42 U.S.C. § 299b–21 — Definitions

(1) HIPAA confidentiality regulations. This means the regulations written under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191). (2) Identifiable patient safety work product. This is patient safety work product that: (A) Is presented in a way that lets someone identify a provider who is the subject of the work, or providers who took part in what it's about; (B) Counts as "individually identifiable health information" under the HIPAA confidentiality regulations; or (C) Is presented in a way that lets someone identify who reported the information, as described in section 299b–22(e). (3) Nonidentifiable patient safety work product. This is patient safety work product that is not identifiable, as defined in (2). (4) Patient safety organization. This is a private or public entity, or part of one, that the Secretary has listed under section 299b–24(d). (5) Patient safety activities. These are: (A) Work to improve patient safety and health care quality. (B) Collecting and analyzing patient safety work product. (C) Developing and sharing information — like recommendations, protocols, or best practices — to improve patient safety. (D) Using patient safety work product to build a culture of safety and give feedback and help to reduce patient risk. (E) Keeping procedures that protect the confidentiality of patient safety work product. (F) Providing proper security for patient safety work product. (G) Using qualified staff. (H) Running a patient safety evaluation system and giving feedback to people who take part in it. (6) Patient safety evaluation system. This is the collecting, managing, or analyzing of information to report to, or by, a patient safety organization. (7) Patient safety work product (A) In general. Except as explained in (B), this means data, reports, records, memos, analyses (like root cause analyses), or written or spoken statements that either: (i) Are put together by a provider to report to a patient safety organization and are actually reported, or are developed by a patient safety organization to carry out patient safety activities — and could improve patient safety, health care quality, or outcomes; or (ii) Identify or are part of the deliberations or analysis of a patient safety evaluation system, or show that something was reported through one. (B) Clarification. (i) This does not include a patient's medical record, billing and discharge information, or any other original patient or provider record. (ii) This does not include information collected, kept, or developed separately from a patient safety evaluation system. If that separate information (or a copy) is reported to a patient safety organization, reporting it does not turn it into patient safety work product. (iii) Nothing in this part limits: whether such separate information can be discovered or used as evidence in a criminal, civil, or administrative case; reporting such information to a federal, state, or local agency for public health or health oversight purposes; or a provider's recordkeeping duties for such information under other law. (8) Provider. This means: (A) An individual or entity licensed or otherwise allowed under state law to give health care services, including — a hospital, nursing facility, outpatient rehab facility, home health agency, hospice, dialysis facility, ambulatory surgical center, pharmacy, physician or practitioner's office, long-term care facility, behavioral health residential facility, clinical laboratory, or health center; or a physician, physician assistant, nurse practitioner, clinical nurse specialist, certified registered nurse anesthetist, certified nurse midwife, psychologist, certified social worker, registered dietitian or nutrition professional, physical or occupational therapist, pharmacist, or other individual health care practitioner; or (B) Any other individual or entity the Secretary names in regulations.