42 U.S.C. § 299b–22 — Privilege and confidentiality protections

(a) Privilege. Despite any other federal, state, or local law, and subject to subsection (c), patient safety work product is privileged. It cannot be: (1) Subpoenaed or ordered produced in a federal, state, or local civil, criminal, or administrative case, including disciplinary cases against a provider; (2) Discovered in such a case; (3) Disclosed under the Freedom of Information Act or a similar state or local law; (4) Used as evidence in a federal, state, or local government civil, criminal, rulemaking, or adjudicatory proceeding, including against a provider; or (5) Used in a professional disciplinary proceeding run by a state-authorized disciplinary body. (b) Confidentiality. Despite any other law, and subject to subsection (c), patient safety work product is confidential and cannot be disclosed. (c) Exceptions. Except as provided in (g)(3): (1) Exceptions from both privilege and confidentiality. Subsections (a) and (b) do not block: (A) Disclosing relevant work product for a criminal case — but only after a court privately reviews it and finds it contains evidence of a crime, is material to the case, and isn't reasonably available elsewhere. (B) Disclosing work product as needed to carry out subsection (f)(4)(A) (equitable relief for retaliation). (C) Disclosing identifiable work product if every provider named in it agrees. (2) Exceptions from confidentiality only. Subsection (b) does not block: (A) Disclosure to carry out patient safety activities. (B) Disclosure of nonidentifiable work product. (C) Disclosure to grantees, contractors, or others doing authorized research, evaluation, or demonstration projects — as far as HIPAA rules would allow disclosing protected health information for that purpose. (D) Disclosure by a provider to the FDA about a product or activity the FDA regulates. (E) Voluntary disclosure by a provider to its own accrediting body. (F) Disclosures the Secretary decides are needed for business operations and fit this part's goals. (G) Disclosure to law enforcement about a crime, or a suspected crime, if the discloser reasonably believes it's necessary for law enforcement. (H) For anyone other than a patient safety organization, disclosure of work product that does not judge the quality of care of an identifiable provider or describe an identifiable provider's actions or failures. (3) Exception from privilege only. Subsection (a) does not block voluntary disclosure of nonidentifiable work product. (d) Continued protection of information after disclosure (1) In general. Work product disclosed under (c) stays privileged and confidential; the disclosure is not a waiver, and the protections follow the work product even after someone else receives it. (2) Exception. Despite (1), and subject to (3): (A) If work product is disclosed in a criminal case, its confidentiality protection (not privilege) ends for that disclosed work product. (B) If work product is disclosed as nonidentifiable under (c)(2)(B), both its privilege and confidentiality protections end for that work product. (3) Construction. (2) does not end protection for any other patient safety work product besides what was actually disclosed. (4) Limitations on actions (A) Patient safety organizations. (i) A patient safety organization cannot be forced to disclose information it collected or developed under this part — whether or not it's patient safety work product — unless the information is identified, is not patient safety work product, and isn't reasonably available elsewhere. (ii) This limit does not apply to actions against a patient safety organization itself, or to disclosures under (c)(1). (B) Providers. An accrediting body cannot take accrediting action against a provider for good-faith participation in collecting, developing, reporting, or keeping patient safety work product under this part. It also cannot require a provider to reveal its communications with a patient safety organization. (e) Reporter protection (1) In general. A provider cannot take an adverse employment action against someone because that person, in good faith, reported information to the provider meaning to have it sent to a patient safety organization, or reported it directly to one. (2) Adverse employment action means: (A) Losing a job, not getting promoted, or losing any other job benefit the person would otherwise get; or (B) A negative decision about the person's accreditation, certification, credentialing, or licensing. (f) Enforcement (1) Civil monetary penalty. Subject to (2) and (3), anyone who knowingly or recklessly discloses identifiable patient safety work product in violation of (b) can be fined up to $10,000 per violation. (2) Procedure. The rules in section 1320a–7a (except subsections (a), (b), and the first sentence of (c)(1)) apply to these penalties the same way they apply under that section. (3) Relation to HIPAA. The same act or omission cannot be penalized under both this subsection and the HIPAA regulations issued under section 264(c)(1). (4) Equitable relief (A) In general. Any harmed individual may sue to stop conduct that violates subsection (e) and to get other fair relief — including getting their job back, back pay, and restored benefits. (B) Against State employees. A state or state agency cannot claim the privilege in subsection (a) unless it has already agreed to be sued under (A), and that agreement is still in effect. (g) Rule of construction. Nothing in this section: (1) Limits other federal, state, or local laws that give greater privilege or confidentiality than this section does; (2) Limits or changes the law's requirements for information that isn't privileged or confidential under this section; (3) Except as provided in (i), changes how the HIPAA confidentiality regulations or section 1320d–5 apply; (4) Limits any provider's, patient safety organization's, or other entity's power to make a contract requiring more confidentiality or letting someone else make a disclosure under this section; (5) Preempts or affects a state law requiring a provider to report information that isn't patient safety work product; or (6) Limits any requirement to report product or activity safety information to the FDA. (h) Clarification. Nothing in this part stops anyone from doing more analysis on the same or similar issues that were already reported to or assessed by a patient safety organization or evaluation system. (i) Clarification of application of HIPAA confidentiality regulations to patient safety organizations. Under the HIPAA confidentiality regulations: (1) Patient safety organizations count as "business associates"; and (2) Their patient safety activities involving a provider count as that provider's "health care operations." (j) Reports on strategies to improve patient safety (1) Draft report. No later than 18 months after any network of patient safety databases starts operating, the Secretary, with the Director, must write a draft report on effective strategies to reduce medical errors and improve patient safety, including any measures the Secretary thinks should encourage using them, including in federally funded programs. The Secretary must let the public comment on the draft and send it to the Institute of Medicine for review. (2) Final report. No later than 1 year after the date in (1), the Secretary must send Congress a final report.