In the 108th Congress, the House and Senate passed competing versions of the Patient Safetyand Quality Improvement Act ( H.R. 663 , S. 720 ). Despite broad bipartisansupport for the legislation, no further action took place before adjournment in December 2004. OnMarch 9, 2005, the Senate Committee on Health, Education, Labor, and Pensions (HELP)unanimously approved a new patient safety bill ( S. 544 ), which is identical to last year'sSenate-passed measure. The patient safety legislation is intended to encourage the voluntaryreporting of information on medical errors by establishing federal evidentiary privilege andconfidentiality protections for such information. Health care providers are reluctant to reportmedical errors because they fear that the information will damage their reputations and be used inmedical malpractice lawsuits. Patient safety emerged as a major health policy issue in late 1999 with the release of theInstitute of Medicine's (IOM) report To Err Is Human. (1) The IOM report concluded that preventable medical errors causeas many as 98,000 deaths each year and called on all parties to make improving patient safety anational health policy priority. It recommended establishing a national mandatory reporting systemto hold hospitals and other health care facilities accountable for errors that lead to serious injury ordeath. Emphasizing that medical errors are primarily the result of faulty systems, process, andconditions that lead people to make mistakes, the IOM also recommended the development ofvoluntary, confidential systems for reporting medical errors that result in no harm (i.e., close calls)or minimal harm. Analysis of such voluntarily reported information could then be used to identifysystem vulnerabilities and develop preventive strategies. The Patient Safety and QualityImprovement Act attempted to implement that recommendation. The IOM based its conclusions on epidemiologic studies published in the 1980s and early1990s. While medical researchers were familiar with the published estimates of the prevalence ofmedical errors in hospitals and other inpatient settings, the information was new to the public andit caught the attention of federal and state legislators and health care policymakers. Indeed, a 1999survey showed that patient safety was the most closely followed health policy story of the year. (2) As a result of the IOM report,numerous patient safety initiatives were initiated within the federal government and throughout theprivate sector, in health plans and health care trade organizations and accrediting andstandard-setting bodies. States responded to the IOM report by considering legislation to expand existing mandatoryreporting systems and, in some cases, enact new systems. Currently, 22 states have mandatoryreporting systems. The goal is to hold hospitals and health care providers accountable to the publicfor the most serious mistakes in the delivery of health care. In an effort to encourage providers toreport errors, most states have adopted measures to protect reporting system data from use bymalpractice attorneys. Policymakers have had to balance provider concerns about the legalconsequences of making information available to attorneys and patients with the desire for publicaccountability. Legislation to encourage medical errors reporting was first introduced in the 106th Congress,following the release of the IOM report. (3) Much of it was reintroduced in the 107th Congress and again in the108th. Patient safety lies at the heart of the current debate on medical malpractice reform. Many trialattorneys defend the current tort system, claiming that the threat of litigation makes providerspractice safer medicine. They view tort law as an important driver of health care quality. Butexperts on health care quality reject this argument. Echoing the IOM's recommendations, theycontend that the only way to realize significant improvements in patient safety is by improving healthcare systems. And that, in turn, requires the analysis of medical errors report. By discouragingphysicians from reporting such information, the tort system is in conflict with this approach to safetyimprovement. This report provides an overview and some analysis of medical errors reporting and theHouse and Senate patient safety bills. It begins with background information on the nature andcauses of medical errors, followed by a brief comparison of the differences between mandatory andvoluntary reporting systems. The report then discusses some of the legal and policy issues facingstate mandatory reporting systems and major national voluntary reporting systems, and identifiesdesign features of effective reporting programs. It concludes with a discussion and side-by-sidecomparison of H.R. 663 and S. 544 . The IOM report defined error as the failure of a planned action to be completed as intended(an error of execution) or the use of a wrong plan to achieve an aim (an error of planning). Medicalerrors can happen at all stages of the process of care, from diagnosis, to treatment, to preventive care. Not all errors result in harm. Those that do are referred to as preventable adverse events. An adverseevent is an injury related to a medical intervention and not due to the underlying medical conditionof the patient. While adverse events are often attributable to error and, therefore, preventable, theyneed not always be the result of medical mismanagement (see discussion of adverse drug reactionsbelow). A limited number of published studies have examined adverse events among hospitalizedpatients. Extrapolating from the results of two large, retrospective reviews of hospital records, theIOM estimated that more than 1 million medical errors occur each year in the United States, of whichbetween 44,000 and 98,000 are fatal. (4) It also concluded that errors may cost the nation as much as $29billion annually in direct medical costs and lost income and productivity. Some researchers havechallenged the accuracy of the IOM's numbers, but there is general agreement that the problem isserious. (5) Still others saythe IOM may have underestimated the true incidence of medical errors because it only considerederrors that occur among hospital patients, which represent a small proportion of the total populationat risk. Many patients receive increasingly complex care in ambulatory settings such as outpatientsurgical centers, physicians' offices, and clinics. Echoing the views of most health care analysts, the IOM emphasized that medical errors areprimarily a systemic problem and generally not attributable to individual negligence or misconduct. Errors are the result of faulty systems, processes, and conditions that lead people to make mistakes. According to the IOM, health care lags behind other industries (e.g., aviation, nuclear power) thatpay attention to factors that affect performance, such as work hours, work conditions, informationtechnology, team relationships, and the design of tasks to make errors more difficult to commit. While there have been few studies that examined all types of adverse events occurring inhospitals and other provider settings, there is an abundant literature that focuses on adverse drugevents (i.e., adverse events specifically associated with ordering and administering medication topatients). Adverse drug events are often found to be the most common type of adverse eventdocumented in hospital settings. In its report, the IOM estimated that drug-related adverse eventskill up to 7,000 Americans annually. Although the distinction is not always clear, researchers divide adverse drug events into twotypes: adverse drug reactions resulting from previously known or newly detected side effects ofdrugs that are correctly prescribed and administered; and injuries that are caused by errors inprescribing, dispensing, and administering medication. Examples of medication errors includephysicians who prescribe antibiotics to patients with documented allergies to those medications,nurses who do not properly dilute intravenous solutions, and patients who fail to take medicationsas directed. Studies reveal that adverse drug events occur in 6.5% to more than 20% of hospitalizedpatients, and that between one-quarter and one-half of these are due to medication errors and are,therefore, avoidable. (6) Newly published research on medication safety among Medicare patients in outpatient settingssuggests that the Medicare population as a whole may experience as many as 180,000life-threatening or fatal adverse drug events annually. (7) It is important to recognize that the majority of medication errorsdo not lead to an adverse drug event, either because they are caught before the drugs areadministered, or because they result in no ill effects. In the IOM's analysis, medication errorstypically result from one or more failures in the increasingly complex systems of medicationmanagement, rather than from negligence on the part of individual health care practitioners. The IOM recommended establishing a nationwide mandatory reporting system for statesto collect standardized information (initially from hospitals, but eventually from other institutionaland ambulatory health care settings) on adverse events that result in death or serious harm. Theprimary purpose of mandatory reporting systems is to hold providers accountable by ensuring thatserious mistakes are reported and investigated and that appropriate follow-up action is taken.Organizations that continue unsafe practices risk citations, penalties, sanctions, suspension orrevocation of licenses, and possible public exposure and loss of business. The IOM proposed thatmandatory reporting system data be made available to the public once they have been validated. To complement the mandatory reporting of serious and fatal errors, the IOM alsorecommended the development of voluntary reporting systems for collecting information on errorsthat result in little or no harm. The focus of voluntary reporting is the analysis and identification ofsystemic problems that could lead to more serious types of errors, and the development of preventionstrategies. To encourage reporting, the IOM further recommended that information collected undera voluntary reporting system be strictly confidential and protected from legal discovery. Table 1 summarizes the differences between mandatory and voluntary reporting systems. State adverse event reporting systems date back to the 1970s. The IOM reviewed reportingsystems in 13 states to learn more about their scope and operations during the preparation of its 1999report. Since the report's release, more than half of the states have introduced legislation to addressthe problem of medical errors, and several have enacted laws to create new mandatory reportingsystems or modify existing ones. Twenty-two states now have laws or regulations that requiregeneral and acute care hospitals to report medical errors. (8) Table 1. Characteristics of Mandatory and Voluntary MedicalErrors Reporting Systems as Proposed by the IOM Sources : Institute of Medicine; National Academy for State Health Policy. The reporting requirements vary widely from state to state, though all require disclosure ofevents that result in unanticipated death. For example, Washington requires the reporting ofmedication-related errors, whereas Tennessee requires health care facilities to report any "unusualevents." In Florida, hospitals are required to report errors that result in certain specified injuries(e.g., brain or spinal damage), whereas in Pennsylvania they must report "any situation or occurrencethat could seriously compromise quality assurance or patient safety." Arizona requires health carefacilities to review reports made by medical practitioners regarding violations of professionalstandards or the law. In contrast, New Jersey requires hospitals and other institutions to report"serious medical errors" to regulators and patients. Some states also include in their reportingmandates provisions to prevent the discovery of error information in civil or administrativeproceedings. Few states have the experts to analyze more than a fraction of the reports they receive. Most reports are not investigated and few hospitals receive any feedback. (9) States face a difficult challenge in designing their reporting systems as they attempt toreconcile two competing objectives. They must motivate health care providers and facilities toreport errors promptly and accurately, while at the same time holding them accountable through asystem of public disclosure of information about errors. The IOM concluded that the public has aright to information concerning the safety of the health care system. Providers, however, arereluctant to report adverse events. They fear that publicly released data will lead to an increase inmalpractice lawsuits. The more comprehensive and organized the reporting system database, thegreater the legal threat it may pose to providers. In a 2003 report on state error reporting systems, the National Academy for State HealthPolicy (NASHP) concluded that the balance between protecting data from legal discovery anddisclosing information to the public appears to be tipped in favor of data protection. (10) Attorneys may compel disclosure of information considered confidential by the state througha variety of legal processes including: (1) Freedom of Information or Open Records requests; (2)subpoenas; (3) legal discovery; and (4) admission into evidence in a civil or administrativeproceeding. To allay providers' concerns about litigation, states have pursued a variety of legaloptions to protect mandatory reporting system data. (11) Some states have exempted reporting system data from theirpublic disclosure (i.e., Freedom of Information) laws, while others have relied on their existing peerreview statutes. (12) Peerreview laws can provide strong protections for reporting system data if they cover (or are interpretedto cover) all activities related to the administration of the reporting system. However, courts haveoccasionally found that the rights of an individual to information relating to a personal lawsuittrumps peer review protection. For these reasons, most of the mandatory reporting systems established since the IOM reporthave comprehensive, system-specific protections of data and reporters built into the authorizingstatute. For example, information may be protected from discovery, subpoena, search warrant, andevidence in civil or administrative proceedings. Protections for reporters may include exclusionfrom civil and criminal lawsuits, monetary liability, state antitrust lawsuits, compelled testimony,and employer retaliation (i.e., "whistleblower" protection). System design features, such as de-identifying data and receiving reports anonymously, mayreduce the need for strong legal protections by making it more difficult to link specific incidents toindividuals or institutions. Of course, such measures also limit the utility of the information toanalysts. Despite their efforts to shield error information from legal discovery and public disclosure,states have had limited success in encouraging providers to report adverse events. Underreportingis a serious issue for state reporting systems and it can have important consequences for health carequality. (13) Failure toinform a patient of a medical error may delay or deprive prompt treatment, which in turn may exposethe physician to greater liability. Underreporting also hinders research on the prevalence and rootcauses of errors, hampering quality improvement initiatives. While providers' fears of legal exposure are real and must be addressed, it remains unclearwhether they have merit. There are no studies on whether reported error information is being usedin malpractice litigation. Moreover, there is little research on the influence of specific laws onreporting behavior. Further complicating the issue is the fact that fear of liability is just one ofseveral factors that lead to the underreporting of medical errors. Other factors include facilities' lackof internal systems to identify events, the culture of medical practice that discourages drawingattention to errors, fear of institutional sanctions, anxiety about maintaining good relationships withpeers, loss of business, damage to reputation, and whether the amount of feedback and the potentialbenefits from reporting justify the time and effort it takes to report. There is not enough evidenceto predict the impact that eliminating one or more of these disincentives would have on reportingbehavior. (14) Somedegree of legal protection may be necessary to encourage reporting, but it may not be sufficient tocreate an environmental conducive to reporting. (15) The IOM recommended that mandatory reporting systems publicly disclose all informationuncovered during investigations. Polls indicate broad public support for such disclosure, and someanalysts argue that disclosure is necessary to drive improvements in health care. However, accordingto NASHP, public disclosure of adverse event information is "sporadic and inconsistent." Whilesome states are prohibited from releasing certain data by statute, others that are permitted todisclosure certain information refrain from doing so because of concerns that the data are incompleteand unreliable and may be misinterpreted by the public. In some cases, states are also reluctant todisclose information in order to alleviate the concerns of hospitals and practitioners. (16) NASHP found that seven states with mandatory reporting systems release incident-specificdata. The remaining states issue or plan to issue aggregate reports. Incident-specific data are mostcommonly provided on a request only basis. Where information is available to the public, it is oftendifficult to access or requires specific information on how and where to request the information inorder to access it. The data may be provided in raw form without accompanying analysis to assistwith interpretation. (17) Overall, it appears that state reporting systems have had at best a modest impact onimproving patient safety. Evidence from hospitals that the reporting and investigation of seriousevents has led to improvement in patient safety is largely anecdotal. As noted above, most stateprograms are plagued by underreporting, especially in their early years of operation. The IOM reportobserved that few states aggregate the data or analyze them to identify general trends. Analysis andfollow-up tend to occur on a case-by-case basis. The report cited limited resources and the absenceof standard reporting requirements as major impediments to making greater use of the reported data. It concluded that "state programs appear to provide a public response for investigation of specificevents, but are less successful in synthesizing information to analyze where broad systemimprovements might take place or in communicating alerts and concerns to other institutions." Insome states, reporting systems established by law are not operating due to a lack of funds. The IOM recommended that state regulatory programs continue to operate mandatoryreporting systems as they have the authority to investigate specific cases and issue penalties or fines. However, in order to establish a nationwide mandatory reporting system, the IOM recommended thatCongress (1) designate the National Quality Forum as the entity responsible for issuing andmaintaining reporting standards to be used by states, (2) require health care institutions to reportstandardized information on a defined list of adverse events, and (3) provide funds and technicalexpertise to state governments to establish or improve their error reporting systems. The National Quality Forum (NQF), established in May 1999 following the recommendationof the President's Advisory Commission on Consumer Protection and Quality in the Health CareIndustry, is a private, nonprofit voluntary consensus standards setting organization created to developand implement a national strategy for the measurement and reporting of health care quality. Actingon the IOM's recommendation, the NQF in 2002 released a list of 27 serious, preventable adverseevents that should be reported by all licensed health care facilities. The list includes standardizeddefinitions of key terms to encourage consistent use and implementation across the country. (18) The IOM further proposed that the Department of Health and Human Services (HHS) collecterror reports should a state choose not to implement a mandatory reporting system. Currently, HHSdoes not require health care institutions or providers to report information on medical errors. (19) The IOM alsorecommended the establishment of a Center for Patient Safety within AHRQ for states to shareinformation and expertise, and to receive and analyze aggregate reports from states to identifypersistent safety issues. As a complement to the mandatory reporting of serious errors, the IOM recommendedestablishing voluntary reporting systems to collect information on less serious mistakes that resultin little or no harm. Information gathered by voluntary reporting systems may be used to identifyvulnerabilities and weaknesses in health care systems and to make improvements to prevent seriouserrors from occurring. The IOM report and several more recent analyses have all highlighted the Aviation SafetyReporting System (ASRS) as a potential model for establishing national voluntary systems forreporting medical errors. ASRS was created in 1975 to encourage pilots, controllers, flightattendants, maintenance personnel, and others in the civilian airline industry to report incidents orsituations in which aviation safety was compromised. The program has become well-established andtrusted within the airline industry and is credited with contributing to improvements in aviationsafety over the past 28 years. ASRS analyzes the voluntarily submitted aviation safety incidentreports to identify deficiencies and discrepancies in the national aviation system so that correctiveaction can be taken. ASRS data are also used to support policies and planning for improving thenational aviation system, and to strengthen the foundation of aviation human factors safety research. This is especially important given estimates that as much as two-thirds of all aviation accidents andincidents are rooted in human performance error. ASRS provides feedback to the aviationcommunity in the form of alert messages identifying problems that may require immediate action,analytical reports, an online database, a monthly safety newsletter, and a quarterly safety bulletin. ASRS is administered by the National Aeronautics and Space Administration (NASA) underan agreement with the Federal Aviation Administration (FAA), which provides most of theprogram's funding. ASRS receives more than 3,200 reports each month. The program's annualoperating budget of approximately $2.5 million (or about $70 per report received) covers reportprocessing, alert messages, data dissemination functions, special studies, and publication activities. Persons who submit reports are given two types of protection: confidentiality, and limitedimmunity from disciplinary action in the case of a potential violation of federal air regulations. TheFAA will not impose penalties upon individuals who complete and submit written incident reportsto ASRS within 10 days after the violation provided that: the violation was inadvertent and not deliberate; the violation did not involve a criminal offense or action which discloses a lackof qualification or competency; and the person has not been found in any prior FAA enforcement action to havecommitted a violation for a five-year period prior to the date of the incident. (20) ASRS administrators attribute the program's success to various factors. (21) First, the reports are heldin strict confidence and reporters are immune from disciplinary action if they report promptly. Second, reporting is simple and involves a one-page form. Third, the program is responsive --reporters receive timely feedback -- and viewed as worthwhile by those that use it. And finally, theprogram is administered by an agency (i.e., NASA) that is independent of the FAA, which regulatesthe aviation industry. ASRS is seen as complementing the work of the National TransportationSafety Board (NTSB), which investigates aviation accidents that result in death or serious injury orin which the aircraft sustains significant damage. There are several national voluntary reporting systems for medical errors. They include thePatient Safety Information System within the Department of Veterans Affairs (VA) and the JointCommission on Accreditation of Healthcare Organizations (JCAHO) Sentinel Events ReportingSystem. Two national programs focus on medication errors: the Medication Error Reportingprogram and the MedMARx program. In addition to its mandatory reporting requirements for drugand medical device manufacturers, the Food and Drug Administration also encourages health careproviders and the public voluntarily to report suspected adverse events involving prescription andover-the-counter drugs. VA Patient Safety Information System. TheDepartment of Veterans Affairs (VA), which manages one of the largest health care networks in theUnited States, is generally recognized as a leader in the growing patient safety movement. (22) In 1999, the VAestablished a National Center for Patient Safety (NCPS) to lead the agency's patient safety effortsand develop a culture of safety throughout the VA health care system. The NCPS developed aninternal, confidential, non-punitive reporting and analysis system, the Patient Safety InformationSystem (PSIS), which permits VA employees to report both adverse events and close calls withoutfear of punishment. The PSIS is not a blame-free system. Events that are judged to be anintentionally unsafe act (i.e., any events that result from a criminal act, a purposefully unsafe act, oran act related to alcohol or substance abuse or patient abuse) can result in the assignment of blameand punitive action. Drawing on the experience of aviation and other "high-reliability" industries, NCPS officialsargue that confidential, non-punitive reporting systems are key to identifying vulnerabilities andanalyzing underlying systemic problems in health care. They contend that an over-reliance onpunitive accountability systems has been a major impediment to improving patient safety. Accountability systems do not encourage identification of potential problems, nor do they provideany incentive for reporting. The PSIS is intended to supplement the VA's existing accountability systems. It takes asystems approach to improving patient safety based on prevention, not punishment. Using toolsdeveloped by NCPS, multidisciplinary teams conduct a root cause analysis of reported adverseevents. Root cause analysis is a process for identifying the causal factors that underlie an event. Itfocuses primarily on systems and processes, not individual performance. The end product of a rootcause analysis is an action plan outlining strategies that the organization intends to implement toreduce the risk of a similar event occurring in the future. Following PSIS implementation, NCPS saw a 900-fold increase in reporting of close calls,and a 30-fold increase in reporting of adverse events. For its efforts in improving patient safety inthe VA health care system, NCPS was awarded the prestigious Innovations in American GovernmentAward in 2001. The PSIS now serves as a benchmark and is being used and emulated by otherhealth care programs, nationally and internationally. (23) In May 2000, the VA signed an agreement with NASA to develop the Patient SafetyReporting System (PSRS), an independent, external reporting system. The PSRS, which wasinaugurated in 2002 at VA hospitals nationwide, is operated by NASA and modeled after the ASRS.It is intended to provide VA employees with a "safety valve" that allows them confidentially toreport close calls or adverse events that, for whatever reason, would otherwise go unreported. Allpersonnel and facility names, facility locations, and other potentially identifying information areremoved before reports are entered into the PSRS database. Only NASA personnel assigned to thereporting system can review data until the de-identification process is complete. (24) JCAHO Sentinel Events Reporting System. JCAHO is an independent, nonprofit organization that evaluates and accredits nearly 18,000 healthcare organizations and programs in the United States, including hospitals, health care networks,managed care organizations, and health care organizations that provide home care, long term care,behavioral health care, laboratory, and ambulatory care services. JCAHO initiated a sentinel eventreporting system for hospitals in 1996. A sentinel event is defined as one that results in anunanticipated death or major permanent loss of function not related to the natural course of thepatient's illness or underlying condition. Sentinel events also include: patient suicide in a settingthat provides round-the-clock care; rape; infant abduction or discharge to the wrong facility; majorincompatibility reactions in blood transfusion recipients; and surgery on the wrong patient or bodypart. (25) Accredited hospitals are expected to identify and respond to all sentinel events by conductinga root cause analysis, implementing improvements to reduce risk, and monitoring the effectivenessof those improvements. To encourage sentinel event reporting, JCAHO has established a policy ofnot penalizing the accreditation status of an organization that reports such events and performs a rootcause analysis. Reporting sentinel events to JCAHO is not entirely voluntary. If a hospital fails toreport an event and JCAHO learns of it from a third party, it requires the hospital to conduct a rootcause analysis or risk loss of accreditation. JCAHO analyzes the error-related information it receivesand publishes recommendations in the Sentinel Event Alert . Despite these efforts, few hospitalsreport sentinel events because they view the program as cumbersome, time-consuming,unresponsive, and potentially risky. They are concerned about the confidentiality of the informationand fear that public disclosure of reports may damage their reputation and lead to a decline inbusiness, a loss of license or accreditation, and litigation. (26) Medication Errors Reporting Program. TheMedication Errors Reporting (MER) program was started in 1975 by the Institute for SafeMedication Practices (ISMP), a nonprofit organization that works with healthcare practitioners,regulatory agencies, professional organizations, and the pharmaceutical industry to provide educationabout adverse drug events and their prevention. Since 1991, the MER program has been owned andadministered by the U.S. Pharmacopeia (USP). USP is a nonprofit, private organization thatestablishes legally recognized standards for the quality, strength, purity, packaging, and labeling ofmedicines for human and veterinary use. The MER program receives voluntary and confidential reports from practitioners -- primarilypharmacists -- via mail, telephone, and the Internet. Reporters are informed that a de-identified copyof the report is routinely sent to ISMP, the Food and Drug Administration (FDA), and thepharmaceutical company whose product is mentioned in the report. With permission, the reporter'sname is disclosed to ISMP, which provides an independent review of the report. Errors ornear-errors reported through the MER program include administering the wrong drug, strength, ordose, confusion over look-alike and sound-alike drugs, incorrect route of administration, and errorsin prescribing and transcribing. ISMP publishes biweekly reports with recommendations andperiodic special alerts. (27) MedMARx Program. USP's MedMARxprogram, begun in 1998, is an Internet-based, voluntary system for hospitals to report medicationerrors. Hospitals must subscribe to MedMARx in order to use the program. Employees of hospitalsthat subscribe may report a medication error anonymously to MedMARx by completing astandardized form. Hospital management is then able to retrieve compiled data on its own facilityand also obtain nonidentifiable comparative information on other participating hospitals. Information is not shared with FDA. The JCAHO framework for conducting a root cause analysisis on the MedMARx system for the convenience of reporters to download the forms, but theprograms are not integrated. In December 2004, USP released its fifth annual national report, which summarizes themedication error data collected by MedMARx during 2003. (28) The analysis was basedon 235,159 medication errors voluntarily reported by 570 hospitals and health care facilitiesnationwide. The report also includes a five-year trend analysis of data submitted to MedMARxbetween 1999 and 2003, with a focus on technology related errors. MedMARx has received generally favorable reviews from analysts. The programincorporates some of the same design features that are found in ASRS. Hospital employees viewMedMARx reporting as relatively safe and straightforward. Unlike JCAHO's system for hospitalsto report events with serious outcomes, MedMARx relies on individual employees submittinganonymous reports of all types of medication errors, whether or not they result in harm. MedMARxis also very responsive. The data are analyzed by experts, and reporters receive timely feedback ofuseful information. (29) Food and Drug Administration. The FDAregulates the manufacturers of prescription and over-the-counter drugs, medical andradiation-emitting devices, and biological products (e.g., antitoxins, vaccines, blood), among otherthings. After FDA approves a new drug or device, the agency continues to monitor its safety throughpostmarketing surveillance. Adverse event reporting is a major component of postmarketingsurveillance. For medical devices, manufacturers are required to report deaths, serious injuries, andmalfunctions to FDA. Hospitals, nursing homes, and other user facilities are also required to reportdeaths to both the manufacturer and FDA, and to report serious injuries to the manufacturer. Forsuspected adverse events associated with drugs, reporting is mandatory for manufacturers. Healthcare professionals and consumers may voluntarily report suspected adverse drug events and deviceproblems through FDA's Medical Products Reporting Program, MedWatch, which allows reportingby phone (toll-free), fax, direct mail (using a postage-paid form), and Internet. All MedWatchreports are evaluated and entered into one of the agency's databases for analysis. (30) FDA receives approximately 235,000 reports annually for adverse drug events and more than80,000 reports on device problems. The agency decides whether any corrective action is necessaryon a case-by-case basis, by considering the unexpectedness and seriousness of the event, thevulnerability of the population affected, and the available options for prevention. If corrective actionis warranted, FDA generally pursues one of three strategies. The first and most common strategyis to negotiate with the manufacturer to make the desired changes. Second, FDA may take regulatoryaction to compel a manufacturer to act. Finally, the agency may attempt to inform health careprofessionals and the public about the risks associated with a particular drug through publishedarticles, direct mailings, and the Internet. On February 26, 2004, FDA published a final rule requiring bar codes on the labels of mostprescription drugs and all over-the-counter drugs used in hospitals and dispensed pursuant to aphysician's order. (31) The agency estimates that the use of bar-coded medications, which nurses scan to match the correctdrug and dose with the intended patient, could prevent more than 500,000 adverse events and save$93 billion over the next 20 years. In addition, the rule requires bar codes on the labels of blood andblood components used for transfusion. On March 14, 2003, FDA proposed revising manufacturer's reporting requirements toimprove the agency's ability to monitor and improve the safe use of medications. (32) The proposal requiresmanufacturers to submit to FDA, within 15 days, all reports they receive of actual and potential (i.e.,near-miss) medication errors. An example of a potential medication error would be a pharmacistwho selects the wrong drug because of a similar sounding name but catches the mistake beforedispensing the medication. If the pharmacist elects to report the incident to the manufacturer, thenunder the proposed rule the manufacturer must report it to FDA. The proposal also requires the useof internationally agreed definitions and reporting formats, which will allow companies to preparea single report for submission to major regulatory agencies worldwide. Table 2 summarizes the design features that analysts have identified as essential for aneffective reporting program. An effective program is one that encourages reporting, analyzes thedata to identify vulnerabilities in the health care system, and promotes the development of preventivestrategies to improve patient safety. (33) The IOM report recommended against establishing acomprehensive national voluntary reporting system modeled after ASRS. For one thing, severalnational reporting systems already exist, particularly for medication errors. Moreover, acomprehensive national reporting system would require an enormous investment in funding andpersonnel, in view of the potential volume of reports. With an estimated 1 million errors each yearin hospital settings alone, plus an even greater number of close calls, the analysis of even a fractionof these events would require many expert analysts, all of whom would have to be recruited andtrained. Table 2. Design Characteristics of Voluntary Medical ErrorsReporting Systems Source : Based on Leape, "Reporting of Adverse Events"; Raymond and Crane, "DesignConsiderations." The IOM said that the existing reporting systems should be encouraged and promoted withinhealth care organizations and that better use should be made of the reported information. Newsystems should be focused on specific areas of medical care (e.g., surgery, pediatrics) and evenparticular care settings. That approach would help manage the potential volume of reports and matchthe expertise to the problems. There also needs to be a mechanism for sharing information acrossdifferent reporting systems. A report in one system may have relevance for another system (e.g.,errors in surgery that also involve medications). Along with its recommendation on reportingsystems, the IOM also recommended the establishment of a federal Center for Patient Safety to setnational goals, fund research, evaluate methods for identifying and preventing medical errors, anddisseminate information on best practices. To encourage providers to report errors without fear of the data being used in a medicalmalpractice lawsuit, the IOM recommended that information collected under a voluntary reportingsystem be protected from legal discovery and admission as evidence in civil cases. The PatientSafety and Quality Improvement Act seeks to implement that recommendation by providing legalprotection for information about medical errors that is voluntarily submitted to patient safetyorganizations (PSOs). PSOs would collect and analyze the information submitted by providers anddevelop and disseminate recommendations for systems-based solutions to improve patient safety andhealth care quality. This section of the report provides an overview of H.R. 663 , as passed by theHouse during the 108th Congress. That is followed by some analysis of key differences between H.R. 663 and the version that passed the Senate during the 108th and that was recentlyreintroduced and approved by the HELP Committee. The House passed the Patient Safety and Quality Improvement Act ( H.R. 663 , H.Rept. 108-28 ) on March 12, 2004, by a vote of 418-6. H.R. 663 would have providedlegal protection to certain categories of documents and communications termed "patient safety workproduct," which are developed by health care providers for reporting to PSOs. Patient safety workproduct would be privileged and not subject to: a civil or administrative subpoena; discovery inconnection with a civil or administrative proceeding; or disclosure under the Freedom of InformationAct. Moreover, it could not be used in any adverse employment action against an employee who ingood faith reports the information to a provider (with the intention of having it reported to a patientsafety organization) or reports the data directly to a patient safety organization. Patient safety workproduct would not encompass documents or communications that are part of traditional medicalrecord keeping. Such information includes patients' medical records, billing records, hospitalpolicies, and records of drug deliveries, that is, information that has been developed, maintained,or which exists separately from patient safety work product. Only information specifically createdfor PSOs would be protected. Under the House-passed bill, PSOs would be certified by AHRQ to collect and analyzepatient safety work product submitted by providers, and to develop and disseminaterecommendations for systems-based solutions to improve patient safety and health care quality. Anypublic or private organization seeking PSO certification would have to meet certain criteria. Forexample, they would have to contain appropriately qualified staff, including licensed or certifiedmedical professionals, and not be part of a health insurance company. A PSO would also have tobe managed and operated independently from any provider that reported to it. The House bill didnot include any language to encourage the establishment of PSOs in every state or region of thecountry. H.R. 663 would have required AHRQ to establish a national database to receiveand analyze de-identified information submitted by PSOs. Information in the national databasewould be available to the public. The bill also would have required AHRQ to develop voluntarynational standards to promote the interoperability of health information technology systems. (34) In addition to the provisions aimed at supporting voluntary reporting of medical errors, H.R. 663 instructed the FDA to issue standards for unique product identifiers (e.g., barcodes) on the packaging of drugs and biological products. It also would have authorized grantprograms for electronic prescribing and other information technology to prevent errors. Finally, H.R.663 would have created a Medical Information Technology Advisory Board to makerecommendations to HHS and Congress on fostering the development and use of informationtechnologies to reduce medical errors. The Senate took up H.R. 663 on July 22, 2004, substituted alternative language( S. 720 , as amended), and passed the measure by voice vote. While S. 720had the same basic structure as the House-passed legislation, there were several key differences. Lawmakers were unable to reconcile those differences before the 108th Congress adjourned. OnMarch 8, 2005, Senator Jeffords reintroduced the Patient Safety and Quality Improvement Act( S. 544 ). S. 544 , which is identical to last year's Senate-passed measure( S. 720 ), was unanimously approved by the Senate HELP Committee on March 9, 2005. Table 3 on page 22 compares the patient safety legislation with the IOM report's recommendations. Table 4 , which begins on page 23, provides a side-by-side comparison of H.R. 663 and S. 544 . Definition of Protected Information. As passedby the House, H.R. 663 would have provided legal protection to "patient safety workproduct," which it defined as any document or communication that is: developed by a provider forthe purpose of reporting to a PSO, and reported to a PSO; created by a PSO; or that would reveal theworkings of a "patient safety evaluation system." The bill defined a patient safety evaluation systemas a process for collecting, managing, or analyzing information submitted to or by a PSO. Patientsafety work product would not include a document or communication that is developed, maintained,or exists separately from any patient safety evaluation system (e.g., a patient's medical record or anyother patient or hospital record). The legal protections in S. 544 apply to all "patient safety data." When theSenate bill was first approved by the HELP Committee during the 108th Congress, some analystsraised concerns that the definition of patient safety data was too broad. It included, for example,"any data ... that could result in improved patient safety or health care quality or health careoutcomes, that are ... collected from a provider ...." Critics of this language argued that it wouldextend the bill's evidentiary privilege and confidentiality protections to a wide range of quality- andoutcomes-related information. As a result, the bill would have the unintended effect of preemptingstate laws that require hospitals to report infection rates, medical outcomes, and serious adverseevents. To address those concerns, the definition of patient safety data was modified to more closelyresemble the language in H.R. 663 , which was tied to the activities of PSOs. S. 544 defines patient safety data as any data, reports, records, memoranda, analyses,or written or oral statements that are: collected or developed by a provider for reporting (within 60days) to a PSO; requested by a PSO and reported within 60 days; reported to a provider by a PSO;or collected by a PSO from another PSO, or developed by a PSO. The definition also states that"patient safety data shall not include information (including a patient's medical record, billing anddischarge information or any other patient or provider record) that is collected or developedseparately from and that exists separately from patient safety data." This separate data provision hasbeen criticized as circular, because it says in effect that information that is not patient safety data isnot patient safety data. S. 544 also includes a provision that is intended to protect mandatory statereporting laws. The provision states that nothing in the bill limits the reporting of information thatis not patient safety data to a "federal, state, or local governmental agency for public healthsurveillance, investigation, or other public health purposes or health oversight purposes. H.R. 663 included comparable language. It said that nothing in the bill preempts orotherwise affects "state law requiring a provider to report information ... that is not patient safetywork product." Privilege. H.R. 663 would haveprotected patient safety work product from discovery in connection with a civil and administrativeproceeding, and from admission as evidence or disclosure in any such proceeding. Patient safetywork product would not be protected from use in criminal proceedings. By comparison, S. 544 would prohibit lawyers from obtaining or using patient safety data in civil,administrative, and criminal proceedings, unless a judge determined that the information containedevidence of "a wanton and criminal act to directly harm the patient." That language was includedis an effort to ensure that the legislation does not unduly compromise the rights of injured patientsto obtain compensation. In its 1999 report, the IOM focused on protecting voluntarily reported patient safetyinformation from discovery and admission as evidence in civil and administrative proceeding, notingthat "instances of criminal prosecution for medical errors are exceptionally rare." The intent was toencourage the voluntary reporting of information about near misses and other problems that wouldotherwise go unreported were it not for legal protection. Analysis of such information would thenbe used to identify vulnerabilities in health care systems. Voluntary reporting systems, as envisionedby the IOM, would not interfere with the mandatory reporting of more serious errors, as requiredunder state law and other accountability systems. Confidentiality. S. 544 designatespatient safety data as confidential and not subject to disclosure, except in certain specifiedcircumstances (e.g., disclosure by a provider to a PSO). Negligent or intentional disclosure of patientsafety data in violation of the bill's confidentiality provisions is subject to civil fines of up to $10,000per violation. H.R. 663 also specified the circumstances under which disclosure of patientsafety work product (identifiable and nonidentifiable) was permitted and provided for penalties ofup to $10,000 per violation for disclosures other than those permitted. Unlike S. 544 ,the House bill did not expressly state that work product is confidential, though this was implied inthe bill's language. H.R. 663 said that disclosures in violation of the bill's provisionsare unlawful and subject to fines, provided such disclosures constitute "a negligent or knowingbreach of confidentiality." Both H.R. 663 and S. 554 state that if the disclosure is in violationof the HIPAA privacy rule, then the HIPAA penalties apply instead. For details of the civil andcriminal penalties under HIPAA, see CRS Report RS20500 , Medical Records Privacy: Questionsand Answers on the HIPAA Rule . PSO Certification and Listing. Under the patientsafety legislation, providers would voluntarily submit information on medical errors to public orprivate entities designated as PSOs. The PSOs would analyze the data and develop and disseminateevidence-based information to providers to help them implement changes that would improve patientsafety. H.R. 663 would have required AHRQ to establish a process for certifying PSOs. The bill listed several criteria for certification. For example, a PSO must not be "a component ofa health insurer or other entity that offers a group health plan or health insurance coverage," and mustbe "managed, controlled, and operated independently from any provider" that reports patient safetywork product to the PSO. That would appear to exclude the Department of Veterans Affairs (VA),among others, from PSO certification. As previously discussed, the VA has developed an internal,confidential, non-punitive reporting and analysis system and is widely recognized as a leader inpatient safety. H.R. 663 also would have required PSOs that are components of otherorganizations to protect the confidentiality of patient safety work product and ensure that theirmission did not create a conflict of interest with the rest of the organization. By comparison, S. 544 relies on a process of PSO self-certification.Organizations would be required to submit a certification to AHRQ that they intend to perform thevarious PSO activities specified in the legislation. The agency would review the submission and,if acceptable, place the name of the organization on a list of certified PSOs. S. 544 doesnot include any criteria that place limits on the types of public or private entities that seek PSOcertification and listing, nor does it address the issue of conflict of interest. Civil Penalties. As noted above, both billsprovide for civil monetary penalties of up to $10,000 for each negligent or intentional disclosure ofpatient safety information in violation of the provisions in the legislation. The bills also prohibit ahealth care provider from taking any adverse employment action against an employee who in goodfaith reports information to the provider with the intention of having it reported to a PSO, or whoreports the information directly to a PSO. But whereas H.R. 663 included civil finesof up to $20,000 per violation for providers who took such action, S. 544 permits anemployee to sue their employer to enjoin a wrongful adverse employment action and to obtainequitable relief, including reinstatement, back pay, and restoration of benefits. Unlike the House bill, S. 544 specifies that providers include state-run facilities.Because the federal government cannot give state employees a right to sue the state, S. 544 includes a provision requiring state hospitals to agree to be subject to such civil action in orderto assert the privileges established by the legislation. Drug and Biological Product Identification. H.R. 663 instructed FDA to require unique product identifiers on the packaging of drugsand biological products. That provision would appear to have been met by the agency's February26, 2004 bar code rule. There is no comparable provision in S. 544 . Health Information Technology (IT) Standards, Grants andAdvisory Board. Both bills would require the Secretary of Health and HumanServices to adopt voluntary, national interoperability standards for the electronic exchange of healthcare information. H.R. 663 contained three additional health IT provisions, none ofwhich are included in the Senate version. The House measure authorized grants to physicians forelectronic prescription programs, and to hospitals for purchasing health IT systems. It also wouldhave created a Medical Information Technology Advisory Board (MITAB) to makerecommendations to the Secretary and Congress on promoting electronic information exchange toimprove patient safety and the quality of health care. Congress and the Administration have taken a number of important steps in the past twoyears to promote the adoption of IT systems for the electronic collection and exchange of patientinformation in order to reduce medical errors, lower health care costs, and improve the quality ofcare. The health IT provisions in the patient safety legislation duplicate some of those actions. Forexample, the Medicare Prescription Drug, Improvement, and Modernization Act ( P.L. 108-173 )required the Secretary to adopt electronic prescribing standards and establish a Commission onSystemic Interoperability to develop a comprehensive strategy for the adoption and implementationof health IT data standards. P.L. 108-173 also authorized IT grants for physicians and establisheddemonstration projects to determine how to improve the quality of care through the adoption of ITsystems. On July 21, 2004, National Coordinator for Health Information Technology David Brailerreleased a 10-year Framework for Strategic Action outlining steps to transform the delivery of healthcare by adopting electronic health records and developing a national health information infrastructure(NHII) to link such records nationwide. (35) The framework sets out a bottom-up approach in which the roleof HHS is to promote and encourage the private sector to build community-level electronic healthinformation networks. Adopting interoperability standards will over time permit these localnetworks to connect with one another to form a NHII. Table 3. Comparison of Patient Safety Legislation with the IOMRecommendations Table 4. Side-by-Side Comparison of Patient Safety and Quality Improvement Act 

Summary: In the 108th Congress, the House and Senate passed competing versions of the Patient Safetyand Quality Improvement Act ( H.R. 663 , S. 720 ), but the differencesbetween the two measures were never resolved. On March 9, 2005, the Senate Committee onHealth, Education, Labor, and Pensions unanimously approved S. 544 , which isidentical to S. 720 . The legislation would establish legal protections for data andreports on medical errors in an effort to encourage voluntary reporting of such information. Thepatient safety bills are in response to the 1999 Institute of Medicine (IOM) report To Err Is Human ,which concluded that preventable medical errors cause as many as 98,000 deaths a year. The IOMfound that medical errors are primarily the result of faulty systems, processes, and conditions thatlead people to make mistakes. It recommended establishing a national mandatory reporting systemto hold hospitals accountable for serious medical errors, as well as developing voluntary, confidentialsystems for reporting errors that result in little or no harm. Analysis of such voluntarily reported datacould be used to identify vulnerabilities in health care systems. Twenty-two states mandate medical error reporting by hospitals. However, providers arereluctant to report adverse events in part because they fear that the information will be used inmalpractice litigation. States have sought to allay those concerns by passing laws to protect reporteddata from legal discovery and by de-identifying data and receiving reports anonymously. Suchmeasures risk limiting the usefulness of the data for research and quality management. There are several national voluntary reporting systems for medical errors, including thePatient Safety Information System within the Department of Veterans Affairs. Analysis of these andother voluntary reporting systems -- notably the Aviation Safety Reporting System -- has identifiedseveral design features associated with effective programs. For example, the reporting processshould be user-friendly and the information kept confidential and protected from legal discovery. Also, reports should be promptly evaluated by experts who are trained to recognize underlyingsystems causes, and reporters should receive timely feedback with recommendations forsystems-based improvements. To encourage voluntary reporting, H.R. 663 would have protected reportedinformation from legal discovery in civil and administrative proceeding, and from a Freedom ofInformation Act request. The bill required the Agency for Healthcare Research and Quality (AHRQ)to certify patient safety organizations to collect and analyze the information reported by providers. Such organizations would develop and disseminate recommendations for systems-based solutionsto improve patient safety and health care quality. H.R. 663 also would have requiredAHRQ to establish a national database to receive and analyze de-identified information submittedby patient safety organizations. S. 544 would protect information from use in criminalas well as civil and administrative proceedings, unless a judge determined that it contained evidenceof an intentional act to directly harm the patient. This report will be updated as legislative eventsin the 109th Congress warrant.