As used in this part, the terms listed alphabetically below have the meanings set forth as follows:

Affiliated provider means, with respect to a provider, a legally separate provider that is the parent organization of the provider, is under common ownership, management, or control with the provider, or is owned, managed, or controlled by the provider.

AHRQ stands for the Agency for Healthcare Research and Quality in HHS.

ALJ stands for an Administrative Law Judge of HHS.

Board means the members of the HHS Departmental Appeals Board, in the Office of the Secretary, which issues decisions in panels of three.

Bona fide contract means:

(1) A written contract between a provider and a PSO that is executed in good faith by officials authorized to execute such contract; or

(2) A written agreement (such as a memorandum of understanding or equivalent recording of mutual commitments) between a Federal, State, local, or Tribal provider and a Federal, State, local, or Tribal PSO that is executed in good faith by officials authorized to execute such agreement.

Complainant means a person who files a complaint with the Secretary pursuant to §3.306.

Component organization means an entity that:

(1) Is a unit or division of a legal entity (including a corporation, partnership, or a Federal, State, local or Tribal agency or organization); or

(2) Is owned, managed, or controlled by one or more legally separate parent organizations.

Component PSO means a PSO listed by the Secretary that is a component organization.

Confidentiality provisions means for purposes of subparts C and D, any requirement or prohibition concerning confidentiality established by sections 921 and 922(b)-(d), (g) and (i) of the Public Health Service Act, 42 U.S.C. 299b-21, 299b-22(b)-(d), (g) and (i) and the provisions, at §§3.206 and 3.208, that implement the statutory prohibition on disclosure of identifiable patient safety work product.

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of patient safety work product by:

(1) An entity or natural person holding the patient safety work product to another legally separate entity or natural person, other than a workforce member of, or a health care provider holding privileges with, the entity holding the patient safety work product; or

(2) A component PSO to another entity or natural person outside the component PSO and within the legal entity of which the component PSO is a part.

Entity means any organization or organizational unit, regardless of whether the organization is public, private, for-profit, or not-for-profit.

Group health plan means an employee welfare benefit plan (as defined in section 3(1) of the Employee Retirement Income Security Act of 1974 (ERISA)) to the extent that the plan provides medical care (as defined in paragraph (2) of section 2791(a) of the Public Health Service Act, including items and services paid for as medical care) to employees or their dependents (as defined under the terms of the plan) directly or through insurance, reimbursement, or otherwise.

Health insurance issuer means an insurance company, insurance service, or insurance organization (including a health maintenance organization, as defined in 42 U.S.C. 300gg-91(b)(3)) which is licensed to engage in the business of insurance in a State and which is subject to State law which regulates insurance (within the meaning of 29 U.S.C. 1144(b)(2)). This term does not include a group health plan.

Health maintenance organization means:

(1) A Federally qualified health maintenance organization (HMO) (as defined in 42 U.S.C. 300e(a));

(2) An organization recognized under State law as a health maintenance organization; or

(3) A similar organization regulated under State law for solvency in the same manner and to the same extent as such a health maintenance organization.

HHS stands for the United States Department of Health and Human Services.

HIPAA Privacy Rule means the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), at 45 CFR part 160 and subparts A and E of part 164.

Identifiable patient safety work product means patient safety work product that:

(1) Is presented in a form and manner that allows the identification of any provider that is a subject of the work product, or any providers that participate in, or are responsible for, activities that are a subject of the work product;

(2) Constitutes individually identifiable health information as that term is defined in the HIPAA Privacy Rule at 45 CFR 160.103; or

(3) Is presented in a form and manner that allows the identification of an individual who in good faith reported information directly to a PSO or to a provider with the intention of having the information reported to a PSO (“reporter”).

Nonidentifiable patient safety work product means patient safety work product that is not identifiable patient safety work product in accordance with the nonidentification standards set forth at §3.212.

OCR stands for the Office for Civil Rights in HHS.

Parent organization means an organization that: owns a controlling interest or a majority interest in a component organization; has the authority to control or manage agenda setting, project management, or day-to-day operations; or the authority to review and override decisions of a component organization. The component organization may be a provider.

Patient Safety Act means the Patient Safety and Quality Improvement Act of 2005 (Pub. L. 109-41), which amended Title IX of the Public Health Service Act (42 U.S.C. 299 et seq.) by inserting a new Part C, sections 921 through 926, which are codified at 42 U.S.C. 299b-21 through 299b-26.

Patient safety activities means the following activities carried out by or on behalf of a PSO or a provider:

(1) Efforts to improve patient safety and the quality of health care delivery;

(2) The collection and analysis of patient safety work product;

(3) The development and dissemination of information with respect to improving patient safety, such as recommendations, protocols, or information regarding best practices;

(4) The utilization of patient safety work product for the purposes of encouraging a culture of safety and of providing feedback and assistance to effectively minimize patient risk;

(5) The maintenance of procedures to preserve confidentiality with respect to patient safety work product;

(6) The provision of appropriate security measures with respect to patient safety work product;

(7) The utilization of qualified staff; and

(8) Activities related to the operation of a patient safety evaluation system and to the provision of feedback to participants in a patient safety evaluation system.

Patient safety evaluation system means the collection, management, or analysis of information for reporting to or by a PSO.

Patient safety organization (PSO) means a private or public entity or component thereof that is listed as a PSO by the Secretary in accordance with subpart B. A health insurance issuer or a component organization of a health insurance issuer may not be a PSO. See also the exclusions in §3.102 of this part.

Patient safety work product:

(1) Except as provided in paragraph (2) of this definition, patient safety work product means any data, reports, records, memoranda, analyses (such as root cause analyses), or written or oral statements (or copies of any of this material)

(i) Which could improve patient safety, health care quality, or health care outcomes; and

(A) Which are assembled or developed by a provider for reporting to a PSO and are reported to a PSO, which includes information that is documented as within a patient safety evaluation system for reporting to a PSO, and such documentation includes the date the information entered the patient safety evaluation system; or

(B) Are developed by a PSO for the conduct of patient safety activities; or

(ii) Which identify or constitute the deliberations or analysis of, or identify the fact of reporting pursuant to, a patient safety evaluation system.

(2)

(i) Patient safety work product does not include a patient's medical record, billing and discharge information, or any other original patient or provider information; nor does it include information that is collected, maintained, or developed separately, or exists separately, from a patient safety evaluation system. Such separate information or a copy thereof reported to a PSO shall not by reason of its reporting be considered patient safety work product.

(ii) Patient safety work product assembled or developed by a provider for reporting to a PSO may be removed from a patient safety evaluation system and no longer considered patient safety work product if:

(A) The information has not yet been reported to a PSO; and

(B) The provider documents the act and date of removal of such information from the patient safety evaluation system.

(iii) Nothing in this part shall be construed to limit information that is not patient safety work product from being:

(A) Discovered or admitted in a criminal, civil or administrative proceeding;

(B) Reported to a Federal, State, local or Tribal governmental agency for public health or health oversight purposes; or

(C) Maintained as part of a provider's recordkeeping obligation under Federal, State, local or Tribal law.

Person means a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.

Provider means:

(1) An individual or entity licensed or otherwise authorized under State law to provide health care services, including—

(i) A hospital, nursing facility, comprehensive outpatient rehabilitation facility, home health agency, hospice program, renal dialysis facility, ambulatory surgical center, pharmacy, physician or health care practitioner's office (includes a group practice), long term care facility, behavior health residential treatment facility, clinical laboratory, or health center; or

(ii) A physician, physician assistant, registered nurse, nurse practitioner, clinical nurse specialist, certified registered nurse anesthetist, certified nurse midwife, psychologist, certified social worker, registered dietitian or nutrition professional, physical or occupational therapist, pharmacist, or other individual health care practitioner;

(2) Agencies, organizations, and individuals within Federal, State, local, or Tribal governments that deliver health care, organizations engaged as contractors by the Federal, State, local, or Tribal governments to deliver health care, and individual health care practitioners employed or engaged as contractors by the Federal State, local, or Tribal governments to deliver health care; or

(3) A parent organization of one or more entities described in paragraph (1)(i) of this definition or a Federal, State, local, or Tribal government unit that manages or controls one or more entities described in paragraphs (1)(i) or (2) of this definition.

Research has the same meaning as the term is defined in the HIPAA Privacy Rule at 45 CFR 164.501.

Respondent means a provider, PSO, or responsible person who is the subject of a complaint or a compliance review.

Responsible person means a person, other than a provider or a PSO, who has possession or custody of identifiable patient safety work product and is subject to the confidentiality provisions.

Workforce means employees, volunteers, trainees, contractors, or other persons whose conduct, in the performance of work for a provider, PSO or responsible person, is under the direct control of such provider, PSO or responsible person, whether or not they are paid by the provider, PSO or responsible person.