Confidentiality Training: PSO Improving Quality and Patient Care

February 23, 2017

Caveats• This is not legal advice.• Any characters in any stories or examples are

factious - Any likeness to real people, events, or PSWP is purely coincidental.• Please ask questions along the way. This webinar

is for you.• If you have specific questions contact your PSO

or me.

Training OverviewThe Patient Safety Act requires that Patient Safety Work Product (PSWP) be confidential and not be disclosed by anyone holding the PSWP, except as permitted by law. The objectives of this training are to identify:- Review of Confidentiality Protections.- Review of Patient Safety Work Product.- How and when do the confidentiality protections

attach?- What are prohibited/permissible disclosures?- How can the Patient Safety Work Product be Used?

Protections to Empower Healthcare Providers to Implement Safety Culture

• Confidentiality (HIPAA for Providers) – The Act places a statutory requirement on providers not to disclose “Patient Safety Work Product,” except under a specific disclosure permission and imposes penalties of over $11,000 per violation against any person or principal who knowingly or recklessly violates the confidentiality provisions.

• Privilege – PSWP is privileged and cannot be discovered, used as evidence in a local, state or Federal proceeding or in a state disciplinary proceeding.

• Whistleblower – No disciplinary action for reporting – only attaches if the report would not have otherwise been made. Cannot attach for reports mandated by federal, state or local law.

“The single greatest impediment to error prevention in the medical industry is that we punish people for making mistakes.”

- Lucian Leape4

Structure of the PSQIA:Once information becomes PSWP, a provider cannot disclose it unless there is a disclosure permission.

ReporterWhistle-BlowerProtectionsforreportingqualityinformationthatwouldnototherwisebecollected/analyzedandisnotanexistingexternalobligation InformationbecomesPSWP- privilegeand

confidentialityprotectionsattach.-CollectionofdataforPSESanalysis,investigation,anddeliberationsinthePSES;or- Collection,analysis,deliberationsinPSO;or

- CollectedanddevelopedforreportingandisreportedtoaPSO

PSOAnalytics,investigationRCA,deliberationssafetables,

collaborations,bestpractices,clinicalprotocoldevelopment

Learningfromdataandanalytics- bestpractices;clinicalprotocols;safetyCulture

DisclosurePermissiontoimprovehealthcaresystem

Review: Three buckets of PSWP

InformationthatiscollectedinthePSESandReportedtothePSO

Analysis(RCSA)andConversations(CommitteeMeetings)DevelopActionplansandchangesinclinicalprotocols

PS0DevelopedFeedback

Patient Safety Work Product: Reporting PathwayAny data, reports, records, memoranda, analysis (such as root cause analysis), or written or oral statements which are assembled or developed by a provider [solely for the purpose of] reporting to a patient safety organization and are reported to a patient safety organization.

Used to collect and report occurrence reports, which are privileged in the PSO but not in the hospital.

“Additional” information – that which is not required and would not be reported but for the PSQIA protections.

7

Patient Safety Work ProductPatient Safety Work Product is NOT –

• Original records – medical records, billing records • PSWP does not include information that is collected, maintained, or

developed separately, or exists separately, from a patient safety evaluation system (e.g., required to be reported to the state or needed for oversight under the Conditions of Participation).

8

Patient Safety Work Product: Analysis Pathway

Any data, reports, records, memoranda, analysis (such as root cause analysis), or written or oral statements which:• Identify the deliberations or analysis of a patient safety evaluation system.

Example: Memorandum of a RCSA, materials collected to conduct an analysis (medical records and radiology films for a specific cardiovascular procedure). • Constitute the deliberations or analysis of a patient safety evaluation

system. Example: Predictive analytics, patterns and trends.

9

Patient Safety Evaluation System (PSES)

The collection, management, or analysis of confidential information for reporting to or by a PSO.• Clinical Prospective: Where providers can evaluate how they improve

upon the high quality job they are doing.• Legal Prospective: Where patient safety activities (quality improvement

activities) occur. Identifies protected information and protected space.

“These protections will enable all health care systems, including multi-facility health care systems, to share data within a protected legal environment, both within and across states, without the threat that the information will be used against the subject providers”.

PSA final Rule

10

Patient Safety Work Product: PSO Pathway

Any data, reports, records, memoranda, analysis (such as root cause analysis), or written or oral statements which are developed by a PSO for the conduct of patient safety activities and which could result in improved patient safety, health care quality, or health care outcomes.• A PSO Cannot be Compelled: A patient safety organization cannot be

compelled to disclose information collected or developed whether or not such information is patient safety work product unless the court or government can:• Identify the specific information,• Prove the information is not patient safety work product, and • Show they cannot reasonably available from another sourc

What is PSO work-product: Analysis, investigations, best practices, recommendations, charts, graphs, measures.

11

Written Reports of Witness Accounts of What they Observed at the Time of a Patient Incident

NotPSWPifpreparedfor• For internal risk management

(claims and liability)

Reporting Pathway: Could be PSWP if Information is not required for another purpose and is Prepared solely for Reporting to a PSO.

• The provider originally prepares the written reports for reporting to the PSO so that the richness of the narrative can be mined for contributing factors.

Written Reports of Witness Accounts of What they Observed at the Time of a Patient Incident (Con’t)

A&D Pathway• The provider prepares a narrative of why

the incident happened and what they believe could be the contributory factors –the narrative is prepared in the PSES.

• The provider facility investigates the incident by interviewing those involved.

• The team conduct a huddle to determine what went wrong and how to correct it. Documents huddle on a form that identifies the analysis.

• Conduct the RCSA with staff and clinical contractors

PSO Pathway• Convening/Safe Table of all

hospital staff to learn and continuously improve clinical protocols.

When Does PSWP become Confidential

• Once created PSWP should be marked as PSWP to indicate that the PSO protections have attached to the information. Examples:

• PSWP Developed for Reporting to the PSO• PSWP Developed in the PSES• PSWP Developed by the PSO

What is a Disclosure?•Disclosure is the release of information outside of

the hospital for which a specific disclosure permission must be applicable.• “Use” of PSWP means “the sharing of PSWP for

any purpose within a legal entity ( hospital or health system). • A hospital may use PSWP for any purpose within

the hospital and the information remains confidential

PSWP Impermissibly Disclosed does not Lose its Protection

• Person who holds PSWP that should not have been disclosed is subject to the confidentiality protections and fines. • Person becomes a “responsible person” and can disclose the

information under a permissible disclosure.• Provider has the burden of proof and the more the information

is disclosed the more difficult it is to prove the information is PSWP.

• The disclosure of Patient Safety Work Product is prohibited unless the transfer or release falls within one of the statutory exceptions identified in 42 C.F.R. §3.206(b):• Disclosure authorized in writing by all identified providers;• To carry out Patient Safety Activities; between a Provider, its

contractor and a PSO; among affiliated providers; to another PSO or provider in a redacted form;• Disclosure for non-identifiable work product;• To grantees carrying out research authorized by the Secretary;• To the Food and Drug Administration with respect to a regulated

product or activity;• Voluntary disclosure by the Provider to an accrediting body;

Disclosure of Patient Safety Work Product

17

• Disclosures to attorneys, accountants or other professionals for business operations or disclosures which the Secretary may determine are necessary for business operations;

• To law enforcement agencies relating to the commission of a crime;• Disclosure in criminal proceedings (after in camera review to

determine whether the PSWP contains material evidence of a crime unavailable from another source);

• Disclosure to permit equitable relief for reporters.• Patient Safety Work Product remains privileged and

confidential in the hands of the transferee, with the exception of non-identifiable patient safety work product. 42 U.S.C. §299-22b(d)(2)(B).

Disclosure Of Patient Safety Work Product, (continued)

18

Permissible Disclosure: Identifiable PSWP may be Disclosed if all Providers Agree

• If all providers identified in the PSWP agree in a contract identifiable PSWP may be shared and the PSWP remains privileged and confidential. Sharing PSWP may be a condition of employment. In most instances, the PSWP that is shared must be stored in a PSES. The contract must be maintained for 5-years.

Examples:• Providers may use PSWP in their defense in a court action if all the

providers agree.• A provider may disclose PSWP to an EHR vendor in the safety

culture. Vendor must have a PSES. • A provider may disclose identifiable PSWP to a nonaffiliated

provider.

Permissible Disclosure: Between Providers and the PSO

• To carry out Patient Safety Activities; between a Provider, its contractor and a PSO; among affiliated providers; to another PSO or provider in a deidentified form;• Contractors cannot disclose PSWP without specific permission from the

PSO or Provider.• Common misunderstanding – once information is reported to the PSO the

provider can never get it back from the PSO. Truth is the information can be disclosed back to the provider.

Sharing PSWP: Affiliated Providers • Definition of affiliated provider identifies to whom

identifiable patient safety work product may be disclosed to under the disclosure provision (42 CFR 3.06(b)(4)(iii).• Affiliated Provider – Legally separate provider that is the

parent organization of the provider, is under common ownership, management, or control with the provider, or is owned, managed or controlled by the provider. (42 CFR 3.20)• Affiliated providers includes: doctors with hospital

privileges. • Sharing occurs in PSES to PSES• PSO can share identifiable PSWP to affiliated providers

(parent)• More analysis must be performed in the PSO than the

provider PSES

Permissible Disclosure: Non-Identifiable PSWP

• Non-Identifiable PSWP may be disclosed by a provider outside of the facility. Non-identifiable PSWP is presented in a form or manner that does not allow the identification of:

• Any health care provider that is the subject of the PSWP;• The patient or any Personal Health Information; and • Any individual who reported the PSWP.

• An example of Non-identifiable PSWP is aggregated data, trends or best practice recommendations.• The non-identifiable PSWP remains privileged and

confidential until the provider or PSO voluntarily releases it.• Regulators cannot make PSWP into unprotected information

simply because it is nonidentifiable.

Permitted Disclosures: FDA• To the Food and Drug Administration with respect to a regulated

product or activity;

If during an RCA, it is discovered that a medical device failed, the provider can report the incident to the FDA under a disclosure. All RCA information must be kept privileged and confidential and FDA may only use the information for determining the safety of medical devices and for no other purpose.

Permitted Disclosure: Accrediting Body• Voluntary disclosure by the Provider to an accrediting body;

• Cannot share provider identifiable information unless the provider agrees. Many providers make this agreement a condition of employment.• The Accrediting Body must know the information is PSWP.• Best practice – have the accrediting body sign the confidentiality

agreement that they provided AQIPS. The accrediting body must know that the information is PSWP.• State agency/CMS surveyors are not accrediting bodies.

Permitted Disclosures: Business Operations• Disclosures to attorneys, accountants or other professionals for business

operations or disclosures which the Secretary may determine are necessary for business operations;• Example: outside counsel

Permitted Disclosure: Law Enforcement• A provider may voluntarily disclose PSWP to law enforcement agencies

relating to the commission of a crime if the provider has a reasonable belief that a crime has been committed (probable cause).• Law enforcement agency can only use the PSWP for the investigation and

no other purpose. Must keep PSWP privileged and confidential.• Must be a Law Enforcement Agency – CMS is not; Coroners are not; FDA

is not.

Permissible Disclosure: Criminal Proceeding and Equitable Relief• Disclosure in criminal proceedings (after indictment) (after in camera

review to determine whether the PSWP contains material evidence of a crime that is unavailable from another source);

• Disclosure to permit equitable relief for reporters.

Safe Harbors• Workforce Safe Harbor

Provider may release information that does not assess a provider’s quality of care or identify specific acts or errors attributable to a provider that could be reported to a PSO. This is how a provider may market how great they are doing because of the PSO.

• Non-Disclosure Safe Harbor

The provider disclosing non-identifiable information has no actual knowledge that the information to be disclosed could be used, alone or in combination with other information that is reasonably available to the intended recipient, to identify the particular provider.

28

Best Practices for Handing Disclosure Request• Create a process in your policies and procedures:• Identifies the individual who is responsible for determining

whether a disclosure is warranted and appropriate. The request may be granted, granted in part, or denied at the discretion of the provider. The disclosure is documented and the person receiving the PSWP knows it remains privileged and confidential.• Requires the individual making the request to document why

they want the information, how it will be used and that they understand the information remains privileged and confidential upon disclosure.

Examples of Permitted Disclosures• Health Care Provider shares with his patients that he is

reporting to PSO to continually improve the quality of patient care.

• A hospital shares the recommendation of the PSO with its Health Care Providers.

• Hospital shares with its community the high quality performance based on PSO analysis but does not share specific PSWP.

Examples of Unpermitted Disclosures

• Disclosure of PSWP (e.g., patterns and trends of serious events, RCAs) by an analytical contractor.• A patient authorizes a healthcare provider to give a

PSWP RCA to his/her lawyer.• Sharing information about a discussion that occurred

inside the PSES between the PSES workforce members who are investigating a serious adverse event.• Rule states that PSWP cannot be disclosed to state

agency surveyors – but the guidance states that PSWP must be provided to surveyors.

How to Prepare for a Survey• Provider makes a list of all the data surveyors can see that

meets external obligations (state and Federal).• Provider should not list what is PSWP – Our experience is

that CMS Surveyor will ask for everything on the list –including protected analysis (NorMet Example).• PSO meets with state surveyor agency to educate them on

the PSQIA and discuss what information is necessary to comply with survey (Florida).

What if Information has Been Reported to the PSO• If required to be reported (e.g., measures) it is NOT PSWP even if it

is in the PSES. • Provider can determine that it is was mistakenly deemed as PSWP

and pull it out of the PSES.• Recreate analysis outside the PSES.• Disclosure permission

• All providers agree (protections are maintained) (can make this agreement a condition of privileges or employment)

• FDA disclosure (example device failure/problem discovered in an RCA) RCA remains PSWP.

• Disclosure to an accrediting body (within the PSES and remains privileged and confidential.

Best Practice if CMS Surveyors Take PSWP

• Be sure the document is clearly marked as PSWP. • Ask Surveyor to sign documentation to document the

disclosure and a confidentiality agreement. • Precedent – HIPAA lawyers will advise clients to have

CDC sign a disclosure statement when they take PHI for public health surveillance.• PSWP cannot be used against a provider by CMS but

CMS posts the confidential information as part of its survey results on the Healthcare Journalists Website.

PSWP Confidentiality Training: Test•Please complete this True/False test to receive credit for this training:

1. PSWP (Patient Safety Work Product) is any data, reports, records, memoranda, analysis (such as Root Cause Analyses), or written or oral statements (or copies of any of this material) which could improve patient safety, health care quality, or health care outcomes. True or False

2. If a provider can release patient information under HIPAA, he/she can release it under the Patient Safety Act. True or False

3. Qualified Expert PSO work force who has access to Patient Safety Work Product, Patient Safety Evaluation System and Feedback and recommendations from the PSO is NOT subject to the Patient Safety Act’s confidentiality requirements. True or False

4. The identity of the individual who reported the PSWP is considered to be PSWP and is confidential. True or False

5. The Patient Safety Evaluation System (PSES) exists anywhere that patient safety activities occur in the health care facility. and includes the process of collection, management, or analysis of information and providing feedback to the hospital. True or False

6. An example of an unauthorized disclosure would be the release of non-identifiable information by the contractor to a third party. True or False

7. A patient’s medical record, billing and discharge information, or any other original patient or provider information is PSWP. True or False

8. All PSWP, including the identity of the provider and hospital, is confidential when reported to a PSO. True or False

9. Disclosure of identifiable PSWP by a provider to an accrediting body that agrees to keep the PSWP confidential is a permitted disclosure under the Patient Safety Act. True or False

10. As a general rule, a person who discloses identifiable PSWP in knowing or reckless violation of the confidentiality provisions is subject to a fine for each disclosure that is more than $11,000. True or False

Questions