DEPARTMENT OF HEALTH & HUMAN SERVICES 	 Office of Inspector General 
Washington, D.C. 20201 
JAN' - 5 2010 
TO: 	 Caroln) M. Clancy, M.D. 
Director 
Agency for Healthcare Research and Quality 
Charlene Frizzera 

Acting Administrator 

Centers for Medicare & Medicaid Services 

FROM:  Sruart Wright 
Deputy Inspector Deneral 
for Evaluation and Inspections 
SUBJECT: 	 Memorandum Report:  Adverse Ev~nts in Hospitals:  Public Disclosure oj 
Information Aboul Events, OEI-06-09-00360 
This memorandum 'report provides information about policies, practices, and plans for 
public disclosure of information about adverse events occurring in hospitals and patient 
privacy protectiol1s for adverse event data.  Publicly disclosing adverse event information 
c,an educate healthcare providersahout the causes of events; potentially leading to 
improvements in patient safety and assisting patients when making decisions about their 
care.  However, there is concern that disclosure could undermine patient privacy. 
Among the entities that we reviewed, including 17 selected State adverse event reporting 
systems, 8 selected Patient Safety Organizations (PSO) overseen by the Agency for 
Healthcare Research and Quality (AHRQ) and the Centers for Medicare & Medicaid 
Services (eMS), we found only limited public disclosure of information about adverse 
events,  Among these entities, seven State systems disclose more extensive information 
about the causes of adverse events and prevention strategies than other State systems. 
Such disclosure may provide the medical community with valuable information for 
improving patient safety.  All reviewed entities protect patient privacy through policies, 
practices, and legal provisions, 
OEl-06-09-00360  Adverse Events in Hospitals: Public Disclosure oflnfbrmation About Events  Page 2  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
BACKGROUND 
 
Statutory Mandate and Office of Inspector General Response 
The Tax Relief and Health Care Act of 2006 (the Act) requires that the Office of 
Inspector General (OIG) report to Congress regarding the incidence of never events 
among Medicare beneficiaries; the extent to which the Medicare program paid, denied 
payment, or recouped payment for services furnished in connection with such events; and 
the processes that CMS uses to identify such events and deny or recoup payment.1, 2  The 
Act also mandates that OIG recommend, as appropriate, potential processes for public 
disclosure of information about events, which will ensure patient privacy and permit the 
use of the information for a root-cause analysis to inform the public and the medical 
community about safety issues.  (For relevant text of the Act, see Appendix A.)  To meet 
the requirements of the Act, OIG published a series of reports in 2008 and will publish 
additional reports based on ongoing work.3 
 
Adverse Events in Hospitals 
Since the Act went into effect, patient safety issues have continued to receive attention 
from policymakers, the health care industry, and patient safety advocates.  The health 
care community now uses the term adverse event more commonly than never event 
to refer to harm experienced by a patient as a result of medical care.  After consulting 
with congressional committee staff in 2007, we modified our approach and terminology 
to be consistent with evolving patient safety research and industry trends.   
 
As used in this study, an adverse event is defined as harm to a patient as a result of 
medical care or harm that occurs in a healthcare setting.  Although an adverse event often 
indicates that the care resulted in an undesirable clinical outcome and may involve 
medical errors, adverse events do not always involve errors, negligence, or poor quality 
of care and may not always be preventable.4   
 
Following a review of Medicare policies and expenditures, as well as consultation with 
officials from CMS and AHRQ, we chose to focus our work on inpatient admissions to 
acute care hospitals.  In 2007, 12.3 million Medicare beneficiaries were hospitalized5 and 
inpatient hospital costs constituted the largest portion of Medicare expenditures  
(30 percent in 2007).6   
                                                 
1 Tax Relief and Health Care Act of 2006 (TRHCA), P.L.No. 109-432  203. 
2 For purposes of the Act, the term never event means an event that is listed and endorsed as a serious reportable event by the 
National Quality Forum (NQF) as of November 16, 2006.  TRHCA,  203(d).  NQF uses the term serious reportable events to 
describe a specific list of events associated primarily with patient death or serious disability that should never occur in a health care 
setting.  These became known as never events.  The list is available online at http://www.qualityforum.org/Topics/Safety.aspx.  
Accessed on August 12, 2009. 
3 The studies released in 2008 include:  Department of Health and Human Services (HHS), OIG, Adverse Events in Hospitals:  
Overview of Key Issues, OEI-06-07-00470, December 2008; OIG, Adverse Events in Hospitals:  State Reporting Systems,                   
OEI-06-07-00471, December 2008; and OIG, Adverse Events in Hospitals:  Case Study of Incidence Among Medicare Beneficiaries in 
Two Counties, OEI-06-08-00220, December 2008. 
4 R.M. Wachter, Understanding Patient Safety, McGraw-Hill, 2008. 
5 CMS, Statistics Book, Table IV.1:  Medicare/short-stay hospital utilization, 2008, p. 43. 
6 Based on data contained in the Congressional Budget Office (CBO), Fact Sheet for CBOs March 2008 Baseline:  Medicare,    
March 12, 2008.  Available online at http://www.cbo.gov/budget/factsheets/2008b/medicare.pdf.  Accessed on October 21, 2009. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 3  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
 
Reporting Information About Adverse Events 
In To Err is Human:  Building a Safer Health System, the Institute of Medicine (IOM) 
recommended a nationwide system for collecting standardized data about serious medical 
errors and other adverse events.7  IOM maintained that adverse event reporting would 
ensure provider accountability, and that standardized data definitions would allow 
stakeholders to compile data, analyze reports, and target areas to improve patient safety.  
At present, there is no centralized adverse event reporting system to which all hospitals 
submit adverse event data and which, in turn, disseminates adverse event information to a 
national audience.  Rather, there are separate Federal, State, and nongovernmental 
entities that receive and disclose adverse event information.  Depending on the entity, 
reporting by hospitals is either voluntary or mandatory, and the entities have different 
data collection procedures, privacy protections, and dissemination practices.  For this 
memorandum report, we reviewed the following entities, which receive information 
about adverse events from hospitals:  
 
State adverse event reporting systems; 
 
PSOs; and 
 
CMS, in its role as recipient of Medicare claims that include information about 
 
hospital-acquired conditions. 
 
We selected these entities because (1) many State systems have a history of collecting 
and analyzing adverse event data; (2) PSOs represent a significant, recent Federal effort 
to collect national adverse event data; and (3) CMS claims data include information about 
adverse events affecting Medicare beneficiaries, a specific population of interest 
identified in the Act.   
 
State Adverse Event Reporting Systems   
In the 2008 report, Adverse Events in Hospitals:  State Reporting Systems, OIG found 
that 25 States and the District of Columbia operated systems to collect adverse event data 
submitted by hospitals.8  All of these State systems received information about the event 
itself and the name of the hospital.  However, they differed in a variety of ways, 
including whether reporting was voluntary or mandatory, how information about events 
was reported, and the types of events reported.  State systems also differed on the criteria 
used to define adverse events, the amount and type of information submitted about 
patients, and whether hospitals submissions included information about the causes of 
events.   
 
Patient Safety Organizations 
AHRQ is implementing a recently established program to collect national adverse event 
information.  Hospitals may voluntarily submit information about adverse events to 
                                                 
7 L. T. Kohn, J. M. Corrigan, and M. S. Donaldson, editors, To Err is Human:  Building a Safer Health System, A Report of the 
Committee on Quality of Health Care in America, Institute of Medicine, 1999. 
8 OIG, Adverse Events in Hospitals:  State Reporting Systems, OEI-06-07-00471, December 2008.   
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 4  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
PSOs, which will allow PSOs to perform analysis of aggregated data.  PSOs may, in turn, 
provide hospitals with analysis and recommendations for improving patient safety and 
quality of care.  A variety of organizations are eligible to become PSOs; AHRQ 
determines whether they meet certain criteria to perform patient safety activities.9  
Examples of organizations that have sponsored a PSO include hospital associations, 
hospital chains, existing patient safety consultant groups, and newly created 
organizations.10 As of December 1, 2009, AHRQ had certified 72 PSOs.11  
 
AHRQ is creating and will maintain the Network of Patient Safety Databases (NPSD) to 
provide an evidence-based management resource for providers, patient safety 
organizations, and other entities.12  PSOs will submit adverse event information 
received from hospitals to the NPSD through common formats, which are standardized 
data  
collection forms that AHRQ is developing.  Additionally, AHRQ has issued two 
contracts to facilitate transmission of adverse event data from PSOs to the NPSD.  The 
Iowa Foundation for Medical Care will be responsible for removing patient identifiers 
from PSO data prior to submission to the NPSD.  Westat will operate the NPSD itself. 
The NPSD will allow AHRQ to receive and publicly disclose non-identifiable adverse 
event data at a national level.  Once the NPSD is operational, the Patient Safety Act 
requires that the data be used to analyze national and regional statistics, including trends 
and patterns of reported adverse events, and for publicly disclosing findings from such 
analyses.13   
 
CMS Receipt of Medicare Claims 
In processing Medicare claims, CMS uses hospital claims data to identify certain adverse 
events, called hospital-acquired conditions.  Since October 1, 2007, CMS has required 
that hospitals assign a present on admission (POA) indicator to each diagnosis for acute 
inpatient Medicare claims.14  The POA indicator differentiates diagnoses that were 
hospital-acquired from those that were present on admission.  This was an initial step in 
complying with the Deficit Reduction Act of 2005 (DRA), which required CMS to select 
hospital-acquired conditions for which hospitals would not be paid higher Medicare 
reimbursement.15  CMS selected 10 categories of conditions for the Medicare hospital-
acquired condition policy, which became effective October 1, 2008, and denies hospitals 
                                                 
9 The Secretary delegated authority to AHRQ to make these determinations, as well as to fulfill other requirements of the Patient 
Safety Act.  Patient Safety and Quality Improvement Act of 2005, P.L.No. 109-41  2, Public Health Service Act,  923 and 924,               
42 U.S.C.  299b-23 and -24; 73 Fed. Reg. 70732 (Nov. 21, 2008).   
10 AHRQ, PSO Update:  Final Rule & Common Formats, December 8, 2008. Available online at 
https://www.psoppc.org/c/document_library/get_file?uuid=c03fb6c5-0de4-49e2-9a1f-fc6ee47c2e28&groupId=10218. Accessed on 
December 22, 2009. 
11 AHRQ, Patient Safety Organizations.  Available online at http://www.pso.ahrq.gov/listing/alphalist.htm.  Accessed on             
December 1, 2009. 
12 42 U.S.C.  922b-23(a). 
13 42 U.S.C.  299b-23(c). 
14 CMS, CMS Manual System, Change Request 5679 (July 20, 2007).  
15 DRA, P.L.No. 109-171  5001(c)(1), Social Security Act  1886(d)(4)(D), 42 U.S.C.  1395ww(d)(4)(D). 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 5  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
higher payment for Medicare admissions complicated by the 10 conditions.16   
Appendix B contains a list of these conditions.  
                                                 
16  Fiscal Year 2009 Inpatient Prospective Payment System Final Rule, 73 Fed. Reg. 48434, 48471-48491 (Aug. 19, 2008);                  
CMS, CMS Manual System, Change Request 6189 (Oct. 3, 2008).   
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 6  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
Public Disclosure of Information About Adverse Events 
Public disclosure of adverse event information offers potential benefits, yet may also lead 
to unintended negative consequences.  For example, publicly disclosing adverse event 
information can educate healthcare providers about the causes of events potentially 
leading to improvements in patient safety, and assist patients making decisions about 
their care.  However, there is concern that disclosure of event information could 
undermine patient privacy and that naming the hospital where an event occurred, or the 
individual providers involved, could discourage reporting of events. 
 
METHODOLOGY 
 
Scope 
For this memorandum report, we reviewed policies, practices, and plans for publicly 
disclosing information about adverse event causes and prevention strategies, while 
protecting patient privacy.  We did not examine hospital or provider confidentiality 
issues, such as naming the hospital where an event occurred in disclosures, except for 
possible patient privacy implications.  We reviewed 17 selected State adverse event 
reporting systems, 8 selected PSOs that will forward data to AHRQs NPSD, and CMS.  
Data collection for this study was performed from July through September 2009.  
Findings represent policies, practices, and plans in place during that time. 
 
Selection of State Adverse Event Reporting Systems and PSOs  
Using data from the OIG report Adverse Events in Hospitals:  State Reporting Systems 
(OEI-06-07-00471) and initial contacts with State system staff, we identified 17 State 
adverse event reporting systems that, as of July 2009, collected information from acute 
care hospitals about patients affected by adverse events and the causes of those events.17  
States using these systems are:  Colorado, Florida, Maine, Maryland, Massachusetts (two 
systems), Minnesota, Nevada, New Jersey, New York, Oregon, Pennsylvania, Rhode 
Island, South Carolina, South Dakota, Utah, and Vermont.   
 
Using AHRQs Directory of PSOs and contacts with PSO staff, we identified the first 
eight PSOs that either received or intended to receive adverse event information from 
acute care hospitals.18  These PSOs are:  California Hospital Patient Safety Organization; 
Clinical Practice Advancement Center; ECRI Institute PSO; HealthWatch; Human 
Performance Technology Group, Inc.; Institute for Safe Medication Practices; Missouri 
Center for Patient Safety; and, Peminic, Inc. 
 
Data Collection and Analysis 
We conducted structured interviews with staff from the 17 State adverse event reporting 
systems to determine the extent to which State systems disclose information about events, 
                                                 
17 We did not review State systems that, based on information from the 2008 OIG report, did not collect information from acute care 
hospitals both about patients affected by adverse events and the causes of those events.   
18 HHS, AHRQ, Alphabetical Directory of Listed Patient Safety Organizations.  Available online at 
http://www.pso.ahrq.gov/listing/alphalist.htm#P0002.  Accessed on October 22, 2009.  
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 7  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
their causes, corrective actions, risk reduction strategies, and patients affected by events.  
We also reviewed relevant documents recently published by State systems, such as 
reports, periodic bulletins, safety alerts, and information on State system Web sites.  
Regarding patient privacy, we determined the extent to which State systems collect 
information about patients and the extent to which they disclose this information.  We 
also identified State legal prohibitions against compelled release of information about 
patients, and confirmed our interpretations with State system staff. 
 
We conducted structured interviews with staff from AHRQ and the eight PSOs regarding 
the extent to which they disclose information about adverse events, their future plans for 
disclosure, the status of efforts necessary for the NPSD to become operational, and 
patient privacy issues.  We reviewed relevant documents, such as AHRQs interim 
guidance for PSOs, proposed and final rules for PSOs, contracts related to PSOs and the 
NPSD, and the Patient Safety Act.  We examined the Patient Safety Act for requirements 
regarding protections of patient privacy that apply to information submitted to PSOs and 
forwarded to the NPSD. 
 
We interviewed CMS staff regarding current and planned public disclosure of 
information from Medicare claims data that include POA indicators.  We reviewed 
claims data and relevant documents to identify the extent to which these data could 
inform the public about hospital-acquired conditions, their causes, and patient safety 
issues.  We also examined mechanisms that CMS uses to protect patient privacy when it 
allows access to Medicare claims data. 
 
Limitations 
Although numerous entities collect information about adverse events, we could not 
examine all such entities for this memorandum report.  Examples of other entities that 
receive adverse event information not examined in this memorandum report include the 
Centers for Disease Control and Preventions National Health Safety Network, which 
receives reports of hospital-acquired infections; and a variety of data systems at the Food 
and Drug Administration (FDA) that receive reports of adverse events associated with 
approved drugs, devices, and biologics, among others.19  
 
Standards 
This study was conducted in accordance with the Quality Standards for Inspections 
approved by the Council of the Inspectors General on Integrity and Efficiency. 
 
 
 
 
 
 
                                                 
19 A recent OIG report examined adverse event reporting to FDA for medical devices.  OIG, Adverse Event Reporting for Medical 
Devices, OEI-01-08-00110, October 2009. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 8  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
RESULTS 
 
Public Disclosure of Information About Adverse Events is Limited Among the 
Entities in Our Review 
Seven State adverse event reporting systems disclosed more extensive information about 
the causes of adverse events and prevention strategies than other State systems.  Such 
disclosure may provide the medical community with valuable information for improving 
patient safety.  Another three State systems disclosed less extensive information about 
adverse events.  AHRQ plans to disclose adverse event information but has not because 
data are not yet available in the NPSD.  CMS is considering plans for disclosing 
information about hospital-acquired conditions in the future. 
 
Seven State Systems Publicly Disclosed More Extensive Information About Causes of 
Adverse Events and Prevention Strategies Than Other State Systems.  These seven 
systems provided information to educate the medical community on how to prevent or 
reduce the occurrence of adverse events.  Disclosure by these systems was based on 
multiple reports of similar adverse events and included analysis of their causes.  
Disclosures also contained information about actions taken by hospitals to correct 
identified vulnerabilities, strategies to reduce the risk of events occurring, and 
demonstrated improvements by hospitals.  Table 1 provides details about the types of 
adverse event information disclosed by the 17 State systems that we reviewed.    
 
For example, one State system published an article addressing adverse events related to 
anticoagulants (blood-thinning medications).  The article combined information from 
hundreds of adverse event reports received by the State system and data from  
evidence-based research.  In brief case summaries, the article provided details about the 
events, including the level of patient harm and identified causes.  To address the causes, 
the article recommended that hospitals establish anticoagulation management service 
programs that would document these services, educate patients and families, and gauge 
progress in improving performance.  State system staff followed up 6 months after the 
article was distributed to hospitals and found that over half of hospitals in the State 
reported making changes as a result of the article.   
 
In contrast, three systems that we reviewed disclosed less extensive information about 
causes and prevention strategies for events.  These systems disclosed either information 
about individual events or lists of events compiled from submitted hospital reports.  For 
example, two systems posted information about individual events, including event type 
and date, hospital name and department, and possible contributing factors, but did not 
disclose root-cause analysis information drawn from data about multiple occurrences.  
The remaining system listed all reported corrective actions that hospitals anticipated 
making, such as planned training, but did not indicate which events led to the planned 
actions.  
 
 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 9  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
Table 1:  Adverse Event Information Disclosed by Selected State Systems 
  Disclosure About  Disclosure Based on Information 
Individual Events  From Multiple Events 
Causes of  Hospital  Causes of  Hospital  Risk 
Evidence of 
System  Individual  Corrective  Events by  Corrective  Reduction 
Improvements 
Events  Actions  Type  Actions  Strategies 
Seven State systems with more extensive disclosure 
Maryland             
Massachusetts, BRM*             
Massachusetts, DPH*             
Minnesota             
New Jersey             
Oregon             
Pennsylvania             
Three State systems with less extensive disclosure 
Colorado             
Maine             
Rhode Island             
Seven State systems with no disclosure 
Utah             
Florida             
Nevada             
New York             
South Carolina             
South Dakota             
Vermont             
* BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 
Source:  OIG review of 17 selected State adverse event reporting systems, 2009. 
 
 
AHRQ Plans To Disclose Adverse Event Information, but the NPSD Is Not Operational 
and Possible Barriers to Data Submission Exist.  AHRQ plans to use aggregated PSO 
data from the NPSD to identify national and regional trends of adverse events, and to 
make this information available to the public.  AHRQs plans include generating two 
public reports, as required by the Patient Safety Act:  a report about effective strategies 
for reducing medical errors and increasing patient safety, and a report containing trend 
analysis results.   
 
AHRQ officials estimated that initial NPSD data will be available for analysis and 
disclosure in early 2011.  These initial data will include identification of adverse events 
and their contributing factors for hospitals.  AHRQ officials reported additional plans to 
collect data about the causes of adverse events (e.g., root-cause analysis) and to expand 
data collection beyond hospitals to other healthcare settings, such as nursing homes.  
However, AHRQ has not announced a timeline for these additional plans. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 10  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
 
Staff from several PSOs that we reviewed reported barriers that could limit hospital 
participation with PSOs and data submission to the NPSD.  For example, staff from one 
PSO reported that some hospitals had questioned the costs and benefits of PSO 
participation.  Additionally, staff from two PSOs indicated that they were unsure about 
the value of submitting data to the NPSD.   
 
Beyond AHRQs disclosure of PSO data, individual PSOs can also generate learning 
materials for hospitals.  Staff from only one PSO that we reviewed indicated plans to 
share such information directly with the public.  These staff reported plans to include 
information about medication-related adverse events in a medication safety newsletter 
available to all healthcare professionals and consumers.   
 
CMS Is Considering Plans for Public Disclosure of Information About Medicare 
Hospital-Acquired Conditions, a Subset of Adverse Events.   CMS officials indicated that 
CMS is considering posting the incidence of hospital-acquired conditions on its Hospital 
Compare Web site, which currently includes other quality measures about hospitals.  
Additionally, CMS may publicly disclose results from an ongoing evaluation focused on 
the Medicare hospital-acquired conditions policy, its effects on Medicare reimbursement, 
utilization, quality, patient safety, and any unintended consequences.  CMS contracted for 
the evaluation in September 2009, and will determine the extent of disclosure after 
findings are known.   
 
Although valuable for ascertaining the incidence of hospital-acquired conditions, 
Medicare claims data lack information about the causes of these conditions or prevention 
strategies, limiting their usefulness for improving patient safety.  CMS officials 
acknowledged that supplemental information about the circumstances under which a 
beneficiary experienced a hospital-acquired condition could allow better understanding of 
causes and development of prevention strategies.  To collect such information, CMS is 
considering combining hospital-acquired condition data with data from other systems. 
 
All Reviewed Entities Protect Patient Privacy Through Policies, Practices, and Legal 
Provisions 
Each entity that we reviewed has patient privacy protections.  These protections vary 
across entities and include policies regarding what patient identifiers are collected, 
practices regarding disclosing patient identifiers, and legal protections that apply to 
patient identifiers. 
 
State Systems Either Do Not Collect or Disclose Patient Identifiers and Most Prohibit the 
Compelled Release of Patient Identifiers.  Five State systems that we reviewed do not 
collect any patient identifiers, such as the patients name or address.  Because these State 
systems do not collect patient identifiers, they cannot disclose such information.  See 
Appendix C for the types of patient identifiers that each of the 17 selected State systems 
collect. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 11  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
 
Our review found no instances in which the remaining 12 State systems disclosed patient 
identifiers publicly.  Rather, most publications referred to patients in ways that would 
prevent identification of individuals.  For example, one approach to protecting patient 
privacy involved developing profiles of typical patients who experience a type of event, 
such as female, Caucasian, 6064 years of age, and admitted to the hospital an average of 
13 days prior to the event.  However, we noticed that some publications contained a level 
of detail that could be used to identify the patient.  The possibility of compromised 
patient privacy could be heightened under certain circumstances, such as when an 
adverse event involves a patient who lives in a smaller community and when media 
reports about an event contain additional information that can be matched to disclosed 
information about the event. 
 
Beyond disclosure of patient information in publications intended for learning, State 
systems may be asked to disclose patient identifiers under four circumstances:  public 
records requests, civil judicial proceedings, criminal judicial proceedings, and 
administrative proceedings.   State laws vary regarding prohibitions against State systems 
being compelled to release patient identifiers in these instances.  Eight of the seventeen 
systems that we reviewed have State laws that expressly prohibit the compelled release of 
patient identifiers under all four circumstances.  State laws for another eight systems 
prohibit compelled release under at least one, but not all, of the circumstances.  Table 2 
lists the four circumstances and whether State laws prohibit systems from being 
compelled to release patient identifiers under each circumstance.  Appendix D expands 
Table 2 by providing citations to relevant State laws and regulations. 
 
For three systems, we found it difficult to ascertain whether State laws prohibited the 
system from being legally compelled to release patient identifiers under one or more of 
these circumstances.  For example, one State law specifies that adverse event information 
shall be confidential, except for official purposes, but does not define official purposes.  
These ambiguous laws could require further administrative or judicial interpretation 
regarding protection of patient privacy.   
 
 
 
 
 
 
 
 
 
 
 
   
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 12  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
Table 2:  Legal Prohibitions Against Compelled Release of Patient 
Identifiers by Selected State Adverse Event Reporting Systems 
Public  Criminal 
Records  Civil Judicial  Judicial  Administrative 
System  Request  Proceeding  Proceeding  Proceeding 
Colorado  Prohibited  Prohibited   Prohibited   Prohibited 
Florida  Prohibited   Prohibited  Not prohibited  Prohibited 
Maine*  Prohibited  Prohibited   Prohibited   Prohibited  
Maryland  Prohibited   Prohibited  Not prohibited  Not prohibited 
Massachusetts, BRM#  Prohibited   Prohibited  Prohibited    Prohibited  
Massachusetts, DPH#  Prohibited   Not prohibited  Not prohibited  Not prohibited 
Minnesota*  Prohibited   Not prohibited  Not prohibited  Not prohibited 
Nevada  Prohibited   Prohibited  Prohibited   Prohibited 
New Jersey  Prohibited   Prohibited  Prohibited   Prohibited 
New York  Prohibited  Unclear  Unclear   Unclear 
Oregon*  Prohibited   Prohibited  Not prohibited  Prohibited 
Pennsylvania*  Prohibited   Prohibited  Prohibited   Prohibited 
Rhode Island  Prohibited   Prohibited  Prohibited   Prohibited 
South Carolina*  Prohibited   Unclear  Unclear   Unclear 
South Dakota  Unclear  Unclear  Unclear   Unclear 
Utah  Prohibited   Prohibited  Prohibited   Prohibited 
Vermont  Prohibited   Prohibited  Not prohibited  Prohibited 
*This State system does not collect patient identifiers. 
# BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 
Source:  OIG review of 17 selected State adverse event reporting systems, 2009. 
 
Patient Identifiers Collected by PSOs Will Be Removed Before Submission to the NPSD, 
and Patient Privacy Is Protected Under the Patient Safety Act.   The initial common 
formats for PSO data include patient identifiers, such as patient name, date of birth, and 
medical record number.  To ensure that no patient identifiers are disclosed to the public, 
an AHRQ contractor will remove patient identifiers before submission to the NPSD.20  
The contractor is also tasked with developing a protocol for suppressing descriptive 
information that could compromise patient identity.  For example, if only one hospital 
performed liver transplants in a State, an adverse event report involving a liver transplant 
in the State would require suppressing either the State name or the procedure name to 
protect patient privacy. 
 
To encourage hospitals to report information about adverse events, Federal privilege and 
confidentiality protections apply to adverse event information collected by PSOs.21  
Privilege protections outlined in the Patient Safety Act limit or forbid the use of PSO data 
in criminal, civil, administrative, or other proceedings.  Additionally, confidentiality 
                                                 
20 Congress mandated that the NPSD use nonidentifiable information.  42 U.S.C.  299b-23. 
21 42 U.S.C.  299b-22.  
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 13  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
protections prohibit PSOs from disclosing any identifiable information about a provider 
or patient.   
 
Patient Identifiers Collected by CMS Are Released Only Through Data Use Agreements 
Based on Federal Laws That Protect Patient Privacy.  Medicare claims contain 
information about Medicare beneficiaries including names, Medicare numbers, addresses, 
dates of birth, gender, and race; and details about their hospital stays, such as provider 
names, billing numbers, diagnosis codes, and charges for services.22  Although CMS has 
not disclosed information to the public about hospital-acquired conditions identified 
through Medicare claims data, it does allow access to claims data in two forms:  full 
Medicare claims data and limited datasets.  Full Medicare claims data include beneficiary 
and provider identifiers, whereas limited datasets exclude or aggregate all identifiers of 
patients and providers.  For example, instead of the beneficiarys date of birth, limited 
datasets contain an age range, such as [age] 65 through 69.23   
 
To access either full or limited datasets, users must demonstrate a need for the data, state 
the intended use of the research, and sign a data use agreement that includes specific 
provisions regarding the protection of patient privacy.24  Pursuant to the Privacy Act of 
1974, CMS will only release claims data to a user who agrees to implement appropriate 
management, operational and technical safeguards sufficient to protect the 
confidentiality, integrity and availability of the information and information systems and 
to prevent unauthorized access.25  Additionally, CMSs Privacy Board must review and 
approve each request for access to full datasets with identifiers and any publications 
resulting from use of identifiable data.26 
 
 
 
 
 
 
 
 
 
 
 
                                                 
22 CMS, Medicare Claims Processing Manual ch. 25.  Available online at 
http://www.cms.hhs.gov/manuals/downloads/clm104c25.pdf.  Accessed on October 22, 2009.   
23 CMS, LDS Inpatient SNF Claim Record Data Dictionary, 2009.  Available online at 
http://www.cms.hhs.gov/LimitedDataSets/Downloads/SAFldsINPMar2009.pdf.  Accessed on October 22, 2009. 
24 CMS has two distinct data use agreements.  Form CMS-R-0235 is used when the recipient is receiving data containing individual 
identifiers.  Form CMS-R-0235L is used when the recipient is receiving limited data sets.  Available online at 
http://www.cms.hhs.gov/PrivProtectedData/.  Accessed on December 2, 2009.  
25 71 Fed. Reg. 67137, 67142 (Nov. 20, 2006). 
26 The CMS Privacy Board safeguards personally identifiable information, assures that there is minimal privacy risk to an individual 
when information is released to a researcher, and ensures compliance with the Privacy Act of 1974 and the HIPAA Privacy Rule.  
Available online at http://www.cms.hhs.gov/SystemLifecycleFramework/downloads/privacypolicy.pdf.  Accessed on                        
November 25, 2009.  
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 14  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
CONCLUSION 
 
This memorandum report contains no recommendations and is being issued directly in 
final form.  We did not make recommendations for two reasons.  First, we concluded that 
it is not appropriate to make a broad recommendation for a public disclosure process.  
Entities collect adverse event data for different purposes, such as for generating 
information for patient safety improvements, conducting oversight of hospitals, or 
processing payments for healthcare services.  Given these differences, we believe that it 
is less useful to propose a standard process for public disclosure than it is to describe the 
current and planned practices of the entities that we reviewed.  Second, all these entities 
have patient privacy protections.  Therefore we did not indentify particular privacy 
concerns that warrant recommendations.   
 
The disclosure practices of the seven State systems with more extensive disclosure can 
serve as models for other entities.  These systems disclose analysis of the causes of 
events, evidence-based guidance for reducing occurrences, and information about 
demonstrated improvements by hospitals.  This type of information, if disseminated by 
other State systems and entities that receive adverse event information, could help to 
improve patient safety.   
 
PSOs are expected to provide AHRQ with national data about adverse events and 
contributing factors.  Once common formats are fully implemented, AHRQ will be 
positioned to publicly disclose more extensive information about the causes of events, 
prevention strategies, and the effectiveness of those strategies.  It is encouraging that 
some PSOs are currently receiving adverse event information from hospitals and are 
preparing to submit data to the NPSD.  However, successful implementation will require 
AHRQ to address the barriers that staff from one PSO described, including that some 
hospitals question the cost and benefit of PSO participation. 
 
Using only Medicare claims data, CMS is limited in what it can disclose about hospital-
acquired conditions, because claims data do not contain information about causes.  
However, CMSs plan to supplement claims data with other data sources appears to have 
the potential to generate new and useful information about hospital-acquired conditions, 
their causes, and prevention. 
 
If you have comments or questions about this memorandum report, please provide them 
within 60 days.  Please refer to report number OEI-06-09-00360 in all correspondence. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 15  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
APPENDIX A:  TAX RELIEF AND HEALTH CARE ACT OF 2006 
P.L.No. 109-432 
DIVISION B  MEDICARE AND OTHER HEALTH PROVISIONS 
TITLE IIMEDICARE BENEFICIARY PROTECTIONS 
SEC 203 OIG STUDY OF NEVER EVENTS 
 
(a) Study. 
(1) In general.The Inspector General in the Department of Health and Human Services 
shall conduct a study on 
(A) incidences of never events for Medicare beneficiaries, including types of such events 
and payments by any party for such events; 
(B) the extent to which the Medicare program paid, denied payment, or recouped payment 
for services furnished in connection with such events and the extent to which beneficiaries 
paid for such services; and 
(C) the administrative processes of the Centers for Medicare & Medicaid Services to detect 
such events and to deny or recoup payments for services furnished in connection with such 
an event. 
(2) Conduct of study.In conducting the study under paragraph (1), the Inspector 
General 
(A) shall audit a representative sample of claims and medical records of Medicare 
beneficiaries to identify never events and any payment (or recouping of payment) for 
services furnished in connection with such events; 
(B) may request access to such claims and records from any Medicare contractor; and 
(C) shall not release individually identifiable information or facility-specific information. 
(b) Report.Not later than 2 years after the date of the enactment of this Act, the Inspector 
General shall submit a report to Congress on the study conducted under this section.  Such 
report shall include recommendations for such legislation and administrative action, such as 
a noncoverage policy or denial of payments, as the Inspector General determines 
appropriate, including 
(1) recommendations on processes to identify never events and to deny or recoup payments 
for services furnished in connection with such events; and 
(2) a recommendation on a potential process (or processes) for public disclosure of never 
events which 
(A) will ensure protection of patient privacy; and  
(B) will permit the use of the disclosed information for a root cause analysis to inform the 
public and the medical community about safety issues involved. 
 
 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 16  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
APPENDIX A  (continued) 
(c) Funding. Out of any funds in the Treasury not otherwise appropriated, there are 
appropriated to the Inspector General of the Department of Health and Human Services 
$3,000,000 to carry out this section, to be available until January 1, 2010. 
(d) Never Events Defined.For purposes of this section, the term never event means an 
event that is listed and endorsed as a serious reportable event by the National Quality 
Forum as of November 16, 2006. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 17  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
APPENDIX B:  MEDICARE LIST OF HOSPITAL-ACQUIRED CONDITIONS 
The Centers for Medicare & Medicaid Services (CMS) list of hospital-acquired conditions 
is divided into 10 categories.  Effective October 1, 2008, CMS no longer pays a higher 
reimbursement for hospitalizations complicated by these categories of conditions if they 
were not present on admission. 
 
Hospital-Acquired Condition 
1.  Foreign object retained after surgery 
2.  Air embolism 
3.  Blood incompatibility 
4.  Pressure ulcers (stages III and IV) 
5.  Falls 
A.  Fracture 
B.  Dislocation 
C.  Intracranial injury 
D.  Crushing injury 
E.  Burn 
F.  Electric shock 
6.  Manifestations of poor glycemic control 
A.  Hypoglycemic coma 
B.  Diabetic ketoacidosis 
C.  Nonkeototic hyperosmolar coma 
D.  Secondary diabetes with ketoacidosis 
E.  Secondary diabetes with hyperosmolarity 
7.  Catheter-associated urinary tract infection 
8.  Vascular catheter-associated infection 
9.  Deep vein thrombosis/pulmonary embolism associated with 
A.  Total knee replacement 
B.  Hip replacement 
10.  Surgical site infection 
A.  Mediastinitis after coronary artery bypass graft 
B.  Associated with certain orthopedic procedures involving the 
a.  Spine 
b.  Neck 
c.  Shoulder 
d.  Elbow 
C.  Associated with certain bariatric surgical procedures for obesity 
a.  Laprascopic gastric bypass 
b.  Gastroenterostomy 
c.  Laparoscopic gastric restrictive surgery 
Source:  Fiscal Year 2009 Final Inpatient Prospective Payment System Rule, 
73 Fed. Reg. 48434, 48471 (August 19, 2008). 
 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 18  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
APPENDIX C:  PATIENT IDENTIFIERS COLLECTED BY SELECTED STATE 
ADVERSE EVENT REPORTING SYSTEMS  
 
Date of  Identifiable 
System  Name  Address  Birth  Number* 
Colorado         
Florida         
Maine         
Maryland        
Massachusetts, BRM#         
Massachusetts, DPH#         
Minnesota         
Nevada         
New Jersey         
New York         
Oregon         
Pennsylvania         
Rhode Island         
South Carolina         
South Dakota        
Utah         
Vermont         
* Includes medical record number, hospital billing number, unique identifier, or patient identification number. 
# BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 
Source:  Office of Inspector General review of 17 selected State adverse event reporting systems, 2009. 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events  Page 19  Carolyn M. Clancy, M.D., and Charlene Frizzera 
 
 
APPENDIX D:  LEGAL PROHIBITIONS AGAINST COMPELLED RELEASE OF 
PATIENT IDENTIFIERS BY SELECTED STATE ADVERSE EVENT REPORTING 
SYSTEMS 
Public Record  Civil Judicial  Criminal Judicial  Administrative 
State 
Request  Proceeding  Proceeding  Proceeding 
Colorado1  Prohibited  Prohibited   Prohibited   Prohibited 
Florida2  Prohibited   Prohibited  Not prohibited  Prohibited 
Maine3 *  Prohibited  Prohibited   Prohibited   Prohibited  
Maryland4  Prohibited   Prohibited  Not prohibited  Not prohibited 
Massachusetts, BRM5 #  Prohibited   Prohibited  Prohibited    Prohibited  
Massachusetts, DPH6 #  Prohibited   Not prohibited  Not prohibited  Not prohibited 
Minnesota7 *  Prohibited   Not prohibited  Not prohibited  Not prohibited 
Nevada8  Prohibited   Prohibited  Prohibited   Prohibited 
New Jersey9  Prohibited   Prohibited  Prohibited   Prohibited 
New York10  Prohibited  Unclear  Unclear  Unclear 
Oregon11 *  Prohibited   Prohibited  Not prohibited  Prohibited 
Pennsylvania12 *  Prohibited   Prohibited  Prohibited   Prohibited 
Rhode Island13  Prohibited   Prohibited  Prohibited   Prohibited 
South Carolina14 *  Prohibited   Unclear  Unclear   Unclear 
South Dakota15  Unclear  Unclear  Unclear   Unclear 
Utah16  Prohibited   Prohibited  Prohibited   Prohibited 
Vermont17  Prohibited   Prohibited  Not prohibited  Prohibited 
    
1.    Colorado Revised Statutes (CRS) 25-1-124(4);   10.  (continued) While Section 2805-m does not  
CRS 24-72-204.  expressly state that it affords adverse event reports 
2.    Florida Statutes  395.0197(7).  an evidentiary privilege, judicial decisions suggest 
3.    22 Maine Revised Statutes  8754(3).  that it does.  Moreover, although at least one 
4.    Code of Maryland Regulations 10.07.06.09.  intermediate appellate court has held that this statute 
5.    Massachusetts General Law (MGL) ch. 4,  7;                   applies to grand jury subpoenas, the States highest 
MGL. ch. 111,  204 and 205; 243 Code of  court has not addressed this issue. 
Massachusetts Regulations 3.04.  11.  Oregon Laws 2003, ch. 686,  12. 
6.    MGL ch. 4,  7.  12.  40 Pennsylvania Statutes (PS)  1303.311(h);  
7.    Minnesota Statutes  144.7065, sub. 0.  40 PS  1303.311(d). 
8.    Nevada Revised Statutes Annotated (NRS)  439.840  13.  Rhode Island General Laws  23-17-40(g),                  
(as amended by 2009 Nevada Statutes 153  8);   23-17-15, and 23-17-25(a). 
NRS  439.860.  14.  South Carolina Code Annotated  44-7-315(A) and 
9.    New Jersey Statutes  26:2H-12.25(f).     44-7-315(B); S.C. Code Ann.  44-7-310. 
10.  New York Consolidated Law Service Public Health      15.  South Dakota Codified Laws  34-12-17.   
 2805- m.  Note:  Section 2805-m of the New York  16.  Utah Administrative Code (UAC) R380-200-6 and  
Public Health Law states that adverse events reports  R380-210-5; Title 26, Chapter 3 of the Utah Code;  
submitted to the State shall be kept confidential and  Utah Code Annotated (UCA)  26-3-7 and 26-3-9; 
shall not be subject to discovery in civil actions.    UCA  63G-2-201. 
  17.  18 Vermont Statutes Annotated  1917. 
 
*This State system does not collect patient identifiers. 
# BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 
Source:  Office of Inspector General review of 17 selected State adverse event reporting systems, 2009. 
 
OEI-06-09-00360                     Adverse Events in Hospitals:  Public Disclosure of Information About Events