AHRQ and the Office for Civil Rights (OCR) within HHS share responsibility for implementing the Patient Safety Act. AHRQ is responsible for listing PSOs, providing technical assistance to PSOs, implementing and maintaining the NPSD, and analyzing the data submitted to the NPSD. OCR has responsibility for interpreting, implementing, and enforcing the confidentiality protections. To help implement the Patient Safety Act, AHRQ and OCR developed the legislation’s implementing regulations, which took effect January 19, 2009. The Patient Safety Act establishes criteria that organizations must meet and required patient safety activities that the organizations must perform after being listed as PSOs. The criteria include an organizational mission to improve patient safety and the quality of health care delivery; use of collected data to provide direct feedback and assistance to providers to minimize patient risk; staff who are qualified to perform analyses on patient safety data; and adequate policies and procedures to ensure that patient safety data are kept confidential. Required PSO activities include activities such as efforts to improve patient safety and the quality of health care delivery. (See app. II for the complete list of criteria and required PSO activities as specified in the Patient Safety Act.) The criteria allow for many types of organizations to apply to AHRQ to be listed as a PSO. These organizations may include public and private entities, for-profit and not- for-profit organizations, and entities that are a component of another organization, such as a hospital association or health system. A PSO must attest for the initial listing period that it will comply with the criteria and that it has policies and procedures in place that will allow it to perform the required activities of a PSO. When reapplying for subsequent 3-year listing periods, a PSO must attest that it is complying with the criteria and that it is in fact performing each of the required activities. The regulations require AHRQ staff to review written PSO applications documenting PSO attestations to each of the statutory criteria and required activities. In the case of certain PSOs that are component organizations, the regulations also require the applicant to complete an additional set of attestations and disclosure statements detailing the relationship between the component and parent organizations. The regulations require that after AHRQ staff review the application materials and related information, the applicant will be listed, conditionally listed, or denied. When a provider elects to use the services of a listed PSO, the Patient Safety Act provides privilege and confidentiality protections for certain types of data regarding patient safety events that providers collect for the purposes of reporting to a PSO. In general, the Patient Safety Act excludes the use of patient safety data in civil suits, such as those involving malpractice claims, and in disciplinary proceedings against a provider. While certain states have laws providing varying levels of privilege and confidentiality protections for patient safety data, the Patient Safety Act provides a minimum level of protection. Regulations implementing the Patient Safety Act address the circumstances under which patient safety data may be disclosed, such as when used in criminal proceedings, authorized by identified providers, and among PSOs or affiliated providers. OCR has the authority to conduct reviews to ensure that PSOs, providers, and other entities are complying with the confidentiality protections provided by the law. OCR also has the authority to investigate complaints alleging that patient safety data has been improperly disclosed and to impose a civil money penalty of up to $11,000 per violation. The Patient Safety Act requires HHS to create and maintain the NPSD as a resource for PSOs, providers, and qualified researchers. The law specifies that the NPSD must have the capacity to accept, aggregate, and analyze non-identifiable patient safety data voluntarily submitted to the NPSD by PSOs, providers, and other entities. Providers may submit non- identifiable data directly to the NPSD, or work with a PSO to submit patient safety data. Neither PSOs nor providers are required by either the Patient Safety Act or regulation to submit data to the NPSD. Figure 1 shows the intended flow of patient safety data and other information among providers, PSOs, and the NPSD. The Patient Safety Act authorizes HHS to develop common formats for reporting patient safety data to the NPSD. According to the Patient Safety Act, these formats may include the necessary data elements to be collected and provide common and consistent definitions and a standardized computer interface for processing the data. While most U.S. hospitals have some type of internal reporting system for collecting data on patient safety events, they often have varying ways of collecting and organizing their data. This variation makes it difficult to accurately compare patient safety events across systems and providers and can be a barrier to developing solutions to improve patient safety. If providers or PSOs choose to submit patient safety data to the NPSD, AHRQ requires that these data be submitted using the common formats, because using the common formats is necessary so that data in the NPSD can be aggregated and analyzed. Aggregation and analysis of data is important for developing the “lessons learned” or “best practices” across different institutions that may help improve patient safety. The Patient Safety Act and its implementing regulations provide additional measures PSOs must follow whether or not they intend to submit the data they collect to the NPSD. The Patient Safety Act regulations require PSOs to collect patient safety data from providers in a standardized manner that permits valid comparisons of similar cases among similar providers, to the extent to which these measures are practical and appropriate. To meet this requirement, the regulation specifies that PSOs must either (1) use the common formats developed by AHRQ when collecting patient safety data from providers, (2) utilize an alternative format that permits valid comparisons among providers, or (3) explain to AHRQ why it would not be practical or appropriate to do so. The Patient Safety Act also requires any data regarding patient safety events that is submitted to the NPSD be non-identifiable. According to the Patient Safety Act, users can access non-identifiable patient safety data only in accordance with the confidentiality protections established by the Patient Safety Act. The Patient Safety Act’s regulations provide technical specifications for making patient safety data non-identifiable. Finally, the Patient Safety Act states AHRQ must analyze the data that are submitted to the NPSD and include these analyses in publicly available reports. Specifically, under the Patient Safety Act, AHRQ is required to submit a draft report on strategies to improve patient safety to the IOM within 18 months of the NPSD becoming operational and a final report to Congress 1 year later. The Patient Safety Act requires this report to include effective strategies for reducing medical errors and increasing patient safety, as well any measures AHRQ determines are appropriate to encourage providers to use the strategies, including use in any federally funded programs. In addition, the Patient Safety Act states HHS must use data in the NPSD to analyze national and regional statistics, including trends and patterns of health care errors, and include any information resulting from such analyses in its annual reports on health care quality. AHRQ listed 65 PSOs from November 2008 to July 2009. However, few of the 17 PSOs we randomly selected to interview had entered into contracts or other business agreements with providers to serve as their PSO, and only 3 PSOs reported having begun receiving patient safety data or providing feedback to providers. PSO officials identified several reasons why they have not yet engaged with providers. Some PSOs are still establishing various aspects of their operations; some are waiting for the common formats for collecting patient safety data to be finalized by AHRQ; and some are still engaged in marketing their services and educating providers about the federal confidentiality protections offered by the Patient Safety Act. Although the regulations implementing the Patient Safety Act did not become effective until January 19, 2009, AHRQ began listing PSOs earlier, in November 2008. By July 2009, AHRQ had listed 65 PSOs in 26 states and the District of Columbia. AHRQ officials told us that in listing PSOs they accepted PSOs’ attestations that the PSOs met the certification requirements established in the Patient Safety Act—that is, to be a listed PSO, an entity must have policies and procedures in place to perform the required activities of a PSO and will comply with additional criteria for listing. For continued listing beyond the initial period, PSOs must attest that they have contracts with more than one provider and are in fact performing each of the required activities. The 65 PSOs AHRQ had listed represent a wide range of organizations, including some that provided patient safety services for many years prior to being listed as well as new organizations specifically established to function as a PSO under the Patient Safety Act. AHRQ officials told us that the organizations listed as PSOs include consulting firms that have provided patient safety services for a range of providers and specialties, as well as organizations with a focus on patient safety in a specific area such as medical devices, hand hygiene, or pediatric anesthesia. The listed PSOs also include vendors of patient safety reporting software and components of state hospital associations. AHRQ officials told us that the services PSOs deliver to individual providers will likely vary, depending on the specific contractual or other business agreements the PSOs establish with providers. For example, a small hospital may want to contract with a PSO to provide all its internal quality improvement services, while a large hospital may just contract with a PSO to obtain the legal protections under the Patient Safety Act and to contribute data to the NPSD.