---
kind: "range"
citation: "42 U.S.C. §§ 299b–21–299b–26"
title: "42"
from: "299b–21"
to: "299b–26"
count: 7
release: "119-102"
url: "https://uscodex.org/usc/42/299b-21..299b-26"
---

# §299b–21. Definitions


In this part:

- (1) **HIPAA confidentiality regulations—** The term “HIPAA confidentiality regulations” means [regulations](/usc/42/201.md?p=d) promulgated under [section 264(c)](/usc/42/264.md?p=c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191; 110 Stat. 2033).
- (2) **Identifiable patient safety work product—** The term “identifiable patient safety work product” means [patient safety work product](#7-A) that—
  - (A) is presented in a form and manner that allows the identification of any [provider](#8) that is a subject of the work product, or any [providers](#8) that participate in activities that are a subject of the work product;
  - (B) constitutes [individually identifiable health information](/usc/42/247d–11.md?p=g-1) as that term is defined in the [HIPAA confidentiality regulations](#1); or
  - (C) is presented in a form and manner that allows the identification of an individual who reported information in the manner specified in [section 299b–22(e) of this title](/usc/42/299b–22.md?p=e).
- (3) **Nonidentifiable patient safety work product—** The term “nonidentifiable patient safety work product” means [patient safety work product](#7-A) that is not [identifiable patient safety work product](#2) (as defined in [paragraph (2)](#2)).
- (4) **Patient safety organization—** The term “patient safety organization” means a private or public entity or component thereof that is listed by the [Secretary](/usc/42/201.md?p=c) pursuant to [section 299b–24(d) of this title](/usc/42/299b–24.md?p=d).
- (5) **Patient safety activities—** The term “patient safety activities” means the following activities:
  - (A) Efforts to improve patient safety and the quality of health care delivery.
  - (B) The collection and analysis of [patient safety work product](#7-A).
  - (C) The development and dissemination of information with respect to improving patient safety, such as recommendations, protocols, or information regarding best [practices](/usc/42/17061.md?p=19).
  - (D) The utilization of [patient safety work product](#7-A) for the purposes of encouraging a culture of safety and of providing feedback and assistance to effectively minimize patient risk.
  - (E) The maintenance of procedures to preserve confidentiality with respect to [patient safety work product](#7-A).
  - (F) The provision of appropriate security measures with respect to [patient safety work product](#7-A).
  - (G) The utilization of qualified staff.
  - (H) Activities related to the operation of a [patient safety evaluation system](#6) and to the provision of feedback to [participants](/usc/42/300gg–91.md?p=d-11) in a [patient safety evaluation system](#6).
- (6) **Patient safety evaluation system—** The term “patient safety evaluation system” means the collection, management, or analysis of information for reporting to or by a [patient safety organization](#4).
- (7) **Patient safety work product—**
  - (A) **In general—** Except as provided in [subparagraph (B)](#7-B), the term “patient safety work product” means any data, reports, records, memoranda, analyses (such as root [cause](/usc/42/9908.md?p=c-2) analyses), or written or oral statements—
    - (i) which—
      - (I) are assembled or developed by a [provider](#8) for reporting to a [patient safety organization](#4) and are reported to a [patient safety organization](#4); or
      - (II) are developed by a [patient safety organization](#4) for the conduct of [patient safety activities](#5);

    and which could result in improved patient safety, health care quality, or health care outcomes; or

    - (ii) which identify or constitute the deliberations or analysis of, or identify the fact of reporting pursuant to, a [patient safety evaluation system](#6).
  - (B) **Clarification—**
    - (i) Information described in [subparagraph (A)](#7-A) does not include a patient’s medical record, billing and discharge information, or any other original patient or [provider](#8) record.
    - (ii) Information described in [subparagraph (A)](#7-A) does not include information that is collected, maintained, or developed separately, or exists separately, from a [patient safety evaluation system](#6). Such separate information or a copy thereof reported to a [patient safety organization](#4) shall not by reason of its reporting be considered [patient safety work product](#7-A).
    - (iii) Nothing in this part shall be construed to limit—
      - (I) the discovery of or admissibility of information described in this subparagraph in a criminal, civil, or administrative proceeding;
      - (II) the reporting of information described in this subparagraph to a Federal, [State](/usc/42/300gg–91.md?p=d-14), or local governmental [agency](/usc/42/299c–7.md?p=2) for public health surveillance, investigation, or other public health purposes or health oversight purposes; or
      - (III) a [provider](#8)’s recordkeeping obligation with respect to information described in this subparagraph under Federal, [State](/usc/42/300gg–91.md?p=d-14), or local law.
- (8) **Provider—** The term “provider” means—
  - (A) an individual or entity licensed or otherwise authorized under [State](/usc/42/300gg–91.md?p=d-14) law to provide health care [services](/usc/42/201.md?p=a), including—
    - (i) a [hospital](/usc/42/1395dd.md?p=e-5), [nursing facility](/usc/42/1396d.md?p=c), comprehensive outpatient rehabilitation [facility](/usc/42/11049.md?p=4), home health [agency](/usc/42/299c–7.md?p=2), hospice [program](/usc/42/274l–1.md?p=4), renal dialysis [facility](/usc/42/11049.md?p=4), ambulatory surgical center, pharmacy, [physician](/usc/42/1320a–7h.md?p=e-11) or health care [practitioner](/usc/42/1395a.md?p=b-6-C)’s [office](/usc/42/3058f.md?p=1), long term care [facility](/usc/42/11049.md?p=4), behavior health residential [treatment](/usc/42/11851.md?p=11) [facility](/usc/42/11049.md?p=4), clinical [laboratory](/usc/42/300jj.md?p=10), or health center; or
    - (ii) a [physician](/usc/42/1320a–7h.md?p=e-11), [physician](/usc/42/1320a–7h.md?p=e-11) assistant, nurse [practitioner](/usc/42/1395a.md?p=b-6-C), clinical nurse specialist, certified registered nurse anesthetist, certified nurse midwife, psychologist, certified social worker, registered dietitian or nutrition professional, physical or occupational therapist, pharmacist, or other individual health care [practitioner](/usc/42/1395a.md?p=b-6-C); or
  - (B) any other individual or entity specified in [regulations](/usc/42/201.md?p=d) promulgated by the [Secretary](/usc/42/201.md?p=c).

# §299b–22. Privilege and confidentiality protections

- (a) **Privilege—** Notwithstanding any other provision of Federal, [State](/usc/42/300gg–91.md?p=d-14), or local law, and subject to [subsection (c)](#c), [patient safety work product](/usc/42/299b–21.md?p=7-A) shall be privileged and shall not be—
  - (1) subject to a Federal, [State](/usc/42/300gg–91.md?p=d-14), or local civil, criminal, or administrative subpoena or order, including in a Federal, [State](/usc/42/300gg–91.md?p=d-14), or local civil or administrative disciplinary proceeding against a [provider](/usc/42/299b–21.md?p=8);
  - (2) subject to discovery in connection with a Federal, [State](/usc/42/300gg–91.md?p=d-14), or local civil, criminal, or administrative proceeding, including in a Federal, [State](/usc/42/300gg–91.md?p=d-14), or local civil or administrative disciplinary proceeding against a [provider](/usc/42/299b–21.md?p=8);
  - (3) subject to disclosure pursuant to [section 552 of title 5](/usc/5/552.md) (commonly known as the Freedom of Information Act) or any other similar Federal, [State](/usc/42/300gg–91.md?p=d-14), or local law;
  - (4) admitted as evidence in any Federal, [State](/usc/42/300gg–91.md?p=d-14), or local governmental civil proceeding, criminal proceeding, administrative rulemaking proceeding, or administrative adjudicatory proceeding, including any such proceeding against a [provider](/usc/42/299b–21.md?p=8); or
  - (5) admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under [State](/usc/42/300gg–91.md?p=d-14) law.
- (b) **Confidentiality of patient safety work product—** Notwithstanding any other provision of Federal, [State](/usc/42/300gg–91.md?p=d-14), or local law, and subject to [subsection (c)](#c), [patient safety work product](/usc/42/299b–21.md?p=7-A) shall be confidential and shall not be disclosed.
- (c) **Exceptions—** Except as provided in [subsection (g)(3)](#g-3)—
  - (1) **Exceptions from privilege and confidentiality—** Subsections [(a)](#a) and [(b)](#b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
    - (A) Disclosure of relevant [patient safety work product](/usc/42/299b–21.md?p=7-A) for use in a criminal proceeding, but only after a court makes an in camera determination that such [patient safety work product](/usc/42/299b–21.md?p=7-A) contains evidence of a criminal act and that such [patient safety work product](/usc/42/299b–21.md?p=7-A) is material to the proceeding and not reasonably available from any other source.
    - (B) Disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) to the extent required to carry out [subsection (f)(4)(A)](#f-4-A).
    - (C) Disclosure of [identifiable patient safety work product](/usc/42/299b–21.md?p=2) if authorized by each [provider](/usc/42/299b–21.md?p=8) identified in such work product.
  - (2) **Exceptions from confidentiality—** [Subsection (b)](#b) shall not apply to (and shall not be construed to prohibit) one or more of the following disclosures:
    - (A) Disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) to carry out [patient safety activities](/usc/42/299b–21.md?p=5).
    - (B) Disclosure of [nonidentifiable patient safety work product](/usc/42/299b–21.md?p=3).
    - (C) Disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) to grantees, contractors, or other entities carrying out research, evaluation, or [demonstration projects](/usc/42/16281.md?p=d-2) authorized, funded, certified, or otherwise sanctioned by rule or other means by the [Secretary](/usc/42/201.md?p=c), for the purpose of conducting research to the extent that disclosure of protected [health information](/usc/42/300jj.md?p=4) would be allowed for such purpose under the [HIPAA confidentiality regulations](/usc/42/299b–21.md?p=1).
    - (D) Disclosure by a [provider](/usc/42/299b–21.md?p=8) to the Food and [Drug](/usc/42/282.md?p=j-1-A-vii) Administration with respect to a product or activity regulated by the Food and [Drug](/usc/42/282.md?p=j-1-A-vii) Administration.
    - (E) Voluntary disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) by a [provider](/usc/42/299b–21.md?p=8) to an accrediting body that accredits that [provider](/usc/42/299b–21.md?p=8).
    - (F) Disclosures that the [Secretary](/usc/42/201.md?p=c) may determine, by rule or other means, are necessary for business operations and are consistent with the goals of this part.
    - (G) Disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) to law enforcement authorities relating to the [commission](/usc/42/2000ff.md?p=1) of a crime (or to an event reasonably believed to be a crime) if the [person](/usc/42/1320a–7k.md?p=d-4-C-i) making the disclosure believes, reasonably under the circumstances, that the [patient safety work product](/usc/42/299b–21.md?p=7-A) that is disclosed is necessary for criminal law enforcement purposes.
    - (H) With respect to a [person](/usc/42/1320a–7k.md?p=d-4-C-i) other than a [patient safety organization](/usc/42/299b–21.md?p=4), the disclosure of [patient safety work product](/usc/42/299b–21.md?p=7-A) that does not include materials that—
      - (i) assess the quality of care of an identifiable [provider](/usc/42/299b–21.md?p=8); or
      - (ii) describe or pertain to one or more actions or failures to act by an identifiable [provider](/usc/42/299b–21.md?p=8).
  - (3) **Exception from privilege—** [Subsection (a)](#a) shall not apply to (and shall not be construed to prohibit) voluntary disclosure of [nonidentifiable patient safety work product](/usc/42/299b–21.md?p=3).
- (d) **Continued protection of information after disclosure—**
  - (1) **In general—** [Patient safety work product](/usc/42/299b–21.md?p=7-A) that is disclosed under [subsection (c)](#c) shall continue to be privileged and confidential as provided for in subsections [(a)](#a) and [(b)](#b), and such disclosure shall not be treated as a waiver of privilege or confidentiality, and the privileged and confidential nature of such work product shall also apply to such work product in the [possession](/usc/42/201.md?p=g) or control of a [person](/usc/42/1320a–7k.md?p=d-4-C-i) to whom such work product was disclosed.
  - (2) **Exception—** Notwithstanding [paragraph (1)](#d-1), and subject to [paragraph (3)](#d-3)—
    - (A) if [patient safety work product](/usc/42/299b–21.md?p=7-A) is disclosed in a criminal proceeding, the confidentiality protections provided for in [subsection (b)](#b) shall no longer apply to the work product so disclosed; and
    - (B) if [patient safety work product](/usc/42/299b–21.md?p=7-A) is disclosed as provided for in [subsection (c)(2)(B)](#c-2-B) (relating to disclosure of [nonidentifiable patient safety work product](/usc/42/299b–21.md?p=3)), the privilege and confidentiality protections provided for in subsections [(a)](#a) and [(b)](#b) shall no longer apply to such work product.
  - (3) **Construction—** [Paragraph (2)](#d-2) shall not be construed as terminating or limiting the privilege or confidentiality protections provided for in subsection [(a)](#a) or [(b)](#b) with respect to [patient safety work product](/usc/42/299b–21.md?p=7-A) other than the specific [patient safety work product](/usc/42/299b–21.md?p=7-A) disclosed as provided for in [subsection (c)](#c).
  - (4) **Limitations on actions—**
    - (A) **Patient safety organizations—**
      - (i) **In general—** A [patient safety organization](/usc/42/299b–21.md?p=4) shall not be compelled to disclose information collected or developed under this part whether or not such information is [patient safety work product](/usc/42/299b–21.md?p=7-A) unless such information is identified, is not [patient safety work product](/usc/42/299b–21.md?p=7-A), and is not reasonably available from another source.
      - (ii) **Nonapplication—** The limitation contained in [clause (i)](#d-4-A-i) shall not apply in an action against a [patient safety organization](/usc/42/299b–21.md?p=4) or with respect to disclosures pursuant to [subsection (c)(1)](#c-1).
    - (B) **Providers—** An accrediting body shall not take an accrediting action against a [provider](/usc/42/299b–21.md?p=8) based on the good faith participation of the [provider](/usc/42/299b–21.md?p=8) in the collection, development, reporting, or maintenance of [patient safety work product](/usc/42/299b–21.md?p=7-A) in accordance with this part. An accrediting body may not require a [provider](/usc/42/299b–21.md?p=8) to reveal its communications with any [patient safety organization](/usc/42/299b–21.md?p=4) established in accordance with this part.
- (e) **Reporter protection—**
  - (1) **In general—** A [provider](/usc/42/299b–21.md?p=8) may not take an adverse employment action, as described in [paragraph (2)](#e-2), against an individual based upon the fact that the individual in good faith reported information—
    - (A) to the [provider](/usc/42/299b–21.md?p=8) with the intention of having the information reported to a [patient safety organization](/usc/42/299b–21.md?p=4); or
    - (B) directly to a [patient safety organization](/usc/42/299b–21.md?p=4).
  - (2) **Adverse employment action—** For purposes of this subsection, an “adverse employment action” includes—
    - (A) loss of employment, the failure to promote an individual, or the failure to provide any other employment-related benefit for which the individual would otherwise be eligible; or
    - (B) an adverse evaluation or decision made in relation to accreditation, certification, credentialing, or licensing of the individual.
- (f) **Enforcement—**
  - (1) **Civil monetary penalty—** Subject to paragraphs [(2)](#f-2) and [(3)](#f-3), a [person](/usc/42/1320a–7k.md?p=d-4-C-i) who discloses [identifiable patient safety work product](/usc/42/299b–21.md?p=2) in knowing or reckless [violation](/usc/42/2000e–16a.md?p=c) of [subsection (b)](#b) shall be subject to a civil monetary penalty of not more than $10,000 for each act constituting such [violation](/usc/42/2000e–16a.md?p=c).
  - (2) **Procedure—** The provisions of [section 1320a–7a of this title](/usc/42/1320a–7a.md), other than subsections [(a)](#a) and [(b)](#b) and the first sentence of [subsection (c)(1)](#c-1), shall apply to civil money penalties under this subsection in the same manner as such provisions apply to a penalty or proceeding under [section 1320a–7a of this title](/usc/42/1320a–7a.md).
  - (3) **Relation to HIPAA—** Penalties shall not be imposed both under this subsection and under the [regulations](/usc/42/201.md?p=d) issued pursuant to [section 264(c)(1)](/usc/42/264.md) of the Health Insurance Portability and Accountability Act of 1996 ([42 U.S.C. 1320d–2](/usc/42/1320d–2.md) note) for a single act or omission.
  - (4) **Equitable relief—**
    - (A) **In general—** Without limiting remedies available to other parties, a civil action may be brought by any aggrieved individual to enjoin any act or practice that violates [subsection (e)](#e) and to obtain other appropriate equitable relief (including reinstatement, back pay, and restoration of benefits) to redress such [violation](/usc/42/2000e–16a.md?p=c).
    - (B) **Against State employees—** An entity that is a [State](/usc/42/300gg–91.md?p=d-14) or an [agency](/usc/42/299c–7.md?p=2) of a [State](/usc/42/300gg–91.md?p=d-14) government may not assert the privilege described in [subsection (a)](#a) unless before the time of the assertion, the entity or, in the case of and with respect to an [agency](/usc/42/299c–7.md?p=2), the [State](/usc/42/300gg–91.md?p=d-14) has consented to be subject to an action described in [subparagraph (A)](#f-4-A), and that consent has remained in effect.
- (g) **Rule of construction—** Nothing in this section shall be construed—
  - (1) to limit the application of other Federal, [State](/usc/42/300gg–91.md?p=d-14), or local laws that provide greater privilege or confidentiality protections than the privilege and confidentiality protections provided for in this section;
  - (2) to limit, alter, or affect the requirements of Federal, [State](/usc/42/300gg–91.md?p=d-14), or local law pertaining to information that is not privileged or confidential under this section;
  - (3) except as provided in [subsection (i)](#i), to alter or affect the implementation of any provision of the [HIPAA confidentiality regulations](/usc/42/299b–21.md?p=1) or [section 1320d–5 of this title](/usc/42/1320d–5.md) (or [regulations](/usc/42/201.md?p=d) promulgated under such section);
  - (4) to limit the authority of any [provider](/usc/42/299b–21.md?p=8), [patient safety organization](/usc/42/299b–21.md?p=4), or other entity to enter into a contract requiring greater confidentiality or delegating authority to make a disclosure or use in accordance with this section;
  - (5) as preempting or otherwise affecting any [State](/usc/42/300gg–91.md?p=d-14) law requiring a [provider](/usc/42/299b–21.md?p=8) to report information that is not [patient safety work product](/usc/42/299b–21.md?p=7-A); or
  - (6) to limit, alter, or affect any requirement for reporting to the Food and [Drug](/usc/42/282.md?p=j-1-A-vii) Administration information regarding the safety of a product or activity regulated by the Food and [Drug](/usc/42/282.md?p=j-1-A-vii) Administration.
- (h) **Clarification—** Nothing in this part prohibits any [person](/usc/42/1320a–7k.md?p=d-4-C-i) from conducting additional analysis for any purpose regardless of whether such additional analysis involves issues identical to or similar to those for which information was reported to or assessed by a [patient safety organization](/usc/42/299b–21.md?p=4) or a [patient safety evaluation system](/usc/42/299b–21.md?p=6).
- (i) **Clarification of application of HIPAA confidentiality regulations to patient safety organizations—** For purposes of applying the [HIPAA confidentiality regulations](/usc/42/299b–21.md?p=1)—
  - (1) [patient safety organizations](/usc/42/299b–21.md?p=4) shall be treated as business associates; and
  - (2) [patient safety activities](/usc/42/299b–21.md?p=5) of such organizations in relation to a [provider](/usc/42/299b–21.md?p=8) are deemed to be health care operations (as defined in such [regulations](/usc/42/201.md?p=d)) of the [provider](/usc/42/299b–21.md?p=8).
- (j) **Reports on strategies to improve patient safety—**
  - (1) **Draft report—** Not later than the date that is 18 months after any network of patient safety databases is operational, the [Secretary](/usc/42/201.md?p=c), in consultation with the [Director](/usc/42/299c–7.md?p=3), shall prepare a draft report on effective strategies for reducing medical errors and increasing patient safety. The draft report shall include any measure determined appropriate by the [Secretary](/usc/42/201.md?p=c) to encourage the appropriate use of such strategies, including use in any federally funded [programs](/usc/42/274l–1.md?p=4). The [Secretary](/usc/42/201.md?p=c) shall make the draft report available for public comment and submit the draft report to the Institute of Medicine for review.
  - (2) **Final report—** Not later than 1 year after the date described in [paragraph (1)](#j-1), the [Secretary](/usc/42/201.md?p=c) shall submit a final report to the Congress.

# §299b–23. Network of patient safety databases

- (a) **In general—** The [Secretary](/usc/42/201.md?p=c) shall facilitate the creation of, and maintain, a network of patient safety databases that provides an interactive evidence-based management resource for [providers](/usc/42/299b–21.md?p=8), [patient safety organizations](/usc/42/299b–21.md?p=4), and other entities. The network of databases shall have the capacity to accept, aggregate across the network, and analyze [nonidentifiable patient safety work product](/usc/42/299b–21.md?p=3) voluntarily reported by [patient safety organizations](/usc/42/299b–21.md?p=4), [providers](/usc/42/299b–21.md?p=8), or other entities. The [Secretary](/usc/42/201.md?p=c) shall assess the feasibility of providing for a [single](/usc/42/2304.md?p=m) point of access to the network for qualified researchers for information aggregated across the network and, if feasible, provide for implementation.
- (b) **Data standards—** The [Secretary](/usc/42/201.md?p=c) may determine common formats for the reporting to and among the network of patient safety databases maintained under [subsection (a)](#a) of [nonidentifiable patient safety work product](/usc/42/299b–21.md?p=3), including necessary work product elements, common and consistent definitions, and a standardized computer interface for the processing of such work product. To the extent practicable, such [standards](/usc/42/1320d.md?p=7) shall be consistent with the administrative simplification provisions of part C of title XI of the Social Security Act [[42 U.S.C. 1320d](/usc/42/1320d.md) et seq.].
- (c) **Use of information—** Information reported to and among the network of patient safety databases under [subsection (a)](#a) shall be used to analyze national and regional statistics, including trends and patterns of health care errors. The information resulting from such analyses shall be made available to the public and included in the annual quality reports prepared under [section 299b–2(b)(2) of this title](/usc/42/299b–2.md?p=b-2).

# §299b–24. Patient safety organization certification and listing

- (a) **Certification—**
  - (1) **Initial certification—** An entity that seeks to be a [patient safety organization](/usc/42/299b–21.md?p=4) shall submit an initial certification to the [Secretary](/usc/42/201.md?p=c) that the entity—
    - (A) has policies and procedures in place to perform each of the [patient safety activities](/usc/42/299b–21.md?p=5) described in [section 299b–21(5) of this title](/usc/42/299b–21.md?p=5); and
    - (B) upon being listed under [subsection (d)](#d), will comply with the criteria described in [subsection (b)](#b).
  - (2) **Subsequent certifications—** An entity that is a [patient safety organization](/usc/42/299b–21.md?p=4) shall submit every 3 years after the date of its initial listing under [subsection (d)](#d) a subsequent certification to the [Secretary](/usc/42/201.md?p=c) that the entity—
    - (A) is performing each of the [patient safety activities](/usc/42/299b–21.md?p=5) described in [section 299b–21(5) of this title](/usc/42/299b–21.md?p=5); and
    - (B) is complying with the criteria described in [subsection (b)](#b).
- (b) **Criteria—**
  - (1) **In general—** The following are criteria for the initial and subsequent certification of an entity as a [patient safety organization](/usc/42/299b–21.md?p=4):
    - (A) The mission and primary activity of the entity are to conduct activities that are to improve patient safety and the quality of health care delivery.
    - (B) The entity has appropriately qualified staff (whether directly or through contract), including licensed or certified medical professionals.
    - (C) The entity, within each 24-month period that begins after the date of the initial listing under [subsection (d)](#d), has bona fide contracts, each of a reasonable period of time, with more than 1 [provider](/usc/42/299b–21.md?p=8) for the purpose of receiving and reviewing [patient safety work product](/usc/42/299b–21.md?p=7-A).
    - (D) The entity is not, and is not a component of, a [health insurance issuer](/usc/42/300gg–91.md?p=b-2) (as defined in [section 300gg–91(b)(2) of this title](/usc/42/300gg–91.md?p=b-2)).
    - (E) The entity shall fully disclose—
      - (i) any financial, reporting, or [contractual relationship](/usc/42/9601.md?p=35-A) between the entity and any [provider](/usc/42/299b–21.md?p=8) that contracts with the entity; and
      - (ii) if applicable, the fact that the entity is not managed, controlled, and operated independently from any [provider](/usc/42/299b–21.md?p=8) that contracts with the entity.
    - (F) To the extent practical and appropriate, the entity collects [patient safety work product](/usc/42/299b–21.md?p=7-A) from [providers](/usc/42/299b–21.md?p=8) in a standardized manner that permits valid comparisons of similar cases among similar [providers](/usc/42/299b–21.md?p=8).
    - (G) The utilization of [patient safety work product](/usc/42/299b–21.md?p=7-A) for the purpose of providing direct feedback and assistance to [providers](/usc/42/299b–21.md?p=8) to effectively minimize patient risk.
  - (2) **Additional criteria for component organizations—** If an entity that seeks to be a [patient safety organization](/usc/42/299b–21.md?p=4) is a component of another organization, the following are additional criteria for the initial and subsequent certification of the entity as a [patient safety organization](/usc/42/299b–21.md?p=4):
    - (A) The entity maintains [patient safety work product](/usc/42/299b–21.md?p=7-A) separately from the rest of the organization, and establishes appropriate security measures to maintain the confidentiality of the [patient safety work product](/usc/42/299b–21.md?p=7-A).
    - (B) The entity does not make an unauthorized disclosure under this part of [patient safety work product](/usc/42/299b–21.md?p=7-A) to the rest of the organization in breach of confidentiality.
    - (C) The mission of the entity does not create a conflict of interest with the rest of the organization.
- (c) **Review of certification—**
  - (1) **In general—**
    - (A) **Initial certification—** Upon the submission by an entity of an initial certification under [subsection (a)(1)](#a-1), the [Secretary](/usc/42/201.md?p=c) shall determine if the certification meets the requirements of subparagraphs [(A)](#c-1-A) and [(B)](#c-1-B) of such subsection.
    - (B) **Subsequent certification—** Upon the submission by an entity of a subsequent certification under [subsection (a)(2)](#a-2), the [Secretary](/usc/42/201.md?p=c) shall review the certification with respect to requirements of subparagraphs [(A)](#c-1-A) and [(B)](#c-1-B) of such subsection.
  - (2) **Notice of acceptance or non-acceptance—** If the [Secretary](/usc/42/201.md?p=c) determines that—
    - (A) an entity’s initial certification meets requirements referred to in [paragraph (1)(A)](#c-1-A), the [Secretary](/usc/42/201.md?p=c) shall notify the entity of the acceptance of such certification; or
    - (B) an entity’s initial certification does not meet such requirements, the [Secretary](/usc/42/201.md?p=c) shall notify the entity that such certification is not accepted and the reasons therefor.
  - (3) **Disclosures regarding relationship to providers—** The [Secretary](/usc/42/201.md?p=c) shall consider any disclosures under [subsection (b)(1)(E)](#b-1-E) by an entity and shall make public findings on whether the entity can fairly and accurately perform the [patient safety activities](/usc/42/299b–21.md?p=5) of a [patient safety organization](/usc/42/299b–21.md?p=4). The [Secretary](/usc/42/201.md?p=c) shall take those findings into consideration in determining whether to accept the entity’s initial certification and any subsequent certification submitted under [subsection (a)](#a) and, based on those findings, may deny, condition, or revoke acceptance of the entity’s certification.
- (d) **Listing—** The [Secretary](/usc/42/201.md?p=c) shall compile and maintain a listing of entities with respect to which there is an acceptance of a certification pursuant to [subsection (c)(2)(A)](#c-2-A) that has not been revoked under [subsection (e)](#e) or voluntarily relinquished.
- (e) **Revocation of acceptance of certification—**
  - (1) **In general—** If, after notice of deficiency, an opportunity for a hearing, and a reasonable opportunity for correction, the [Secretary](/usc/42/201.md?p=c) determines that a [patient safety organization](/usc/42/299b–21.md?p=4) does not meet the certification requirements under [subsection (a)(2)](#a-2), including subparagraphs [(A)](#a-2-A) and [(B)](#a-2-B) of such subsection, the [Secretary](/usc/42/201.md?p=c) shall revoke the [Secretary](/usc/42/201.md?p=c)’s acceptance of the certification of such organization.
  - (2) **Supplying confirmation of notification to providers—** Within 15 days of a revocation under [paragraph (1)](#e-1), a [patient safety organization](/usc/42/299b–21.md?p=4) shall submit to the [Secretary](/usc/42/201.md?p=c) a confirmation that the organization has taken all reasonable actions to notify each [provider](/usc/42/299b–21.md?p=8) whose [patient safety work product](/usc/42/299b–21.md?p=7-A) is collected or analyzed by the organization of such revocation.
  - (3) **Publication of decision—** If the [Secretary](/usc/42/201.md?p=c) revokes the certification of an organization under [paragraph (1)](#e-1), the [Secretary](/usc/42/201.md?p=c) shall—
    - (A) [remove](/usc/42/9601.md?p=23) the organization from the listing maintained under [subsection (d)](#d); and
    - (B) publish notice of the revocation in the Federal Register.
- (f) **Status of data after removal from listing—**
  - (1) **New data—** With respect to the privilege and confidentiality protections described in [section 299b–22 of this title](/usc/42/299b–22.md), data submitted to an entity within 30 days after the entity is removed from the listing under [subsection (e)(3)(A)](#e-3-A) shall have the same status as data submitted while the entity was still listed.
  - (2) **Protection to continue to apply—** If the privilege and confidentiality protections described in [section 299b–22 of this title](/usc/42/299b–22.md) applied to [patient safety work product](/usc/42/299b–21.md?p=7-A) while an entity was listed, or to data described in [paragraph (1)](#f-1), such protections shall continue to apply to such work product or data after the entity is removed from the listing under [subsection (e)(3)(A)](#e-3-A).
- (g) **Disposition of work product and data—** If the [Secretary](/usc/42/201.md?p=c) [removes](/usc/42/9601.md?p=23) a [patient safety organization](/usc/42/299b–21.md?p=4) from the listing as provided for in [subsection (e)(3)(A)](#e-3-A), with respect to the [patient safety work product](/usc/42/299b–21.md?p=7-A) or data described in [subsection (f)(1)](#f-1) that the [patient safety organization](/usc/42/299b–21.md?p=4) received from another entity, such former [patient safety organization](/usc/42/299b–21.md?p=4) shall—
  - (1) with the approval of the other entity and a [patient safety organization](/usc/42/299b–21.md?p=4), transfer such work product or data to such [patient safety organization](/usc/42/299b–21.md?p=4);
  - (2) return such work product or data to the entity that submitted the work product or data; or
  - (3) if returning such work product or data to such entity is not practicable, destroy such work product or data.

# §299b–24a. Activities regarding women’s health

- (a) **Establishment—** There is established within the [Office](/usc/42/3058f.md?p=1) of the [Director](/usc/42/299c–7.md?p=3), an [Office](/usc/42/3058f.md?p=1) of Women’s Health and Gender-Based Research (referred to in this section as the “[Office](/usc/42/3058f.md?p=1)”). The [Office](/usc/42/3058f.md?p=1) shall be headed by a [director](/usc/42/299c–7.md?p=3) who shall be appointed by the [Director](/usc/42/299c–7.md?p=3) of Healthcare and Research Quality.
- (b) **Purpose—** The official designated under [subsection (a)](#a) shall—
  - (1) report to the [Director](/usc/42/299c–7.md?p=3) on the current [Agency](/usc/42/299c–7.md?p=2) level of activity regarding women’s health, across, where appropriate, age, biological, and sociocultural contexts, in all aspects of [Agency](/usc/42/299c–7.md?p=2) work, including the development of evidence reports and clinical practice protocols and the conduct of research into patient outcomes, delivery of health care [services](/usc/42/201.md?p=a), quality of care, and access to health care;
  - (2) establish short-range and long-range goals and objectives within the [Agency](/usc/42/299c–7.md?p=2) for research important to women’s health and, as relevant and appropriate, coordinate with other appropriate [offices](/usc/42/3058f.md?p=1) on activities within the [Agency](/usc/42/299c–7.md?p=2) that relate to health [services](/usc/42/201.md?p=a) and medical effectiveness research, for issues of particular concern to women;
  - (3) identify [projects](/usc/42/11360.md?p=20) in women’s health that should be conducted or supported by the [Agency](/usc/42/299c–7.md?p=2);
  - (4) consult with health professionals, nongovernmental organizations, consumer organizations, women’s health professionals, and other individuals and groups, as appropriate, on [Agency](/usc/42/299c–7.md?p=2) policy with regard to women; and
  - (5) serve as a member of the Department of Health and Human [Services](/usc/42/201.md?p=a) Coordinating Committee on Women’s Health (established under [section 237a(b)(4) of this title](/usc/42/237a.md?p=b-4)).
- (c) **Authorization of appropriations—** For the purpose of carrying out this section, there are authorized to be appropriated such sums as may be necessary for each of the fiscal years 2010 through 2014.

# §299b–25. Technical assistance


The [Secretary](/usc/42/201.md?p=c), acting through the [Director](/usc/42/299c–7.md?p=3), may provide technical assistance to [patient safety organizations](/usc/42/299b–21.md?p=4), including convening annual meetings for [patient safety organizations](/usc/42/299b–21.md?p=4) to discuss methodology, communication, data collection, or privacy concerns.


# §299b–26. Severability


If any provision of this part is held to be unconstitutional, the remainder of this part shall not be affected.