DEPARTMENT OF HEALTH & HUMAN SERVICES 	 Office of Inspector General 

Washington, D.C. 20201 

JAN' - 5 2010 

TO: 	 Caroln) M. Clancy, M.D. 

Director 

Agency for Healthcare Research and Quality 

Charlene Frizzera 


Acting Administrator 


Centers for Medicare & Medicaid Services 


FROM: Sruart Wright 

Deputy Inspector Deneral 

for Evaluation and Inspections 

SUBJECT: 	 Memorandum Report: Adverse Ev~nts in Hospitals: Public Disclosure oj 

Information Aboul Events, OEI-06-09-00360 

This memorandum 'report provides information about policies, practices, and plans for 

public disclosure of information about adverse events occurring in hospitals and patient 

privacy protectiol1s for adverse event data. Publicly disclosing adverse event information 

c,an educate healthcare providersahout the causes of events; potentially leading to 

improvements in patient safety and assisting patients when making decisions about their 

care. However, there is concern that disclosure could undermine patient privacy. 

Among the entities that we reviewed, including 17 selected State adverse event reporting 

systems, 8 selected Patient Safety Organizations (PSO) overseen by the Agency for 

Healthcare Research and Quality (AHRQ) and the Centers for Medicare & Medicaid 

Services (eMS), we found only limited public disclosure of information about adverse 

events, Among these entities, seven State systems disclose more extensive information 

about the causes of adverse events and prevention strategies than other State systems. 

Such disclosure may provide the medical community with valuable information for 

improving patient safety. All reviewed entities protect patient privacy through policies, 

practices, and legal provisions, 

OEl-06-09-00360 Adverse Events in Hospitals: Public Disclosure oflnfbrmation About Events 
Page 2 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

 

BACKGROUND 

Statutory Mandate and Office of Inspector General Response 

The Tax Relief and Health Care Act of 2006 (the Act) requires that the Office of 

Inspector General (OIG) report to Congress regarding the incidence of “never events” 

among Medicare beneficiaries; the extent to which the Medicare program paid, denied 

payment, or recouped payment for services furnished in connection with such events; and 

the processes that CMS uses to identify such events and deny or recoup payment.1, 2

 The 

Act also mandates that OIG recommend, as appropriate, potential processes for public 

disclosure of information about events, which will ensure patient privacy and permit the 

use of the information for a root-cause analysis to inform the public and the medical 

community about safety issues. (For relevant text of the Act, see Appendix A.) To meet 

the requirements of the Act, OIG published a series of reports in 2008 and will publish 

additional reports based on ongoing work.3

Adverse Events in Hospitals 

Since the Act went into effect, patient safety issues have continued to receive attention 

from policymakers, the health care industry, and patient safety advocates. The health 

care community now uses the term “adverse event” more commonly than “never event” 

to refer to harm experienced by a patient as a result of medical care. After consulting 

with congressional committee staff in 2007, we modified our approach and terminology 

to be consistent with evolving patient safety research and industry trends. 

As used in this study, an adverse event is defined as harm to a patient as a result of 

medical care or harm that occurs in a healthcare setting. Although an adverse event often 

indicates that the care resulted in an undesirable clinical outcome and may involve 

medical errors, adverse events do not always involve errors, negligence, or poor quality 

of care and may not always be preventable.4

 

Following a review of Medicare policies and expenditures, as well as consultation with 

officials from CMS and AHRQ, we chose to focus our work on inpatient admissions to 

acute care hospitals. In 2007, 12.3 million Medicare beneficiaries were hospitalized5

 and 

inpatient hospital costs constituted the largest portion of Medicare expenditures 

(30 percent in 2007).6

 

1 Tax Relief and Health Care Act of 2006 (TRHCA), P.L.No. 109-432 § 203. 2 For purposes of the Act, the term “never event” means “an event that is listed and endorsed as a serious reportable event by the 

National Quality Forum (NQF) as of November 16, 2006.” TRHCA, § 203(d). NQF uses the term “serious reportable events” to 

describe a specific list of events associated primarily with patient death or serious disability that “should never occur in a health care 

setting.” These became known as “never events.” The list is available online at http://www.qualityforum.org/Topics/Safety.aspx. 

Accessed on August 12, 2009. 

3 The studies released in 2008 include: Department of Health and Human Services (HHS), OIG, Adverse Events in Hospitals: 

Overview of Key Issues, OEI-06-07-00470, December 2008; OIG, Adverse Events in Hospitals: State Reporting Systems, 

OEI-06-07-00471, December 2008; and OIG, Adverse Events in Hospitals: Case Study of Incidence Among Medicare Beneficiaries in 

Two Counties, OEI-06-08-00220, December 2008. 4 R.M. Wachter, Understanding Patient Safety, McGraw-Hill, 2008. 5 CMS, Statistics Book, Table IV.1: Medicare/short-stay hospital utilization, 2008, p. 43. 6 Based on data contained in the Congressional Budget Office (CBO), Fact Sheet for CBO’s March 2008 Baseline: Medicare, 

March 12, 2008. Available online at http://www.cbo.gov/budget/factsheets/2008b/medicare.pdf. Accessed on October 21, 2009.

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 3 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

 

Reporting Information About Adverse Events 

In To Err is Human: Building a Safer Health System, the Institute of Medicine (IOM) 

recommended a nationwide system for collecting standardized data about serious medical 

errors and other adverse events.7 IOM maintained that adverse event reporting would 

ensure provider accountability, and that standardized data definitions would allow 

stakeholders to compile data, analyze reports, and target areas to improve patient safety. 

At present, there is no centralized adverse event reporting system to which all hospitals 

submit adverse event data and which, in turn, disseminates adverse event information to a 

national audience. Rather, there are separate Federal, State, and nongovernmental 

entities that receive and disclose adverse event information. Depending on the entity, 

reporting by hospitals is either voluntary or mandatory, and the entities have different 

data collection procedures, privacy protections, and dissemination practices. For this 

memorandum report, we reviewed the following entities, which receive information 

about adverse events from hospitals: 

● State adverse event reporting systems; 

● PSOs; and 

● CMS, in its role as recipient of Medicare claims that include information about 

hospital-acquired conditions. 

We selected these entities because (1) many State systems have a history of collecting 

and analyzing adverse event data; (2) PSOs represent a significant, recent Federal effort 

to collect national adverse event data; and (3) CMS claims data include information about 

adverse events affecting Medicare beneficiaries, a specific population of interest 

identified in the Act. 

State Adverse Event Reporting Systems 

In the 2008 report, Adverse Events in Hospitals: State Reporting Systems, OIG found 

that 25 States and the District of Columbia operated systems to collect adverse event data 

submitted by hospitals.8

 All of these State systems received information about the event 

itself and the name of the hospital. However, they differed in a variety of ways, 

including whether reporting was voluntary or mandatory, how information about events 

was reported, and the types of events reported. State systems also differed on the criteria 

used to define adverse events, the amount and type of information submitted about 

patients, and whether hospitals’ submissions included information about the causes of 

events. 

Patient Safety Organizations 

AHRQ is implementing a recently established program to collect national adverse event 

information. Hospitals may voluntarily submit information about adverse events to 

7 L. T. Kohn, J. M. Corrigan, and M. S. Donaldson, editors, To Err is Human: Building a Safer Health System, A Report of the 

Committee on Quality of Health Care in America, Institute of Medicine, 1999. 8 OIG, Adverse Events in Hospitals: State Reporting Systems, OEI-06-07-00471, December 2008. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 4 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

ed 

e 

f reported adverse events, and for publicly disclosing findings from such 

nalyses.13 

e 

cute 

lect 

 hospitals 

PSOs, which will allow PSOs to perform analysis of aggregated data. PSOs may, in turn, 

provide hospitals with analysis and recommendations for improving patient safety and 

quality of care. A variety of organizations are eligible to become PSOs; AHRQ 

determines whether they meet certain criteria to perform “patient safety activities.”9 

Examples of organizations that have sponsored a PSO include hospital associations, 

hospital chains, existing patient safety consultant groups, and newly created 

organizations.10 As of December 1, 2009, AHRQ had certified 72 PSOs.11 

AHRQ is creating and will maintain the Network of Patient Safety Databases (NPSD) to 

provide an “evidence-based management resource for providers, patient safety 

organizations, and other entities.”12 PSOs will submit adverse event information 

received from hospitals to the NPSD through “common formats,” which are standardiz

data 

collection forms that AHRQ is developing. Additionally, AHRQ has issued two 

contracts to facilitate transmission of adverse event data from PSOs to the NPSD. The 

Iowa Foundation for Medical Care will be responsible for removing patient identifiers 

from PSO data prior to submission to the NPSD. Westat will operate the NPSD itself. 

The NPSD will allow AHRQ to receive and publicly disclose non-identifiable advers

event data at a national level. Once the NPSD is operational, the Patient Safety Act 

requires that the data be used to analyze national and regional statistics, including trends

and patterns o

a

CMS Receipt of Medicare Claims

In processing Medicare claims, CMS uses hospital claims data to identify certain advers

events, called hospital-acquired conditions. Since October 1, 2007, CMS has required 

that hospitals assign a present on admission (POA) indicator to each diagnosis for a

inpatient Medicare claims.14 The POA indicator differentiates diagnoses that were 

hospital-acquired from those that were present on admission. This was an initial step in 

complying with the Deficit Reduction Act of 2005 (DRA), which required CMS to se

hospital-acquired conditions for which hospitals would not be paid higher Medicare 

reimbursement.15 CMS selected 10 categories of conditions for the Medicare hospitalacquired condition policy, which became effective October 1, 2008, and denies

 

9 The Secretary delegated authority to AHRQ to make these determinations, as well as to fulfill other requirements of the Patient 

lth Service Act, §§ 923 and 924, 

e: Final Rule & Common Formats, December 8, 2008. Available online at 

Safety Act. Patient Safety and Quality Improvement Act of 2005, P.L.No. 109-41 § 2, Public Hea

42 U.S.C. §§ 299b-23 and -24; 73 Fed. Reg. 70732 (Nov. 21, 2008). 

10 AHRQ, PSO Updat

https://www.psoppc.org/c/document_library/get_file?uuid=c03fb6c5-0de4-49e2-9a1f-fc6ee47c2e28&groupId=10218. Accessed o

December 22, 2009.

n 

11 AHRQ, Patient Safety Organizations. Available online at http://www.pso.ahrq.gov/listing/alphalist.htm. Accessed on 

(4)(D), 42 U.S.C. § 1395ww(d)(4)(D). 

December 1, 2009. 

12 42 U.S.C. § 922b-23(a). 

13 42 U.S.C. § 299b-23(c). 

14 CMS, CMS Manual System, Change Request 5679 (July 20, 2007). 15 DRA, P.L.No. 109-171 § 5001(c)(1), Social Security Act § 1886(d)

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 5 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

higher payment for Medicare admissions complicated by the 10 conditions.16 

Appendix B contains a list of these conditions. 

 

16 Fiscal Year 2009 Inpatient Prospective Payment System Final Rule, 73 Fed. Reg. 48434, 48471-48491 (Aug. 19, 2008); 

CMS, CMS Manual System, Change Request 6189 (Oct. 3, 2008). 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 6 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

 lead 

t 

ent occurred, or the 

dividual providers involved, could discourage reporting of events. 

e hospital where an event occurred in disclosures, except for 

ossible patient privacy implications. We reviewed 17 selected State adverse event 

d CMS. 

 Events in Hospitals: State Reporting Systems

EI-06-07-00471) and initial contacts with State system staff, we identified 17 State 

 reporting systems that, as of July 2009, collected information from acute 

ts.17 

o 

erse event information from 

cute care hospitals. These PSOs are: California Hospital Patient Safety Organization; 

ctice Advancement Center; ECRI Institute PSO; HealthWatch; Human 

uri 

ata Collection and Analysis 

e conducted structured interviews with staff from the 17 State adverse event reporting 

stems to determine the extent to which State systems disclose information about events, 

 

Public Disclosure of Information About Adverse Events 

Public disclosure of adverse event information offers potential benefits, yet may also

to unintended negative consequences. For example, publicly disclosing adverse even

information can educate healthcare providers about the causes of events potentially 

leading to improvements in patient safety, and assist patients making decisions about 

their care. However, there is concern that disclosure of event information could 

undermine patient privacy and that naming the hospital where an ev

in

METHODOLOGY 

Scope 

For this memorandum report, we reviewed policies, practices, and plans for publicly 

disclosing information about adverse event causes and prevention strategies, while 

protecting patient privacy. We did not examine hospital or provider confidentiality 

issues, such as naming th

p

reporting systems, 8 selected PSOs that will forward data to AHRQ’s NPSD, an

Data collection for this study was performed from July through September 2009. 

Findings represent policies, practices, and plans in place during that time. 

Selection of State Adverse Event Reporting Systems and PSOs 

Using data from the OIG report Adverse

(O

adverse event

care hospitals about patients affected by adverse events and the causes of those even

States using these systems are: Colorado, Florida, Maine, Maryland, Massachusetts (tw

systems), Minnesota, Nevada, New Jersey, New York, Oregon, Pennsylvania, Rhode 

Island, South Carolina, South Dakota, Utah, and Vermont. 

Using AHRQ’s Directory of PSOs and contacts with PSO staff, we identified the first 

eight PSOs that either received or intended to receive adv

18 a

Clinical Pra

Performance Technology Group, Inc.; Institute for Safe Medication Practices; Misso

Center for Patient Safety; and, Peminic, Inc. 

D

W

sy

 

 We did not review State systems that, based on information from the 2008 OIG report, did not collect information from acute care 

hospitals both about patients affected by adverse events and the causes of those events. 

#P0002

17

18 HHS, AHRQ, Alphabetical Directory of Listed Patient Safety Organizations. Available online at 

http://www.pso.ahrq.gov/listing/alphalist.htm . Accessed on October 22, 2009. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 7 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

 corrective actions, risk reduction strategies, and patients affected by events. 

e also reviewed relevant documents recently published by State systems, such as 

, we determined the extent to which State systems collect 

ans for 

ome operational, and 

atient privacy issues. We reviewed relevant documents, such as AHRQ’s interim 

ents 

d 

ed 

ety 

sues. We also examined mechanisms that CMS uses to protect patient privacy when it 

e 

d 

th 

s. 

 

their causes,

W

reports, periodic bulletins, safety alerts, and information on State system Web sites. 

Regarding patient privacy

information about patients and the extent to which they disclose this information. We 

also identified State legal prohibitions against compelled release of information about 

patients, and confirmed our interpretations with State system staff. 

We conducted structured interviews with staff from AHRQ and the eight PSOs regarding

the extent to which they disclose information about adverse events, their future pl

disclosure, the status of efforts necessary for the NPSD to bec

p

guidance for PSOs, proposed and final rules for PSOs, contracts related to PSOs and the

NPSD, and the Patient Safety Act. We examined the Patient Safety Act for requirem

regarding protections of patient privacy that apply to information submitted to PSOs an

forwarded to the NPSD. 

We interviewed CMS staff regarding current and planned public disclosure of 

information from Medicare claims data that include POA indicators. We review

claims data and relevant documents to identify the extent to which these data could 

inform the public about hospital-acquired conditions, their causes, and patient saf

is

allows access to Medicare claims data. 

Limitations 

Although numerous entities collect information about adverse events, we could not 

examine all such entities for this memorandum report. Examples of other entities that 

receive adverse event information not examined in this memorandum report include th

Centers for Disease Control and Prevention’s National Health Safety Network, which 

receives reports of hospital-acquired infections; and a variety of data systems at the Foo

and Drug Administration (FDA) that receive reports of adverse events associated wi

approved drugs, devices, and biologics, among other 19

Standards 

This study was conducted in accordance with the Quality Standards for Inspections

approved by the Council of the Inspectors General on Integrity and Efficiency. 

 

19 A recent OIG report examined adverse event reporting to FDA for medical devices. OIG, Adverse Event Reporting for Medical 

Devices, OEI-01-08-00110, October 2009. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 8 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

RESULTS 

Public Disclosure of Information About Adverse Events is Limited Among the 

Entities in Our Review 

Seven State adverse event reporting systems disclosed more extensive information about 

the causes of adverse events and prevention strategies than other State systems. Such 

disclosure may provide the medical community with valuable information for improving 

patient safety. Another three State systems disclosed less extensive information about 

adverse events. AHRQ plans to disclose adverse event information but has not because 

data are not yet available in the NPSD. CMS is considering plans for disclosing 

information about hospital-acquired conditions in the future. 

Seven State Systems Publicly Disclosed More Extensive Information About Causes of 

Adverse Events and Prevention Strategies Than Other State Systems. These seven 

systems provided information to educate the medical community on how to prevent or 

reduce the occurrence of adverse events. Disclosure by these systems was based on 

multiple reports of similar adverse events and included analysis of their causes. 

Disclosures also contained information about actions taken by hospitals to correct 

identified vulnerabilities, strategies to reduce the risk of events occurring, and 

demonstrated improvements by hospitals. Table 1 provides details about the types of 

adverse event information disclosed by the 17 State systems that we reviewed. 

For example, one State system published an article addressing adverse events related to 

anticoagulants (blood-thinning medications). The article combined information from 

hundreds of adverse event reports received by the State system and data from 

evidence-based research. In brief case summaries, the article provided details about the 

events, including the level of patient harm and identified causes. To address the causes, 

the article recommended that hospitals establish anticoagulation management service 

programs that would document these services, educate patients and families, and gauge 

progress in improving performance. State system staff followed up 6 months after the 

article was distributed to hospitals and found that over half of hospitals in the State 

reported making changes as a result of the article. 

In contrast, three systems that we reviewed disclosed less extensive information about 

causes and prevention strategies for events. These systems disclosed either information 

about individual events or lists of events compiled from submitted hospital reports. For 

example, two systems posted information about individual events, including event type 

and date, hospital name and department, and possible contributing factors, but did not 

disclose root-cause analysis information drawn from data about multiple occurrences. 

The remaining system listed all reported corrective actions that hospitals anticipated 

making, such as planned training, but did not indicate which events led to the planned 

actions. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 9 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

Table 1: Adverse Event Information Disclosed by Selected State Systems

Disclosure About 

Individual Events 

Disclosure Based on Information 

From Multiple Events 

System 

Causes of 

Individual 

Events 

Hospital 

Corrective 

Actions 

Causes of 

Events by 

Type 

Hospital 

Corrective 

Actions 

Risk 

Reduction 

Strategies 

Evidence of 

Improvements 

Seven State systems with more extensive disclosure 

Maryland ● ● ● ●

Massachusetts, BRM* ● ● ● ● ● ●

Massachusetts, DPH* ● ● ● ● ●

Minnesota ● ● ● ●

New Jersey ● ● ● ● ●

Oregon ● ● ● ●

Pennsylvania ● ● ● ● ●

Three State systems with less extensive disclosure 

Colorado ● ● 

Maine ● 

Rhode Island ● ● 

Seven State systems with no disclosure 

Utah 

Florida 

Nevada 

New York 

South Carolina 

South Dakota 

Vermont 

* BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 

Source: OIG review of 17 selected State adverse event reporting systems, 2009. 

AHRQ Plans To Disclose Adverse Event Information, but the NPSD Is Not Operational 

and Possible Barriers to Data Submission Exist. AHRQ plans to use aggregated PSO 

data from the NPSD to identify national and regional trends of adverse events, and to 

make this information available to the public. AHRQ’s plans include generating two 

public reports, as required by the Patient Safety Act: a report about effective strategies 

for reducing medical errors and increasing patient safety, and a report containing trend 

analysis results. 

AHRQ officials estimated that initial NPSD data will be available for analysis and 

disclosure in early 2011. These initial data will include identification of adverse events 

and their contributing factors for hospitals. AHRQ officials reported additional plans to 

collect data about the causes of adverse events (e.g., root-cause analysis) and to expand 

data collection beyond hospitals to other healthcare settings, such as nursing homes. 

However, AHRQ has not announced a timeline for these additional plans. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 10 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

e 

g 

to 

fessionals and consumers. 

Staff from several PSOs that we reviewed reported barriers that could limit hospital 

participation with PSOs and data submission to the NPSD. For example, staff from on

PSO reported that some hospitals had questioned the costs and benefits of PSO 

participation. Additionally, staff from two PSOs indicated that they were unsure about 

the value of submitting data to the NPSD. 

Beyond AHRQ’s disclosure of PSO data, individual PSOs can also generate learnin

materials for hospitals. Staff from only one PSO that we reviewed indicated plans 

share such information directly with the public. These staff reported plans to include

information about medication-related adverse events in a medication safety newsletter 

available to all healthcare pro

CMS Is Considering Plans for Public Disclosure of Information About Medicare 

Hospital-Acquired Conditions, a Subset of Adverse Events. CMS officials indicated th

CMS is considering posting the incidence of hospital-acquired conditions on its

Compare Web site, which currently includes other quality measures about hospitals. 

Additionally, CMS may publicly disclose results from an ongoing evaluation focused on

the Medicare hospital-acquired conditions policy, its effects on Medicare reimbursement, 

utilization, quality, patient safety, and any unintended consequences. CMS contracted

the evaluation in September 2009, and will determine the extent of disclosure after 

findings are known. 

Although valuable for ascertaining the incidence of hospital-acquired 

at 

 Hospital 

 for 

conditions, 

edicare claims data lack information about the causes of these conditions or prevention 

ll Reviewed Entities Protect Patient Privacy Through Policies, Practices, and Legal 

rovisions 

ach entity that we reviewed has patient privacy protections. These protections vary 

cross entities and include policies regarding what patient identifiers are collected, 

ractices regarding disclosing patient identifiers, and legal protections that apply to 

atient identifiers. 

M

strategies, limiting their usefulness for improving patient safety. CMS officials 

acknowledged that supplemental information about the circumstances under which a 

beneficiary experienced a hospital-acquired condition could allow better understanding of 

causes and development of prevention strategies. To collect such information, CMS is 

considering combining hospital-acquired condition data with data from other systems. 

A

P

E

a

p

p

State Systems Either Do Not Collect or Disclose Patient Identifiers and Most Prohibit the 

Compelled Release of Patient Identifiers. Five State systems that we reviewed do not 

collect any patient identifiers, such as the patient’s name or address. Because these State 

systems do not collect patient identifiers, they cannot disclose such information. See 

Appendix C for the types of patient identifiers that each of the 17 selected State systems 

collect. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 11 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

Our review found no instances in which the remaining 12 State systems disclosed patient 

identifiers publicly. Rather, most publications referred to patients in ways that would 

prevent identification of individuals. For example, one approach to protecting patient 

privacy involved developing profiles of typical patients who experience a type of event, 

such as female, Caucasian, 60–64 years of age, and admitted to the hospital an average of 

13 days prior to the event. However, we noticed that some publications contained a level 

of detail that could be used to identify the patient. The possibility of compromised 

patient privacy could be heightened under certain circumstances, such as when an 

adverse event involves a patient who lives in a smaller community and when media 

reports about an event contain additional information that can be matched to disclosed 

information about the event. 

Beyond disclosure of patient information in publications intended for learning, State 

systems may be asked to disclose patient identifiers under four circumstances: public 

records requests, civil judicial proceedings, criminal judicial proceedings, and 

administrative proceedings. State laws vary regarding prohibitions against State systems 

being compelled to release patient identifiers in these instances. Eight of the seventeen 

systems that we reviewed have State laws that expressly prohibit the compelled release of 

patient identifiers under all four circumstances. State laws for another eight systems 

prohibit compelled release under at least one, but not all, of the circumstances. Table 2 

lists the four circumstances and whether State laws prohibit systems from being 

compelled to release patient identifiers under each circumstance. Appendix D expands 

Table 2 by providing citations to relevant State laws and regulations. 

For three systems, we found it difficult to ascertain whether State laws prohibited the 

system from being legally compelled to release patient identifiers under one or more of 

these circumstances. For example, one State law specifies that adverse event information 

“shall be confidential, except for official purposes,” but does not define official purposes. 

These ambiguous laws could require further administrative or judicial interpretation 

regarding protection of patient privacy. 

 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 12 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

Table 2: Legal Prohibitions Against Compelled Release of Patient 

Identifiers by Selected State Adverse Event Reporting Systems 

System 

Public 

Records 

Request 

Civil Judicial 

Proceeding 

Criminal 

Judicial 

Proceeding 

Administrative 

Proceeding 

Colorado Prohibited Prohibited Prohibited Prohibited 

Florida Prohibited Prohibited Not prohibited Prohibited

Maine* Prohibited Prohibited Prohibited Prohibited 

Maryland Prohibited Prohibited Not prohibited Not prohibited 

Massachusetts, BRM# Prohibited Prohibited Prohibited Prohibited 

Massachusetts, DPH# Prohibited Not prohibited Not prohibited Not prohibited 

Minnesota* Prohibited Not prohibited Not prohibited Not prohibited 

Nevada Prohibited Prohibited Prohibited Prohibited

New Jersey Prohibited Prohibited Prohibited Prohibited

New York Prohibited Unclear Unclear Unclear 

Oregon* Prohibited Prohibited Not prohibited Prohibited

Pennsylvania* Prohibited Prohibited Prohibited Prohibited

Rhode Island Prohibited Prohibited Prohibited Prohibited

South Carolina* Prohibited Unclear Unclear Unclear 

South Dakota Unclear Unclear Unclear Unclear 

Utah Prohibited Prohibited Prohibited Prohibited

Vermont Prohibited Prohibited Not prohibited Prohibited

*This State system does not collect patient identifiers. 

# BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 

Source: OIG review of 17 selected State adverse event reporting systems, 2009. 

Patient Identifiers Collected by PSOs Will Be Removed Before Submission to the NPSD, 

and Patient Privacy Is Protected Under the Patient Safety Act. The initial common 

formats for PSO data include patient identifiers, such as patient name, date of birth, and 

medical record number. To ensure that no patient identifiers are disclosed to the public, 

an AHRQ contractor will remove patient identifiers before submission to the NPSD.20 

The contractor is also tasked with developing a protocol for suppressing descriptive 

information that could compromise patient identity. For example, if only one hospital 

performed liver transplants in a State, an adverse event report involving a liver transplant 

in the State would require suppressing either the State name or the procedure name to 

protect patient privacy. 

To encourage hospitals to report information about adverse events, Federal privilege and 

confidentiality protections apply to adverse event information collected by PSOs.21 

Privilege protections outlined in the Patient Safety Act limit or forbid the use of PSO data 

in criminal, civil, administrative, or other proceedings. Additionally, confidentiality 

 

20 Congress mandated that the NPSD use nonidentifiable information. 42 U.S.C. § 299b-23. 21 42 U.S.C. § 299b-22. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 13 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

it PSOs from disclosing any identifiable information about a provider 

r patient. 

protections prohib

o

Patient Identifiers Collected by CMS Are Released Only Through Data Use Agreements 

Based on Federal Laws That Protect Patient Privacy. Medicare claims contain 

information about Medicare beneficiaries including names, Medicare numbers, a

dates of birth, gender, and race; and details about their hospital stays, such as provid

names, billing numbers, diagnosis codes, and charges for services.22 Although CMS has

not disclosed information to the public about hospital-acquired conditions identified 

through Medicare claims data, it does allow access to claims data in two forms: full 

Medicare claims data and limited datasets. Full Medicare claims data include benef

and provider identifiers, whereas limited da

ddresses, 

er 

iciary 

tasets exclude or aggregate all identifiers of 

atients and providers. For example, instead of the beneficiary’s date of birth, limited 

, state 

f

ase claims data to a user who “agrees to implement appropriate 

anagement, operational and technical safeguards sufficient to protect the 

s and 

 and 

p

datasets contain an age range, such as “[age] 65 through 69.”23 

To access either full or limited datasets, users must demonstrate a need for the data

the intended use of the research, and sign a data use agreement that includes specific 

provisions regarding the protection of patient privacy.24 Pursuant to the Privacy Act o

1974, CMS will only rele

m

confidentiality, integrity and availability of the information and information system

to prevent unauthorized access.”25 Additionally, CMS’s Privacy Board must review

approve each request for access to full datasets with identifiers and any publications 

resulting from use of identifiable data.26

 

22 CMS, Medicare Claims Processing Manual ch. 25. Available online at 

http://www.cms.hhs.gov/manuals/downloads/clm104c25.pdf. Accessed on October 22, 2009. 23 CMS, LDS Inpatient SNF Claim Record Data Dictionary, 2009. Available online at 

http://www.cms.hhs.gov/LimitedDataSets/Downloads/SAFldsINPMar2009.pdf. Accessed on October 22, 2009. 24 CMS has two distinct data use agreements. Form CMS-R-0235 is used when the recipient is receiving data containing individual 

identifiers. Form CMS-R-0235L is used when the recipient is receiving limited data sets. Available online at 

http://www.cms.hhs.gov/PrivProtectedData/. Accessed on December 2, 2009. 25 71 Fed. Reg. 67137, 67142 (Nov. 20, 2006). 

26 The CMS Privacy Board safeguards personally identifiable information, assures that there is minimal privacy risk to an individual 

when information is released to a researcher, and ensures compliance with the Privacy Act of 1974 and the HIPAA Privacy Rule. 

Available online at http://www.cms.hhs.gov/SystemLifecycleFramework/downloads/privacypolicy.pdf. Accessed on 

November 25, 2009. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 14 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

sued directly in 

 we concluded that 

ublic disclosure process. 

 purposes, such as for generating 

formation for patient safety improvements, conducting oversight of hospitals, or 

yments for healthcare services. Given these differences, we believe that it 

s of the entities that we reviewed. Second, all these entities 

ance for reducing occurrences, and information about 

atient safety. 

formation from hospitals and are 

re 

to have 

ew and useful information about hospital-acquired conditions, 

lease refer to report number OEI-06-09-00360 in all correspondence. 

CONCLUSION 

This memorandum report contains no recommendations and is being is

final form. We did not make recommendations for two reasons. First,

it is not appropriate to make a broad recommendation for a p

Entities collect adverse event data for different

in

processing pa

is less useful to propose a standard process for public disclosure than it is to describe the 

current and planned practice

have patient privacy protections. Therefore we did not indentify particular privacy 

concerns that warrant recommendations. 

The disclosure practices of the seven State systems with more extensive disclosure can 

serve as models for other entities. These systems disclose analysis of the causes of 

events, evidence-based guid

demonstrated improvements by hospitals. This type of information, if disseminated by 

other State systems and entities that receive adverse event information, could help to 

improve p

PSOs are expected to provide AHRQ with national data about adverse events and 

contributing factors. Once common formats are fully implemented, AHRQ will be 

positioned to publicly disclose more extensive information about the causes of events, 

prevention strategies, and the effectiveness of those strategies. It is encouraging that 

some PSOs are currently receiving adverse event in

preparing to submit data to the NPSD. However, successful implementation will requi

AHRQ to address the barriers that staff from one PSO described, including that some 

hospitals question the cost and benefit of PSO participation. 

Using only Medicare claims data, CMS is limited in what it can disclose about hospitalacquired conditions, because claims data do not contain information about causes. 

However, CMS’s plan to supplement claims data with other data sources appears 

the potential to generate n

their causes, and prevention. 

If you have comments or questions about this memorandum report, please provide them 

within 60 days. P

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 15 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

APPENDIX A: TAX RELIEF AND HEALTH CARE ACT OF 2006

P.L.No. 109-432 

DIVISION B – MEDICARE AND OTHER HEALTH PROVISIONS

TITLE II—MEDICARE BENEFICIARY PROTECTIONS

SEC 203 OIG STUDY OF NEVER EVENTS

(a) Study.— 

(1) In general.—The Inspector General in the Department of Health and Human Services 

shall conduct a study on— 

(A) incidences of never events for Medicare beneficiaries, including types of such events 

and payments by any party for such events; 

(B) the extent to which the Medicare program paid, denied payment, or recouped payment 

for services furnished in connection with such events and the extent to which beneficiaries 

paid for such services; and 

(C) the administrative processes of the Centers for Medicare & Medicaid Services to detect 

such events and to deny or recoup payments for services furnished in connection with such 

an event. 

(2) Conduct of study.—In conducting the study under paragraph (1), the Inspector 

General— 

(A) shall audit a representative sample of claims and medical records of Medicare 

beneficiaries to identify never events and any payment (or recouping of payment) for 

services furnished in connection with such events; 

(B) may request access to such claims and records from any Medicare contractor; and 

(C) shall not release individually identifiable information or facility-specific information. 

(b) Report.—Not later than 2 years after the date of the enactment of this Act, the Inspector 

General shall submit a report to Congress on the study conducted under this section. Such 

report shall include recommendations for such legislation and administrative action, such as 

a noncoverage policy or denial of payments, as the Inspector General determines 

appropriate, including— 

(1) recommendations on processes to identify never events and to deny or recoup payments 

for services furnished in connection with such events; and 

(2) a recommendation on a potential process (or processes) for public disclosure of never 

events which— 

(A) will ensure protection of patient privacy; and 

(B) will permit the use of the disclosed information for a root cause analysis to inform the 

public and the medical community about safety issues involved. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 16 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

APPENDIX A (continued) 

(c) Funding.— Out of any funds in the Treasury not otherwise appropriated, there are 

appropriated to the Inspector General of the Department of Health and Human Services 

$3,000,000 to carry out this section, to be available until January 1, 2010. 

(d) Never Events Defined.—For purposes of this section, the term “never event” means an 

event that is listed and endorsed as a serious reportable event by the National Quality 

Forum as of November 16, 2006. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 17 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

 

APPENDIX B: MEDICARE LIST OF HOSPITAL-ACQUIRED CONDITIONS 

The Centers for Medicare & Medicaid Services (CMS) list of hospital-acquired conditions 

is divided into 10 categories. Effective October 1, 2008, CMS no longer pays a higher 

reimbursement for hospitalizations complicated by these categories of conditions if they 

were not present on admission. 

Hospital-Acquired Condition 

1. Foreign object retained after surgery 

2. Air embolism 

3. Blood incompatibility 

4. Pressure ulcers (stages III and IV) 

5. Falls 

A. Fracture 

B. Dislocation 

C. Intracranial injury 

D. Crushing injury 

E. Burn 

F. Electric shock 

6. Manifestations of poor glycemic control 

A. Hypoglycemic coma 

B. Diabetic ketoacidosis 

C. Nonkeototic hyperosmolar coma 

D. Secondary diabetes with ketoacidosis 

E. Secondary diabetes with hyperosmolarity 

7. Catheter-associated urinary tract infection 

8. Vascular catheter-associated infe ction

9. Deep vein thrombosis/pulmonary embolism associated with 

A. Total knee replacement 

B. Hip replacement 

10. Surgical site infection 

A. Mediastinitis after coronary artery bypass graft 

B. Associated with certain orthopedic procedures involving the 

a. Spine 

b. Neck 

c. Shoulder 

d. Elbow 

C. Associated with certain bariatric surgical procedures for obesity 

a. Laprascopic gastric bypass 

b. Gastroenterostomy 

c. Laparoscopic gastric restrictive surgery

Source: Fiscal Year 2009 Final Inpatient Prospective Payment System Rule, 

73 Fed. Reg. 48434, 48471 (August 19, 2008). 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 18 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

APPENDIX C: PATIENT IDENTIFIERS COLLECTED BY SELECTED STATE 

ADVERSE EVENT REPORTING SYSTEMS 

System Name Address Date of 

Birth 

Identifiable 

Number*

Colorado ●

Florida ● ● ●

Maine 

Maryland ● ●

Massachusetts, BRM# ● ●

Massachusetts, DPH# ● ● 

Minnesota 

Nevada ● 

New Jersey ● ● ● ●

New York ● ●

Oregon 

Pennsylvania 

Rhode Island ●

South Carolina 

South Dakota ● 

Utah ● 

Vermont ● 

* Includes medical record number, hospital billin

ates the Board of Registration i

g number, uniqu

n Medicine and D

e identifier, or patient identification number. 

# BRM abbrevi PH abbreviates the Department of Public Health. 

Source: Office of Inspector General review of 17 selected State adverse event reporting systems, 2009. 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events
Page 19 – Carolyn M. Clancy, M.D., and Charlene Frizzera 

OEI-06-09-00360 Adverse Events in Hospitals: Public Disclosure of Information About Events

APPENDIX D: LEGAL PROHIBITIONS AGAINST COMPELLED RELEASE OF 

PATIENT IDENTIFIERS BY SELECTED STATE ADVERSE EVENT REPORTING 

SYSTEMS 

State Public Record 

Request 

Civil Judicial 

Proceeding 

Criminal Judicial 

Proceeding 

Administrative 

Proceeding 

Colorado1 Prohibited Prohibited Prohibited Prohibited 

Florida2 Prohibited Prohibited Not prohibited Prohibited 

Maine3 * Prohibited Prohibited Prohibited Prohibited 

Maryland4 Prohibited Prohibited Not prohibited Not prohibited 

Massachusetts, BRM5 # Prohibited Prohibited Prohibited Prohibited 

Massachusetts, DPH6 # Prohibited Not prohibited Not prohibited Not prohibited 

Minnesota7 * Prohibited Not prohibited Not prohibited Not prohibited 

Nevada8 Prohibited Prohibited Prohibited Prohibited 

New Jersey9 Prohibited Prohibited Prohibited Prohibited 

New York10 Prohibited Unclear Unclear Unclear

Oregon11 * Prohibited Prohibited Not prohibited Prohibited 

Pennsylvania12 * Prohibited Prohibited Prohibited Prohibited 

Rhode Island13 Prohibited Prohibited Prohibited Prohibited 

South Carolina14 * Prohibited Unclear Unclear Unclear 

South Dakota15 Unclear Unclear Unclear Unclear

Utah16 Prohibited Prohibited Prohibited Prohibited 

Vermont17 Prohibited Prohibited Not prohibited Prohibited 

1. Colorado Revised Statutes (CRS) 25-1-124(4); 

CRS 24-72-204. 

2. Florida Statutes § 395.0197(7).

3. 22 Maine Revised Statutes § 8754(3). 

4. Code of Maryland Regulations 10.07.06.09. 

5. Massachusetts General Law (MGL) ch. 4, § 7; 

MGL. ch. 111, §§ 204 and 205; 243 Code of 

Massachusetts Regulations 3.04. 

6. MGL ch. 4, § 7. 

7. Minnesota Statutes § 144.7065, sub. 0. 

8. Nevada Revised Statutes Annotated (NRS) § 439.840 

(as amended by 2009 Nevada Statutes 153 § 8); 

NRS § 439.860. 

9. New Jersey Statutes § 26:2H-12.25(f). 

10. New York Consolidated Law Service Public Health 

§ 2805- m. Note: Section 2805-m of the New York 

Public Health Law states that adverse events reports 

submitted to the State shall be kept confidential and 

shall not be subject to discovery in civil actions. 

 

10. (continued) While Section 2805-m does not 

expressly state that it affords adverse event reports 

an evidentiary privilege, judicial decisions suggest 

that it does. Moreover, although at least one 

intermediate appellate court has held that this statute 

applies to grand jury subpoenas, the State’s highest 

court has not addressed this issue. 

11. Oregon Laws 2003, ch. 686, § 12. 

12. 40 Pennsylvania Statutes (PS) § 1303.311(h); 

40 PS §§ 1303.311(d). 

13. Rhode Island General Laws §§ 23-17-40(g), 

23-17-15, and 23-17-25(a). 

14. South Carolina Code Annotated §§ 44-7-315(A) and 

§ 44-7-315(B); S.C. Code Ann. § 44-7-310. 

15. South Dakota Codified Laws § 34-12-17. 

16. Utah Administrative Code (UAC) R380-200-6 and 

R380-210-5; Title 26, Chapter 3 of the Utah Code; 

Utah Code Annotated (UCA) §§ 26-3-7 and 26-3-9; 

UCA § 63G-2-201. 

17. 18 Vermont Statutes Annotated § 1917. 

*This State system does not collect patient identifiers. 

# BRM abbreviates the Board of Registration in Medicine and DPH abbreviates the Department of Public Health. 

Source: Office of Inspector General review of 17 selected State adverse event reporting systems, 2009.