42 U.S.C. § 299b–24 — Patient safety organization certification and listing

(a) Certification (1) Initial certification. An entity that wants to be a patient safety organization must send the Secretary an initial certification stating that it has policies and procedures for each patient safety activity listed in section 299b–21(5), and that once listed under (d), it will meet the criteria in (b). (2) Subsequent certifications. Every 3 years after its first listing, a patient safety organization must send a new certification stating it is actually performing those activities and meeting those criteria. (b) Criteria (1) In general. To be certified (initially or later), an entity must show: (A) Its mission and main activity are to improve patient safety and health care quality. (B) It has appropriately qualified staff, whether direct employees or contractors, including licensed or certified medical professionals. (C) Within each 24-month period after its first listing, it has genuine contracts of reasonable length with more than one provider to receive and review patient safety work product. (D) It is not, and is not part of, a health insurance issuer. (E) It fully discloses any financial, reporting, or contract relationship with any provider it contracts with, and whether it is not independently managed, controlled, and run apart from any provider it contracts with. (F) As much as practical, it collects patient safety work product from providers in a standard way that allows valid comparisons among similar cases and providers. (G) It uses patient safety work product to give providers direct feedback and help that reduces patient risk. (2) Additional criteria for component organizations. If the entity is part of a larger organization, it must also show: (A) It keeps patient safety work product separate from the rest of the organization and has proper security to keep it confidential. (B) It does not improperly disclose patient safety work product to the rest of the organization. (C) Its mission does not create a conflict of interest with the rest of the organization. (c) Review of certification (1) In general. (A) For an initial certification, the Secretary decides whether it meets the requirements in (a)(1)(A) and (B). (B) For a later certification, the Secretary reviews it against the same requirements in (a)(2)(A) and (B). (2) Notice of acceptance or non-acceptance. If an entity's initial certification meets the requirements, the Secretary must tell it the certification is accepted. If not, the Secretary must tell it the certification is rejected and explain why. (3) Disclosures regarding relationship to providers. The Secretary must consider the disclosures required under (b)(1)(E) and publicly state whether the entity can fairly and accurately do patient safety organization work. The Secretary must factor these findings into deciding whether to accept an initial or later certification, and may deny, place conditions on, or revoke acceptance based on them. (d) Listing. The Secretary must keep a public list of entities whose certification has been accepted under (c)(2)(A) and has not been revoked or voluntarily given up. (e) Revocation of acceptance of certification (1) In general. After giving notice of a problem, a chance for a hearing, and a fair chance to fix it, if the Secretary decides a patient safety organization no longer meets the certification requirements in (a)(2) (including (A) and (B)), the Secretary must revoke acceptance of its certification. (2) Supplying confirmation of notification to providers. Within 15 days of revocation, the organization must confirm to the Secretary that it has taken all reasonable steps to tell every provider whose patient safety work product it collects or analyzes about the revocation. (3) Publication of decision. If the Secretary revokes an organization's certification, the Secretary must remove it from the list in (d) and publish notice of the revocation in the Federal Register. (f) Status of data after removal from listing (1) New data. For the privilege and confidentiality protections in section 299b–22, data sent to an entity within 30 days after it's removed from the list has the same status as data sent while it was still listed. (2) Protection to continue to apply. If privilege and confidentiality protections applied to patient safety work product (or the new data described in (1)) while the entity was listed, those protections keep applying even after the entity is removed from the list. (g) Disposition of work product and data. If the Secretary removes a patient safety organization from the list, for work product or data described in (f)(1) that it got from another entity, the former organization must either: (1) With approval from the other entity and a patient safety organization, transfer the work product or data to that patient safety organization; (2) Return the work product or data to the entity that submitted it; or (3) If returning it isn't practical, destroy it.