apply to (and shall
not be construed to prohibit) one or more of the following
disclosures:
(A) Disclosure of patient safety work product to carry out
patient safety activities.
(B) Disclosure of nonidentifiable patient safety work
product.
(C) Disclosure of patient safety work product to grantees,
contractors, or other entities carrying out research,
evaluation, or demonstration projects authorized, funded,
certified, or otherwise sanctioned by rule or other means by
the Secretary, for the purpose of conducting research to the
extent that disclosure of protected health information would be
allowed for such purpose under the HIPAA confidentiality
regulations.
(D) Disclosure by a provider to the Food and Drug
Administration with respect to a product or activity regulated
by the Food and Drug Administration.
(E) Voluntary disclosure of patient safety work product by a
provider to an accrediting body that accredits that provider.
(F) Disclosures that the Secretary may determine, by rule or
other means, are necessary for business operations and are
consistent with the goals of this part.
(G) Disclosure of patient safety work product to law
enforcement authorities relating to the commission of a crime
(or to an event reasonably believed to be a crime) if the
person making the disclosure believes, reasonably under the
circumstances, that the patient safety work product that is
disclosed is necessary for criminal law enforcement purposes.
(H) With respect to a person other than a patient safety
organization, the disclosure of patient safety work product
that does not include materials that - 
(i) assess the quality of care of an identifiable provider;
or
(ii) describe or pertain to one or more actions or failures
to act by an identifiable provider.
(3) Exception from privilege
Subsection (a) of this section shall not apply to (and shall
not be construed to prohibit) voluntary disclosure of
nonidentifiable patient safety work product.
(d) Continued protection of information after disclosure
(1) In general
Patient safety work product that is disclosed under subsection
(c) of this section shall continue to be privileged and
confidential as provided for in subsections (a) and (b) of this
section, and such disclosure shall not be treated as a waiver of
privilege or confidentiality, and the privileged and confidential
nature of such work product shall also apply to such work product
in the possession or control of a person to whom such work
product was disclosed.
(2) Exception
Notwithstanding paragraph (1), and subject to paragraph (3) - 
(A) if patient safety work product is disclosed in a criminal
proceeding, the confidentiality protections provided for in
subsection (b) of this section shall no longer apply to the
work product so disclosed; and
(B) if patient safety work product is disclosed as provided
for in subsection (c)(2)(B) of this section (relating to
disclosure of nonidentifiable patient safety work product), the
privilege and confidentiality protections provided for in
subsections (a) and (b) of this section shall no longer apply
to such work product.
(3) Construction
Paragraph (2) shall not be construed as terminating or limiting
the privilege or confidentiality protections provided for in
subsection (a) or (b) of this section with respect to patient
safety work product other than the specific patient safety work
product disclosed as provided for in subsection (c) of this
section.
(4) Limitations on actions
(A) Patient safety organizations
(i) In general
A patient safety organization shall not be compelled to
disclose information collected or developed under this part
whether or not such information is patient safety work
product unless such information is identified, is not patient
safety work product, and is not reasonably available from
another source.
(ii) Nonapplication
The limitation contained in clause (i) shall not apply in
an action against a patient safety organization or with
respect to disclosures pursuant to subsection (c)(1) of this
section.
(B) Providers
An accrediting body shall not take an accrediting action
against a provider based on the good faith participation of the
provider in the collection, development, reporting, or
maintenance of patient safety work product in accordance with
this part. An accrediting body may not require a provider to
reveal its communications with any patient safety organization
established in accordance with this part.
(e) Reporter protection
(1) In general
A provider may not take an adverse employment action, as
described in paragraph (2), against an individual based upon the
fact that the individual in good faith reported information - 
(A) to the provider with the intention of having the
information reported to a patient safety organization; or
(B) directly to a patient safety organization.
(2) Adverse employment action
For purposes of this subsection, an "adverse employment action"
includes - 
(A) loss of employment, the failure to promote an individual,
or the failure to provide any other employment-related benefit
for which the individual would otherwise be eligible; or
(B) an adverse evaluation or decision made in relation to
accreditation, certification, credentialing, or licensing of
the individual.
(f) Enforcement
(1) Civil monetary penalty
Subject to paragraphs (2) and (3), a person who discloses
identifiable patient safety work product in knowing or reckless
violation of subsection (b) of this section shall be subject to a
civil monetary penalty of not more than $10,000 for each act
constituting such violation.
(2) Procedure
The provisions of section 1320a-7a of this title, other than
subsections (a) and (b) and the first sentence of subsection
(c)(1), shall apply to civil money penalties under this
subsection in the same manner as such provisions apply to a
penalty or proceeding under section 1320a-7a of this title.
(3) Relation to HIPAA
Penalties shall not be imposed both under this subsection and
under the regulations issued pursuant to section 264(c)(1) of the
Health Insurance Portability and Accountability Act of 1996 (42
U.S.C. 1320d-2 note) for a single act or omission.
(4) Equitable relief
(A) In general
Without limiting remedies available to other parties, a civil
action may be brought by any aggrieved individual to enjoin any
act or practice that violates subsection (e) of this section
and to obtain other appropriate equitable relief (including
reinstatement, back pay, and restoration of benefits) to
redress such violation.
(B) Against State employees
An entity that is a State or an agency of a State government
may not assert the privilege described in subsection (a) of
this section unless before the time of the assertion, the
entity or, in the case of and with respect to an agency, the
State has consented to be subject to an action described in
subparagraph (A), and that consent has remained in effect.
(g) Rule of construction
Nothing in this section shall be construed - 
(1) to limit the application of other Federal, State, or local
laws that provide greater privilege or confidentiality
protections than the privilege and confidentiality protections
provided for in this section;
(2) to limit, alter, or affect the requirements of Federal,
State, or local law pertaining to information that is not
privileged or confidential under this section;
(3) except as provided in subsection (i) of this section, to
alter or affect the implementation of any provision of the HIPAA
confidentiality regulations or section 1320d-5 of this title (or
regulations promulgated under such section);
(4) to limit the authority of any provider, patient safety
organization, or other entity to enter into a contract requiring
greater confidentiality or delegating authority to make a
disclosure or use in accordance with this section;
(5) as preempting or otherwise affecting any State law
requiring a provider to report information that is not patient
safety work product; or
(6) to limit, alter, or affect any requirement for reporting to
the Food and Drug Administration information regarding the safety
of a product or activity regulated by the Food and Drug
Administration.
(h) Clarification
Nothing in this part prohibits any person from conducting
additional analysis for any purpose regardless of whether such
additional analysis involves issues identical to or similar to
those for which information was reported to or assessed by a
patient safety organization or a patient safety evaluation system.
(i) Clarification of application of HIPAA confidentiality
regulations to patient safety organizations
For purposes of applying the HIPAA confidentiality regulations - 
(1) patient safety organizations shall be treated as business
associates; and
(2) patient safety activities of such organizations in relation
to a provider are deemed to be health care operations (as defined
in such regulations) of the provider.
(j) Reports on strategies to improve patient safety
(1) Draft report
Not later than the date that is 18 months after any network of
patient safety databases is operational, the Secretary, in
consultation with the Director, shall prepare a draft report on
effective strategies for reducing medical errors and increasing
patient safety. The draft report shall include any measure
determined appropriate by the Secretary to encourage the
appropriate use of such strategies, including use in any
federally funded programs. The Secretary shall make the draft
report available for public comment and submit the draft report
to the Institute of Medicine for review.
(2) Final report
Not later than 1 year after the date described in paragraph
(1), the Secretary shall submit a final report to the Congress.