Back More
Salem Press

Table of Contents

Privacy Rights in the Digital Age, 2nd Edition

P

by Julie E. Randolph

Patient Safety and Quality Improvement Act of 2005 (PSQIA), 42 U.S.C. § 299b-21 to -26

Identification: Enacted July 29, 2005, effective January 19, 2009, a regulation to improve patient safety by creating incentives for healthcare providers to report and analyze patient safety events. PSQIA facilitates providers’ being able to share information concerning adverse events with patient safety organizations (PSOs) by allowing them to communicate such information without waiving privilege or violating confidentiality requirements. As of 2015, healthcare providers appear to be working out how to optimize their PSO use, and some providers have invoked PSQIA to protect materials from discovery during legal proceedings.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996, 110 Stat. 1936 (1996), outlines the privacy and security requirements for covered entities. Covered entities, under certain circumstances, may share information with business associates, as defined under HIPAA. Covered entities not complying with HIPAA’s requirements may face fines or other penalties; conversely, HIPAA does not confer any privilege on materials shared with a PSO. As a result, a covered entity may be reluctant to share information on adverse events with an entity such as a PSO because doing so may run afoul of HIPAA’s confidentiality provisions and may make such information vulnerable to discovery and use against the covered entity.

Congress enacted PSQIA in response to the Institute of Medicine’s 1999 report “To Err Is Human: Building a Safer Health System,” which estimated that each year preventable medical errors caused between 44,000 and 98,000 deaths in hospitals and between $17 billion and $29 billion in hospital costs. Lawmakers took up one of the report’s recommendations, a voluntary reporting system for adverse events to identify and learn from errors, thus encouraging participation by protecting the disclosed information. Congress began debating the law in late 1999, and multiple versions w9ere introduced in subsequent sessions of Congress. Both houses of Congress passed the final version in 2005. The Department of Health and Human Services published the initial Notice of Proposed Rule-making on February 12, 2008, and promulgated the final rule implementing the act on November 21, 2008.

PSQIA amends Title IX of the Public Health Service Act. PSQIA outlines the requirements for PSO certification and clarifies that, for purposes of applying HIPAA’s confidentiality regulations, PSOs will be treated as business associates, and patient safety activities will be treated as healthcare operations of the provider (defined in the act).

PSQIA confers privilege on “patient safety work product,” which is defined in the act as including data, reports, records, memoranda, analyses, or written or oral statements that are assembled or developed to report to a PSO, that a PSO develops for patient safety activities or that show that an entity is reporting to a PSO. It does not include patients’ medical records, billing and discharge information, or any other original patient or provider record. Identifiable patient safety work product is patient safety work product that allows the identification of providers that are the subject of the work product or whose activities are the subject of the work product, individually identifiable health information as defined by HIPAA, or patient safety work product that allows the identification of an individual who reports information. Nonidentifiable patient safety work product is patient safety work product that does not fall into those categories.

Under PSQIA, patient safety work product is privileged and confidential. Because it is privileged, it is not subject to federal, state, or local civil, criminal, or administrative subpoena or order; to discovery in connection with federal, state, or local civil, criminal, or administrative proceedings; or to disclosure under the Freedom of Information Act or similar laws. It also cannot be admitted as evidence in federal, state, local, or governmental civil or criminal proceedings or administrative rulemaking or adjudicatory proceedings, nor can it be admitted in a professional disciplinary body’s proceedings. Subject to PSQIA’s listed exceptions, patient safety work product is confidential and cannot be disclosed.

PSQIA provides limited exceptions to both privilege and confidentiality. These include use in a criminal proceeding after the court has reviewed the patient work safety product and made an in camera determination that it contains evidence of a criminal act where necessary to enforce protection of a reporter (as defined in the act), and when authorized by each provider identified in the work product. Privilege does not apply to voluntary disclosure of nonidentifiable patient safety work product. Work safety product is exempt from confidentiality when the work product is disclosed to carry out patient safety activities, when nonidentifiable patient safety work product is disclosed, when the secretary of Health and Human Services sanctions the disclosure, for disclosure to the Food and Drug Administration with respect to a product or activity it regulates, for voluntary disclosure to an accrediting body, when the secretary deems it necessary for business operations consistent with the act’s goals, to law enforcement authorities when the person reporting reasonably believes disclosure is necessary for criminal law enforcement purposes, and to a non-PSO when the disclosure does not include materials that assess the quality of care of an identifiable provider or do not describe or pertain to actions or failures of an identifiable provider. Disclosure of patient safety work product under these exceptions does not waive privilege or confidentiality, so the materials disclosed under PSQIA’s exceptions otherwise remain privileged and confidential.

PSQIA contains some additional protections to encourage reporting. Accrediting bodies cannot take an accrediting action against a provider based on the provider’s good-faith participation in collecting, developing, reporting, or maintaining patient safety work product, and an accrediting body cannot require a provider to reveal its communications with a PSO. A provider in turn cannot take an adverse employment action (as defined in the act) against an individual who in good faith reports information for the provider to provide to a PSO or who reports it directly to the PSO.

The penalty for disclosing identifiable patient safety work product is $10,000 for each act constituting a knowing or reckless violation of PSQIA’s confidentiality provisions, but double fines for the same act cannot be imposed under both HIPAA and PSQIA.

Last, PSQIA states that it will not limit the application of federal, state, or local laws that provide greater privilege or confidentiality protections than those in the act. Because many states have their own statutory schemes for peer review that attach privilege and confidentiality protections, the amount of protection attached to a provider’s information may vary by state.

Further Reading

1 

Levy, Frederick, Darren Mareniss, Corianne Iacovelli, and Jeffrey Howard. “The Patient Safety and Quality Improvement Act of 2005: Preventing Error and Promoting Patient Safety.” Journal of Legal Medicine 31, no. 4 (2010): 397–422.

2 

Liang, Bryan A. “Regulating for Patient Safety: The Law’s Response to Medical Errors: Collaborating on Patient Safety: Legal Concerns and Policy Requirements.” Widener Law Review 12 (2005): 83–105.

3 

U.S. Department of Health and Human Services. “Patient Safety and Quality Improvement: Final Rule.” Federal Register 73, no. 226 (November 21, 2008).

See also: Federal Freedom of Information Act (FOIA); Health Insurance Portability and Accountability Act (HIPPA); Medical confidentiality, privacy right to; Privacy laws, state

Citation Types

MLA 9th
Randolph, Julie E. "P." Privacy Rights in the Digital Age, 2nd Edition, edited by Jane E. Kirtley & Michael Shally-Jensen, Salem Press, 2019. Salem Online, online.salempress.com/articleDetails.do?articleName=PRDA2e_0171.
APA 7th
Randolph, J. E. (2019). P. In J. E. Kirtley & M. Shally-Jensen (Eds.), Privacy Rights in the Digital Age, 2nd Edition. Salem Press. online.salempress.com.
CMOS 17th
Randolph, Julie E. "P." Edited by Jane E. Kirtley & Michael Shally-Jensen. Privacy Rights in the Digital Age, 2nd Edition. Hackensack: Salem Press, 2019. Accessed May 30, 2026. online.salempress.com.