2024 Compliatric Webinar Series - Managing and Protecting Adverse Patient Event Information.pdf

April 25, 2024
Managing and Protecting Adverse Patient
Event Information: Legal Requirements and
Best Practices for Health Centers
1

DISCLAIMER
These materials have been prepared by the attorneys of Feldesman
Leifer LLP. The opinions expressed in these materials are the views
of Feldesman Leifer LLP and not necessarily the views of the
federal government, any state government or of any other
organization or person.
The materials are being issued with the understanding that the
authors are not engaged in rendering legal or other professional
services. If legal assistance or other expert assistance is required,
the services of a competent professional with knowledge of your
specific circumstances should be sought.
Feldesman Leifer LLP. © 2024 All rights reserved. | Feldesman.com 2

TODAY’S PRESENTER
Feldesman Leifer LLP. © 2024 All rights reserved. | Feldesman.com
Molly, a member of the firm’s Management Committee,
advises health centers on the management of clinical,
employment and workforce related risks, with a particular
focus on professional liability, FTCA and HIPAA matters.
Molly counsels health care entities such as community
health centers on contracting, regulatory compliance, fraud
and abuse, patient privacy and confidentiality and risk
management matters.
From her experience as both a private attorney and in-
house counsel, Molly knows the importance of managing
liability and risk issues in mission-driven organizations.
Molly S. Evans
Partner
mevans@feldesman.com
3

COPYRIGHT NOTICE OF ORIGINAL MATERIALS
• These slides are being made available to you and your organization as a participant of a
Feldesman Leifer LLP program. You are ONLY permitted to duplicate, reproduce and/or
distribute these materials within your organization.
• Note: a membership organization may not consider its members to be “within the
organization” for purposes of sharing materials.
• These slides may not be otherwise photocopied, reproduced, duplicated, and/or
distributed outside your organization and/or posted on a website without prior written
permission from the authors.
• Any other use or disclosure is a violation of federal copyright law and is punishable by the
imposition of substantial fines.
• Copyright is claimed in all original material, including but not limited to these slides and
other resources or handouts provided in connection to this training, exclusive of any
materials from federal laws and regulations and any documents published by the federal
government.

AGENDA
I. Adverse Patient Event Risk Management
under The Health Center Federal Tort Claims
Act (FTCA) Program
II. Protection under The Patient Safety and
Quality Improvement Act (PSQIA)
III. The Separation of Information Discovery
Protection vs. Information Storage
Methodologies
IV. Methods of Protecting Documents from
Legal Discovery

Adverse Patient Event Risk Management under the FTCA Program

OGC LITIGATION HOLD LETTER
• Identify all employees who have information related to the litigation and
provide it to OGC.
• Issue written notification to all health center employees (sample litigation hold
notice provided by OGC).
• Provide OGC with a list of relevant health center IT and HIMS supervisors who
have responsibility for IT systems. Send IT department litigation hold memo
and discuss record retention, backup practices, and related items.
• Provide OGC with information related to the health center’s document
retention policies.
• Re-issue litigation hold notice to all health center employees every three
months.
• Provide OGC with a copy of the health center’s litigation hold notice.

OGC LITIGATION HOLD LETTER
• All medical records
• All billing records
• All communications between patient and health center (and any of its employees)
• All communications between any third party and the health center (and any
employees concerning patient’s medical care and treatment)
• All records pertaining to health center’s employee(s) named in the complaint
licensure, certification, and employment history with the health center, including
any personnel files maintained by the health center
• Any documentation the health center and/or its employees distributed to the
patient
• Any policies of the health center in effect during the time the patient was being
treated by the health center that bear upon standards for medical treatment

Who to Contact if You Receive Notice of a Claim or Lawsuit:
U.S. Department of Health and Human Services
Office of the General Counsel
General Law Division
Attention: CLAIMS
330 C Street SW
Switzer Bldg, Suite 2600
Washington D.C. 20201
202-619-2155
202-619-2922 (fax)
HHS-FTCA-Claims@hhs.gov
**IMPORTANT- CONFIRM RECEIPT OF
ALL DOCUMENTS E-MAILED OR FAXED

Protection under The Patient Safety and Quality Improvement Act
(PSQIA)
The Patient Safety Act (42 U.S.C. sections 299b-21 to 299b-26) is the
Federal law that created patient safety organizations (PSOs),
confidentiality and privilege protections for information meeting
the definition of patient safety work product, authority for
AHRQ's development of the Common Formats, and the network of
patient safety databases (NPSD).
The Patient Safety Rule (42 CFR Part 3) is the Federal regulation
that implements the Patient Safety Act.
HHS Guidance documents explain, in general, how HHS interprets
some aspects of the Patient Safety Act.
Source: https://pso.ahrq.gov/resources/psqia

(PSQIA)
The Patient Safety Act recognizes the goal of accountability and transparency,
and it attempts to balance this goal with that of improving patient safety and
reducing medical errors.
The Patient Safety Act promotes the goal of improving patient safety and
reducing medical errors by establishing a system in which health care
providers can voluntarily collect and report information related to patient
safety, health care quality, and health care outcomes to PSOs.
The intent of the system established by the Patient Safety Act is to protect the
additional information created through voluntary patient safety activities, not
to protect records created through providers’ mandatory information
collection activities.
Source: https://pso.ahrq.gov/sites/default/files/wysiwyg/guidance-pswp-provider-obligations.pdf

(PSQIA)
“Patient Safety Work Product (PSWP)”
PSWP is “any data, reports, records, memoranda, analyses (such as root
cause analyses), or written or oral statements” that, in pertinent part, (1)
are assembled for reporting to a PSO and are reported to a PSO, or are
developed by a PSO for the conduct of patient safety activities, and that
could result in improved patient safety, health care quality, or health care
outcomes; or (2) identify or constitute the deliberations or analysis of, or
identify the fact of reporting pursuant to, a patient safety evaluation
system (PSES). 42 U.S.C. § 299b-21(7)(A)

(PSQIA)
Patient Safety Work Product (PSWP)
PSWP does not include:
“(i) a patient's medical record, billing and discharge information, or any other original
patient or provider record.
(ii) Information described in subparagraph (A) does not include information that is
collected, maintained, or developed separately, or exists separately, from a patient
safety evaluation system. Such separate information or a copy thereof reported to a
patient safety organization shall not by reason of its reporting be considered patient
safety work product.
(iii) Nothing in this part shall be construed to limit--
(I) the discovery of or admissibility of information described in this subparagraph in a
criminal, civil, or administrative proceeding;
(II) the reporting of information described in this subparagraph to a Federal, State, or
local governmental agency for public health surveillance, investigation, or other public
health purposes or health oversight purposes; or
(III) a provider's recordkeeping obligation with respect to information described in this
subparagraph under Federal, State, or local law.”
42 U.S.C. § 299b-21(7)(B)

(PSQIA)
299b–22. Privilege and confidentiality protections
(a) Privilege
Notwithstanding any other provision of Federal, State, or local law, and subject to subsection (c), patient safety
work product shall be privileged and shall not be—
(1) subject to a Federal, State, or local civil, criminal, or administrative subpoena or order, including in a
Federal, State, or local civil or administrative disciplinary proceeding against a provider;
§ (2) subject to discovery in connection with a Federal, State, or local civil, criminal, or administrative
proceeding, including in a Federal, State, or local civil or administrative disciplinary proceeding against a
provider;
(3) subject to disclosure pursuant to section 552 of title 5 (commonly known as the Freedom of Information
Act) or any other similar Federal, State, or local law;
(4) admitted as evidence in any Federal, State, or local governmental civil proceeding, criminal proceeding,
administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such
proceeding against a provider; or
(5) admitted in a professional disciplinary proceeding of a professional disciplinary body established or
specifically authorized under State law.

(PSQIA)
(b) Confidentiality of patient safety work product
Notwithstanding any other provision of Federal, State, or local law, and subject to subsection
(c), patient safety work product shall be confidential and shall not be disclosed.

The Separation of Information Discovery Protection vs. Information
Storage Methodologies
Information Discovery Protection
Protecting sensitive communications from being disclosed
during the legal discovery process through the assertion of
privilege.
Privilege: Attorney-client privilege, work-product doctrine,
state law-controlled peer review privilege.
Other Legal Bases to withhold documents from discovery:
PSWP in a PSO.

Establishing Privilege:
• Utilizing federal/state protections.
• Clearly marking privileged communications.
• Keeping privileged information separate from other
documents.
• Training staff on the importance of maintaining privilege.
• Challenges: Overcoming claims of waiver of privilege and
inadvertent disclosure during broad discovery requests.

Best Practices:
• Implementing a document review process that identifies
and segregates privileged material.
• Using privilege logs to document the basis for non-
disclosure.
• Consulting with legal counsel to navigate complex privilege
assertions.

Information Storage Methodologies: Data Protection
Strategies Beyond Privilege
• Safeguarding information from unauthorized access, data
breaches, and other forms of compromise.
• Protecting information regardless of its privileged status to
maintain confidentiality and integrity.

Information Storage Methodologies: Data Protection
Strategies Beyond Privilege
Security Measures:
• Employing encryption for data at rest and in transit.
• Utilizing robust cybersecurity frameworks.
• Regular vulnerability assessments and penetration testing.
• Incident Response: Having a plan in place for potential data
breaches to minimize impact and comply with notification
laws.

Methods of Protecting Documents from Legal Discovery
• Attorney-Client Privilege: Ensures communications
between attorneys and their clients remain confidential and
are not subject to discovery.
• State Peer Review Privilege: Protects the confidentiality of
records related to peer review activities in healthcare
settings.
– Varies by state; know the specific statutes and how they
apply to the documents in question.

Asserting Privilege:
• Properly label and segregate privileged documents.
• Establish protocols to avoid inadvertent waivers of
privilege.
Challenges:
• Navigating variations in state laws regarding peer review
privilege.
• Educating staff on the identification and handling of
privileged information.

Special Protections for Patient Safety and Quality
Assurance Documents
Ensuring documents are generated or assembled for
submission to a PSO and thus considered PSWP.
Maintain separate systems for PSWP and other documents to
avoid commingling.
Best Practices:
Regular audits to ensure compliance with PSWP
documentation and handling requirements.
Training programs for healthcare providers and staff on
proper PSWP procedures.

mevans@feldesman.com
Molly Evans

Washington, DC
1129 20th Street, NW
Suite 400
Washington, DC 20036
P: 202.466.8960
training@feldesman.com
Sacramento, CA
400 Capitol Mall
Suite 2580
Sacramento, CA 95814
P: 916.500.0755
training@feldesman.com

2024 Compliatric Webinar Series - Managing and Protecting Adverse Patient Event Information.pdf

Recommended

Recommended

More Related Content

Similar to 2024 Compliatric Webinar Series - Managing and Protecting Adverse Patient Event Information.pdf

Similar to 2024 Compliatric Webinar Series - Managing and Protecting Adverse Patient Event Information.pdf (20)

More from Compliatric Where Compliance Happens

More from Compliatric Where Compliance Happens (20)

Recently uploaded

Recently uploaded (20)

2024 Compliatric Webinar Series - Managing and Protecting Adverse Patient Event Information.pdf