Tibbs v. Bunnell

Opinion of the Court by Justice SCOTT. Appellants, Phillip Tibbs, M.D., Joel E. Norman, M.D., and Barrett W. Brown, M.D., petitioned the Court of Appeals for a writ of prohibition directing the Fayette County Circuit Court to prohibit the production of an “incident” or “event” report created after the death of patient Luvetta Goff, arguing that it fell within the federal privilege created by the Patient Safety and Quality Improvement Act of 2005 (“PSQIA” or “the Act”), 42 U.S.C.A. § 299b-21 et seq. The Court of Appeals granted Appellants the writ, but Appellants appealed to this Court as a matter of right, Ky. Const. § 110(2)(b), arguing that the Court of Appeals erroneously limited the protective scope of the privilege. No cross-appeals were filed. Appellants now present a question of first impression to this Court regarding the proper scope of the privilege established by the Act. As such, the issuance of the writ is not before us, and therefore stánds, as does the order of remand for further review. We only address the scope of the Act’s privilege, as this is the sole issue presented on appeal. For the reasons that follow, we reverse and clarify the scope of the Act’s privilege to be applied on remand. I. BACKGROUND The underlying case is a medical malpractice action in which Goff died as a result of complications from an elective spine surgery performed by Appellants at the University of Kentucky Hospital. Goffs estate filed a wrongful death and medical malpractice action against Appellants, and this appeal stems from a discovery dispute regarding an alleged post-incident or event report generated by a UK Hospital surgical nurse concerning the surgery through the UK Healthcare Patient Safety Evaluation System on the day of the event.1 During discovery, Goffs estate requested the following: INTERROGATORY NO. 26: Please state whether any investigation, including but not limited to peer review and/or incident reports, has been conducted upon the medical treatment, surgery or care rendered to the Plaintiff, by you, or anyone at your direction or control, and if so, by whom, when and the results thereof. If yes, produce such documents. [[Image here]] REQUEST NO. 7: Please produce any and all documents generated by any investigation, including but not limited to, peer review and/or incident reports of the events of January 3, 2011 through January 26, 2011, as identified in your answer to interrogatory No. 26. Appellants then moved for a protective order concerning the report, asserting that the only post-incident report that exists is a “report created through UK Healthcare’s Patient Safety Evaluation System” and, thus, it is protected from discovery by the new federal privilege for patient safety work product created by the Act.2 [799] The trial court denied Appellants’ motion and ordered production of the document if it was generated by “someone involved in or with actual knowledge of the medical care,”3 at UK. Appellants then sought a writ of prohibition preventing the trial court from ordering production of the report, and the Court of Appeals entered an order granting the writ of prohibition, holding the Act’s federal privilege preempted the trial court from ordering the disclosure of information privileged under federal statutory law,4 but that the Act’s privilege is limited to “doeu-ments that contain a self-examining analysis,” and, thus, remanded the matter to the trial court with instructions to conduct an in camera review of the document at issue to determine if it contained the required “self-examining analysis.”5 Appellants now appeal from the Court of Appeals’ opinion and order alleging that the Court of Appeals erroneously limited the scope of the privilege. Appellants base their appeal on the portion of the Court of Appeals order limiting the privilege to documents containing a “self-exam [800] ining analysis,” arguing that the term “self-examining analysis” is neither found nor implied in the Act or its legislative history. II. PSQIA Before we address the scope of the Act’s privilege, we feel that it is important to discuss the history and purpose of the Act as established by the United States Congress. Congress enacted this legislation in order to encourage health care providers to voluntarily associate and communicate privileged patient safety work product (PSWP) among themselves through in-house patient safety evaluation systems (PSES) and with and through affiliated patient safety organizations (PSO) in order to hopefully create an enduring national system capable of studying, analyzing, disseminating, and acting on events, solutions, and recommendations for the betterment of national patient safety, healthcare quality, and healthcare outcomes. 42 U.S.C.A. § 299b-21, et seq.; see also Dep’t of Fin. & Prof'l Regulation v. Walgreen Co., 361 Ill.Dec. 186, 970 N.E.2d 552, 557 (Ill.App.Ct.2012) (“The Patient Safety Act ‘announces a more general approval of the medical peer review process and more sweeping evidentiary protections for materials used therein.’ ” (citation omitted)).6 Congress took such action following the Institute of Medicine’s (IOM) publication of a report entitled To Err Is Human: Building a Safer Health System, in which it was estimated that up to 98,000 Americans die each year as a result of medical errors, most of which “errors were not the result of personal recklessness but rather resulted from faulty systems, processes, and conditions.” Lee Med., Inc. v. Beecher, 312 S.W.3d 515, 534 (Tenn.2010) (citing Institute of Medicine, Committee on Quality of Health Care in America, To Err Is Human: Building a Safer Health System, 49-66 (2000)). Prior to the Act, providers had little incentive to communicate amongst themselves and to report and analyze errors nationally due to fear that such communications or analysis might well generate litigation and/or be discoverable therein. The intended purpose of the Act is set out in the House of Representatives report, as follows: The IOM report offered several recommendations to improve patient safety and reduce medical error, including that Congress pass legislation to extend peer review protections to data related to patient safety and quality improvement that are developed and analyzed by health care organizations for internal [801] use or shared with others solely for the purpose of improving safety and quality. This bill’s intended purpose is to encourage the reporting and analysis of medical errors and health care systems by providing peer review protection of information reported to patient safety organizations for the purposes of quality improvement and patient safety. These protections will facilitate an environment in which health care providers are able to discuss errors openly and learn from them. The protections apply to certain categories of documents and communications termed “patient safety work product” that are developed in connection with newly created patient safety organizations. This patient safety work product is considered privileged and, therefore, cannot be subject to disclosure.... ELR.Rep. No. 109-197 (2005). Complementing the privilege is a confidentiality provision establishing that “patient safety work product shall be confidential and shall not be disclosed” except as authorized by the Act itself. 42 U.S.C.A. § 299b—22(b); see also 42 C.F.R. § 3.206(b).7 III. ANALYSIS Appellants raise a very narrow issue before this Court: whether the Court of Appeals erred in limiting the privilege to documents employing a “self-examining analysis” rather than the statutory language used in the Act. If Appellants are correct, the secondary question becomes: what is “patient safety work product”? On direct appeal from the Court of Appeals in a case involving a writ of prohibition, this Court reviews the Court of Appeals legal rulings de novo. Commonwealth v. Shepherd, 366 S.W.3d 1, 4 (Ky.2012) (citing Grange Mutual Ins. Co. v. Trude, 151 S.W.3d 803 (Ky.2004)). A. Applicability of Francis In granting Appellants’ petition for writ of prohibition, the Court of Appeals construed the privilege under the Act to be limited to documents, or portions thereof, containing a “self-examining analysis,” thereby instructing the trial court upon remand to review the document at issue in camera to determine what portions qualified for the privilege. In support of its opinion, the Court of Appeals cited to Francis v. United States, No. 09 Civ. 4004(GBD)(KNF), 2011 WL 2224509 (S.D.N.Y. May 31, 2011). Appellants argue that the Court of Appeals erred in applying Francis to determine the scope of the privilege granted by the Act, since the Act was not applicable therein8 and Francis applied a different federal common law privilege involving a “self-examining analysis.”9 [802] On review, we agree that the Court of Appeals misapplied Francis to the present case given that it relied on dictum from Francis to support its finding that the Act’s privilege is limited solely to documents, or portions thereof, that employ a “self-examining analysis,” to wit: Inasmuch as the self-critical analysis privilege “is based upon the concern that disclosure of documents reflecting candid self-examination will deter or suppress socially useful investigations and evaluations!,]” it stands to reason that only quality assurance review documents containing self-examining statements are privileged. This conclusion is in line with Congress’ intent regarding the scope of the [Act’s] privilege, which extends only to “the analysis of, and subsequent corrective actions related to [an] adverse event or medical errors. Id. at *1 (citations omitted). The final portion of this quote was extracted from a Senate report that accompanied a 2003 proposed version of the Patient Safety Act that was not enacted. Therefore, the Court of Appeals relied on commentary from Francis regarding a pri- or- version of the Act that never became law, rather than on the Act itself. Furthermore, the Court of Appeals failed to take into consideration the entire context of that Senate report. The full text demonstrates that it was not the intent of the Senate under the prior draft to limit the scope of the privilege to only documents employing a self-critical analysis. The legislation grants an evidentiary privilege for information collected and developed by providers and PSO’s through this voluntary reporting system. The privilege encompasses not only the report to the patient safety organization but also all aspects of the analysis of, and subsequent corrective actions related to, adverse events, medical errors, and “near misses” reported as patient safety data. It covers all deliberations, including oral and written communications, and work products that meet the requirements for patient safety data. Sen. Rep. No. 108-196, at 5 (2003). Given that Francis involved the application of a common law privilege under a different federal statute, referred to a Senate report that accompanied a prior version of the Act that predated the actual passage of the Act, and failed to consider the full context of that Senate report, we believe that the Court of Appeals was misguided in its ultimate limitations on the scope of the privilege. In fact, as the statutory language indicates, the privilege also extends to certain types of information and data underlying, supporting, or triggering such an analysis. 42 U.S.C.A. § 299b-21(7). We therefore reverse the opinion of the Court of Appeals to the extent it limited the scope of the Act’s privilege to documents containing a “self-examining analysis.” We will now analyze and clarify the scope of the Act’s privilege. B. Proper Scope of Analysis In order to determine whether or not something falls under the protection of the privilege established by the Act, one must first look to the plain language of the Act itself. “The cardinal rule of statutory construction is that the intention of the legislature should be ascertained and given effect.” Jefferson Cnty. Bd. of Educ. v. Fell, 391 S.W.3d 713, 718 (Ky.2012) {citing MPM Fin. Grp., Inc. v. Morton, 289 S.W.3d 193, 197 (Ky.2009)). “Thus, we first look at the language employed by [Congress], relying generally on the common meaning of the particular words chosen.” Id. at 719 {citing Caesars Riverboat Casino, LLC v. Beach, 336 S.W.3d 51, 58 (Ky.2011)). [803] Therefore the first analysis to undertake when a party asserts the Act’s privilege is to determine whether the information satisfies the statutory definition for patient safety work product as established by the Act, to wit: (A) In general Except as provided in subparagraph (B), the term “patient safety work product” means any data, reports, records, memoranda, and analyses (such as root cause analyses), or written or oral statements— (i) which— (I) are assembled or developed by a provider for reporting to a patient safety organization and are reported to a patient safety organization; or (II) are developed by a patient safety organization for the conduct of patient safety activities; and which could result in improved patient safety, health care quality, or healthcare outcomes; or (ii) which identify or constitute the deliberations or analysis of, or identify the fact of reporting pursuant to, a patient safety evaluation system. 42 U.S.C.A. § 299b-21 (7). To the extent this may be done, we need go no further. Here, the language of the Act’s definition of “patient safety work product” establishes that the categories of items defined in subsection A shall be deemed to be patient safety work product, unless it falls within one of the exceptions established in subparagraph B. One must then look to subsection B to determine if an item falls within the exception stated: (B) Clarification: (i) Information described in subpara-graph (A) does not include a patient’s medical record, billing and discharge information, or any other original patient or provider record. (ii) Information described in subpara-graph (A) does not include information that is collected, maintained, or developed separately, or exists separately, from a patient safety evaluation system. Such separate information or a copy thereof reported to a patient safety organization shall not by reason of its reporting be considered patient safety work product. (iii) Nothing in this part shall be construed to limit— (I) the discovery of or admissibility of information described in this sub-paragraph in a criminal, civil, or administrative proceeding; (II) the reporting of information described in this subparagraph to a Federal, State, or local governmental agency for public health surveillance, investigation, or other public health purposes or health oversight purposes; or (III) a provider’s recordkeeping obligation with respect to information described in this subparagraph under Federal, State, or local law. 42 U.S.C.A. § 299b-21(7)(B) (emphasis added). C. Goff’s “Incident Report” is Not Protected by the PSQIA We now turn in the present case to the determination of whether “incident reports” are protected under the Act’s privilege. By its plain and express terms, the Act does not protect a “patient’s medical record, billing and discharge information, or any other original patient or provider record.” 42 U.S.C.A. § 299b-21(7)(B)(i). Nor does it protect information “collected, maintained or developed separately, or existing separately from a patient safety evaluation system” even if collected by a Patient Safety Evaluation System and re [804] ported to a Patient Safety Organization. 42 U.S.C.A. § 299b-21(7)(B)(ii). Kentucky Administrative Regulations relating to Kentucky hospitals provide that: “administrative reports shall be established, maintained and utilized as necessary to guide the operation, measure of productivity and reflect the programs of the facility.” 902 KAR 20:016 § 3(3)(a) (emphasis added). These reports “shall include: ... (5) [ijncident investigation reports; [10,11] and (6) [o]ther pertinent reports made in the regular course of business.” Id. Such required documents also include peer review and credentialing records. See 902 KAR 20:016 § 8(b)(l)-(2). Under Kentucky law, these types of reports are required in the regular course of the hospital’s business, are hospital records, and, thus, are generally discoverable. See Saleba, 300 S.W.3d at 184 (“[W]e reiterate that KRS 311.377(2) does not extend the privilege for peer review documents to medical malpractice suits.”). This position conforms with the United States Department for Health and Human Services’ own interpretation of the Act in its enactment of its final rules and regulations covering its implementation, to wit: The Patient Safety Act establishes a protected space or system that is separate, distinct, and resides alongside but does not replace other information collection activities mandated by laws, regulations, and accrediting and licensing requirements as well as voluntary reporting activities that occur for the purpose of maintaining accountability in the health care system. Information is not patient safety work product if it is collected to comply with external obligations, such as: state incident reporting requirements; adverse drug event information reporting to the Food and Drug Administration (FDA); certification or licensing records for compliance with health oversight agency requirements; reporting to the National Practitioner Data Bank of physician disciplinary actions; complying with required disclosures by particular providers or suppliers pursuant to Medicare’s conditions of participation or conditions of coverage; or provision of access to records by Protection and Advocacy organizations as required by law. Patient Safety and Quality Improvement, 73 FR 70732-01 at 70742-43. As a rule, courts give deference to agency interpretations of the statutes which they administer. Chevron, U.S.A., Inc. v. Natural Res. Def. Council, Inc., 467 U.S. 837, 844, 104 S.Ct. 2778, 81 L.Ed.2d 694 (1984) (“We have long recognized that considerable weight should be accorded to an executive department’s construction of a statutory scheme it is entrusted to administer, and the principle of deference to administrative interpretations.” (footnote omitted)). Moreover, an agency’s interpretation of its own regulations is controlling unless it is “plainly erroneous or in [805] consistent with the regulation.” Auer v. Robbins, 519 U.S. 452, 461, 117 S.Ct. 905, 137 L.Ed.2d 79 (1997) (citations omitted). Here, UK Healthcare’s Risk Management Director’s affidavit establishes, in relevant part, that: 1. “The UK Healthcare Risk Management Department oversees the daily operation of [UK Healthcare’s] Patient Safety Evaluation System (“PSES”).” 12 2. “[T]he University subsequently entered into a contract with [University HealthSystem Consortium (UHC)] for UHC to serve as the University’s [Patient Safety Organization (PSO) ].” 3. “One of UHC’s services as the University’s PSO is to provide UK Healthcare with the use of UHC’s Patient Safety Net® system.” 4. “The Patient Safety Net® is a real-time, Web-based event reporting system, which serves as the data collection tool and the repository for information submitted to the UHC PSO through a provider’s PSES.” (Emphasis added.) 5. “The Patient Safety Net® collects and compiles UK Healthcare’s reported events data (incident reports) and generates analyses and reports for Patient Safety Net® participants with the ability to generate reports and to compare statistics between participants.” 13 6. “A wide range of events are reported to the Patient Safety Net® including Patient Events, Staff Events, Visitor Events and Unsafe Conditions. There are many types of reportable events in the Patient Events category, which include complications of surgery or anesthesia, including, but not limited to, death or hemorrhage requiring an unexpected transfusion or return to the OR. The intraoperative complication that occurred during Luvetta Goffs surgery was appropriately reported to the Patient Safety Net®....” 7. “Since the creation of UK Healthcare’s PSES, all incident reports at UK Healthcare facilities, including the incident report concerning Lu--vetta Goff, have been generated exclusively through UHC’s Patient Safety Net® system. Thus, to create an incident report, a UK HealthCare employee must input data through UHC’s web-based system.” 8. “The Patient Safety Net® requires incident reports to include certain common data elements, including the date of the submission, any person harmed or affected by the incident, the location where the event occurred, and a description of the event.” 9. “All incident reports completed by a UK Healthcare employee using the Patient Safety Net® are automatically transmitted to UHC every 45 days.” [806] In support of their argument that the Act mandates a privilege for the incident or event report in this instance, Appellants cite to Dep’t of Fin. & Prof'l Regulation v. Walgreen Co., 361 Ill.Dec. 186, 970 N.E.2d 552 (Ill.App.Ct.2012) and K.D. ex rel. Dieffenbach v. United States, 715 F.Supp.2d 587 (D.Del.2010). K.D. was an action under the Federal Tort Claims Act (FTCA), 28 U.S.C.A. § 2671, et seq., wherein production was sought of documents concerning monitoring of a National Institutes of Health (NIH) research protocol in which K.D. had participated.14 K.D., like Francis, relied on the 2003 Senate Report on the Act (which refers to an earlier draft that was never enacted) in its general analysis of the Act. Id. at 595. Moreover, in analogizing the common law privilege involved to information privileged under the Act, it did not address 42 U.S.C.A. § 299b-21(7)(B) dealing with the exceptions to “patient safety work product.” Walgreen, however, upheld a trial court’s order prohibiting production and discovery under the PSQIA of Walgreen incident reports of medication error by three of its pharmacists, sought by the Illinois Department of Financial and Professional Regulation (the Department). Walgreen, 361 IlhDee. 186, 970 N.E.2d at 558. The Department had claimed the pharmacy incident reports were exempted from the Act’s privilege as they “could have been created, maintained, or used for a purpose other than reporting to a PSO.” Id., 361 Ill.Dec. 186, 970 N.E.2d at 557. Thus, it argued they would not be privileged pursuant to 42 U.S.C.A. § 299b-2l(7)(B)(ii). Walgreen, on the other hand, established by affidavit, that it “does not create, maintain, or otherwise have in its possession incident reports pertaining to medication error other than the STARS reports referenced in [its] original affidavit. There are no other incident reports pertaining to medication error that are collected or maintained separately from the STARS reporting system.” Walgreen, 361 Ill.Dec. 186, 970 N.E.2d at 558. Walgreen’s affidavit further evidenced that the STARS reports were transmitted to a PSO. Pursuant to the foregoing, the court in Walgreen held the “STARS reports were privileged pursuant to section 299b-21(7) of the ... Act.” Id. However, the opinion did not disclose any obligations Walgreen had to create, maintain, or file medication error incident reports with the Illinois Department, other than noting that the Illinois Medical Studies Act was not applicable to pharmacies and the Department sought an order compelling their production.15 [807] Plainly, however, the PSQIA did not intend to supplant, or invalidate, traditional state monitoring or regulation of health providers. See 42 U.S.C.A. § 299b-21(7)(B)(i)-(iii). As previously noted, the United States Department of Health and Human Services’ own final rules negate any such intent: “The Patient Safety Act establishes a protected space or system that is separate, distinct, and resides alongside but does not replace other information collection activities mandated by laws, regulations, and accrediting and licensing requirements as well as voluntary reporting activities that occur for the purpose of maintaining accountability in the health care system.” Patient Safety and Quality Improvement, 73 FR 70732-01 at 70742 (emphasis added). Thus, as noted in the House Report regarding the Act: Paragraphs 7(B)(i) and (ii) explains documents or communications that are not included under clause (7)(A). The Committee understands that it is likely and appropriate for a provider to keep a copy of documents and possible logs of communications that are reported to the patient safety organization. Generally, such copies are also patient safety work product because they are part of the patient safety evaluation system. Such items would not be considered original provider records as set out under 7(B)(i). On the other hand, there may be documents or communications that are part of traditional health care operations or record keeping (including but not limited to medical records, billing records, guidance on procedures, physician notes, hospital policies, logs of operations, records of drug deliveries, and primary information at the time of events). Such information may be in communications or copies of documents sent to a patient safety organization. Originals or copies of such documents are both original provider records and separate information that is developed, collected, maintained or exist separately from any patient safety evaluation system. Both these original documents and ordinary information about health care operations may be relevant to a patient safety evaluation system but are not themselves patient safety work product. H.R. Rep. 109-197, 14 (emphasis added). To date, no opinion has directly addressed the effect of the Act’s recognition of these dual reporting obligations. One Florida federal discrimination action, Awwad v. Largo Med. Ctr., Inc., 8:11-CV-1638-T-24TBM, 2012 WL 1231982 (M.D.Fla. Apr. 12, 2012), touched • on the applicability of the Act to the discovery of credentialing and peer review files, .but held, without explanation, “any privilege created by the PSQIA appears inapplicable to the circumstances of this case.” Id. at *2. It is noted, however, that Florida has a constitutional provision and statutes mandating patient rights of access to “any records made or received in the course of business by a health care facility or health care provider relating to any adverse medical incident.” 16 Fla. Const. [808] art. X, § 25(a); see also Fla. Stat. Ann. § 381.028 (the pre-2013 version of which was held unconstitutional in part by W. Florida Reg’l Med. Ctr., Inc. v. See, 79 So.3d 1 (Fla.2012)). Thus, according to one Florida writer, “neither annual reports nor Code 15 reports are protected as PSWP” in Florida under the Act. Kelly G. Dunberg, Just What the Doctor Ordered? How the Patient Safety and Quality Improvement Act May Cure Florida’s Patients’ Right to Know About Adverse Medical Incidents (Amendment 7), 64 Fla. L.Rev. 513, 542 (2012).17 Although this issue might have also been addressed in Lee Mem’l Health Sys. v. Guillermo, 2:10-CV-00700-FTM-36, 2011 WL 5826672, (“Counts One through Four of the Amended Complaint seek declaratory relief to the effect that Amendment 7 [ (Fla. Const, art. X, § 25) ] is preempted by the ... PSQIA.”), the federal district court abstained from exercising jurisdiction and dismissed the case, stating that “Florida Circuit Courts, District Courts of Appeal, and the Supreme Court of Florida have shown themselves to be very capable of adjudicating these federal issues.” Id. The following year (in 2012), in W. Florida Reg’l Med. Ctr., 79 So.3d 1, an issue was raised by the hospital as to whether an incident report was protected by various Florida statutes, as well as the Health Care Quality Improvement Act of 1986 (HCQIA), 42 U.S.C.A. § 11101, et. seq. However, it is notable that no issue was raised in that case as to the applicability of PSQIA. Id. One other opinion handled the issue of event reports peripherally, Venosh v. Henzes, No. 11CV3058, 2013 WL 9593953 (Pa.Com.Pl. July 17, 2013). However, Venosh was decided on the basis that there was no evidence that the two event reports were provided to a duly certified PSO. Id. at *1. This was the same rationale noted in Francis, supra. In Kentucky, KRS 216B.042 grants the Cabinet for Health and Family Services the responsibility for licensing and regulating healthcare facilities including the right to “[ejstablish licensure standards and procedures to ensure safe, adequate, and efficient ... health facilities and health services,” KRS 216B .042(c), as - well as the right to “enter upon the premises of any health care facility for the purpose of inspection,” KRS 216B-042(2). And, as previously stated, pursuant to its regulations, “[ajdministrative reports shall be established, maintained and utilized as necessary to guide the operation ... of the facility.” 902 KAR 20:016 § 3(3)(a) (emphasis added). Such reports shall include, among others, “incident investigation reports ... and ... [ojther pertinent reports made in the regular course of business.” Id. And such facilities shall “have written policies and procedures governing all aspects of the operation of the facility and the services provided, including: ... (g) [a]n effective procedure for recording accidents involving a patient ..., including incidents of transfusion reactions, drug reactions, medication errors, and similar events....” 902 KAR 20:016 § 3(4). [809] Here, we have incident information reported by a hospital surgical nurse that normally would be found in an incident report which is required by Kentucky regulations to be “established, maintained and utilized as necessary to guide the operation ... of the facility.” 902 KAR 20:016 § 3(3)(a). Yet, it appears the information has not been completed or maintained separately as a hospital record (in a normal incident report), but was filed and stored in a database ostensibly dedicated to the Hospital’s Patient Safety Evaluation System operated by its Risk Management Department and to which the hospital’s PSO has access. For this reason, it is claimed to be privileged under the Act. Yet, while the incident information may be relevant to its endeavors under the Act, it is not, nor can it be, patient safety work product, since its collection, creation, maintenance, and utilization is mandated by the Commonwealth of Kentucky as part of its regulatory oversight of its healthcare facilities. As evidenced by its recognition of dual reporting requirements, Congress never intended the Act to deprive the states of state-mandated information relevant to their regulatory duties. 42 U.S.C.A. § 299b-21(7)(B); H.R. Rep. 109-197, 14 (“Both these original documents and ordinary information about health care operations may be relevant to a patient safety evaluation system but are not themselves patient safety work product.”).18 Thus, Congress did not intend for separately-mandated incident information sources to be able to acquire a federal privilege by virtue of the healthcare provider’s act of putting them solely into a PSES repository system (here, “Patient Safety Net®”) for the use of the healthcare provider’s PSES and its PSO. Thus, information normally contained in an incident report is not privileged under the Act and may be discovered, following an in camera review, and its information compelled. To the extent the information normally contained in such state-mandated incident reports is intermingled with other material properly privileged under the Act, they may be separated from each other by the trial court in camera. We do not otherwise disturb or review the trial court’s order of confidentiality. IV. CONCLUSION We reiterate, the Court of Appeals’ issuance of the writ is not properly before us and stands, as does the order of remand. For the aforementioned reasons, we reverse the opinion of the Court of Appeals regarding the scope of the privilege under the Act, and remand this matter to the trial court for in camera review, consistent with this opinion. CUNNINGHAM and VENTERS, JJ., concur. NOBLE, J., concurs in result only. ABRAMSON, J., dissents by separate opinion in which MINTON, C.J., joins. KELLER, J., not sitting. Footnotes [1] The UK Healthcare Risk Management Department now oversees the daily operation of UK Healthcare’s Patient Safety Evaluation System (PSES). [2] Peer review documents and incident reports [799] are not otherwise privileged in malpractice litigation in Kentucky. Saleta v. Schrand, 300 S.W.3d 177 (Ky.2009). [3] Particularly, the trial court ordered: 1. The Court finds that the incident report subject to the defendants’ motion is not entitled to the privilege contained in the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. §§ 299b-22(a) and 299b-21 (the "Act”). The Court holds that the incident report is not "patient safety work product” because it is exempted from the definition of "patient safety work product” by the "clarification” contained § 299b—21(7)(B) of the Act. 2. The Court holds that the incident report is discoverable only if it was prepared by someone involved in or with actual knowledge of the medical care rendered to Mrs. Goff at the University of Kentucky ("UK”). Therefore, the defendants' motion for a protective order is OVERRULED if the incident report was prepared by a person who was involved in and had actual knowledge of Mrs. Goff's medical care at UK. The motion for protective order is SUSTAINED if the incident report was prepared by a person who was not involved in and did not have actual knowledge of Mrs. Goff’s medical care at UK. Within 20 days of the entry of this order, the defendants shall either produce the incident report or advise the Court and opposing counsel that it is not being produced because it was prepared by a person who was not involved in and did not have actual knowledge of Mrs. Goffs medical care at UK. 3. If the incident report is produced pursuant to this Order, it shall be maintained in a confidential manner, shall not be used for any purpose outside of this litigation, and shall not be disclosed to any person, party, or attorney who is not involved in this litigation. The Court will also allow appropriate redactions of elements of the form (as opposed to the substantive content inserted therein) if deemed necessary to protect any proprietary information regarding the form itself. [4] The section in the Code of Federal Regulations dealing with the privilege for patient safety work product states: (a) Privilege. Notwithstanding any other provision of Federal, State, local, or Tribal law and subject to paragraph (b) of this section and § 3.208 of this subpart, patient safety work product shall be privileged and shall not be: (1) Subject to a Federal, State, local, or Tribal civil, criminal, or administrative subpoena or order, including in a Federal, State, local, or Tribal civil or administrative disciplinary proceeding against a provider;.... 42 C.F.R. § 3.204 [5] The alleged “incident report,” or, as Appellants refer to it, the "incident/event report," has yet to be produced. However, given Appellants’ petition for a writ, the current appeal, and the fact that the report was generated by a UK surgical nurse on the day of the event, the probability that the report was prepared by someone "not involved in, nor having actual knowledge of the underlying treatment is very low.” [6] Traditionally, "medical malpractice suits ... [were] considered to be the cornerstone mechanism of regulating patient safety in the United States.” Levy, et. al., The Patient Safety and Quality Improvement Act of 2005 Preventing Error and Promoting Patient Safety, 31 J. Legal Med. at 400. "One defect [of this litigation, however,] is that [it] only addresses negligent care that actually [causes] damage.” Id. "Beyond medical malpractice, medical peer review is the other main institutional process that deals with patient safety. Medical peer review is a mechanism in which a committee, composed of medical professionals, evaluates the appropriateness of care or determines the adequacy of practitioners’ credentials. The Joint Commission (formerly the Joint Commission on Accreditation of Healthcare Organizations, or JCAHQ), the Medicare program, and all states require a peer review process for providers.” Id. at 400-01 (footnotes omitted). "Through its accreditation activities, The Joint Commission promotes patient safety by requiring member organizations to report serious adverse patient health events and performing root cause analysis on those events.” Id. at 406. "However, such serious events are a very small proportion of patient care errors. There [were no] mechanisms for evaluating 'near misses’ that [did] not result in serious harm.” Id. [7] The Act empowers the Secretary of Health and Human Services to commence enforcement proceedings against anyone (including any healthcare provider) who knowingly or recklessly discloses identifiable patient safety work product in violation of the confidentiality provision. 42 U.S.C.A. § 299b-22(f); 42 C.F.R. §§ 3.402-3.552. Violations of the confidentiality provision are punishable by civil monetary penalties of up to $ 11,000 per violation. Id. [8] Francis, 2011 WL 2224509, at *6 ("The quality assurance review documents at issue in this action are not protected under the PSQIA, since they were not provided to a PSO.”). [9] Appellees agree with this point, but nevertheless assert that incident reports are not privileged under the Act. Their position is consistent with paragraph one of the trial court's order, which states "[t]he Court holds that the incident report is not ‘patient safety work product' because it is exempted from the definition of ‘patient safety work product' by the ‘clarification’ contained in § 299-21(7)(B) of the Act.” [10] Occurrence or incident reports are "to be used by employees in the ordinary course of business when significant events occur to document their experience and observations for subsequent review by the hospital’s risk management staff in assessing legal liability issues.” Univ. Med. Ctr., Inc. v. Beglin, 375 S.W.3d 783, 787 (Ky.2011). As such, it is not a patient record, but, rather, a hospital record. 902 KAR 20:016 § 3(3)(a). [11] Reports of adverse patient health events are also required to maintain a hospital’s accreditation with the Joint Commission. Levy, et al., The Patient Safety and Quality Improvement Act of2005 Preventing Error and Promoting Patient Safety, 31 J. Legal Med. at 406. We note, however, that 42 U.S.C.A. 299b-22(c)(2)(E) waives confidentiality regarding disclosure to an "accrediting body that accredits that provider.” We find no countervailing waiver to a state regulatory body. [12] The UK Healthcare Incident Reporting Committee is designated as a component of the UK Healthcare PSES, as is most of UK HealthCare’s staff, departments, and committees, including the Senior Administration Group and Senior Operations Group. UK Healthcare Policy and Procedure, Policy # A06-035, Patient Safety Evaluation System, p. 3. [13] UHC is an alliance of 116 academic medical centers and 260 of their affiliated hospitals, representing almost 90% of the nation’s non-profit academic medical centers, including the University of Louisville Hospital. [14] Given the documents at issue and the circumstances involved, the PSQIA was not applicable. K.D., 715 F.Supp.2d at 596 ("Whether or not the NIH review bodies at issue here meet the technical requirements for listing as PSOs, they clearly perform the same functions Congress intended the PSQIA to encourage.”). [15] Pharmacies are not required to file incident reports with the Illinois Department, as sections 8-2101 to 8-2105 of the Illinois Code of Civil Procedure (Code) pertaining to medical studies (the Medical Studies Act) (735 ILCS 5/8-2101 to 8-2105 (West 2010)) do not apply to pharmacies. See Walgreen, 361 Ill. Dec. 186, 970 N.E.2d at 559 ("Because pharmacies are not listed in the pertinent section of the Medical Studies Act ..., the circuit court improperly determined that the statute applied to [Walgreen].”) In Kentucky, there is no administrative regulation that requires the direct reporting of incidents to the Kentucky Board of Pharmacists, however, pharmacies are to keep patient and quality assurance records available shall the Board request such records. See 201 KAR 2:170; 201 KAR 2:205. [16] Florida’s Constitution defines "adverse medical incident,” to wit: The phrase “adverse medical incident” means medical negligence, intentional misconduct, and any other act, neglect, or default of a health care facility or health care provider that caused or could have caused injury to or death of a patient, including, but not limited to, those incidents that are required by state or federal law to be reported to any governmental agency or body, and incidents that are reported to or reviewed by any health care facility peer review, risk management, quality assurance, credentials, or similar committee, or any representative of any such committees. Fla. Const, art. X, § 25(c)(3). [17] "A Code 15 report is a report that a health care facility must file with Florida's Agency for Health Care Administration within fifteen calendar days after the occurrence of an "adverse incident” as defined in [Fla. Stat. Ann.] section 395.0197(7).” W. Florida Reg’l Med. Ctr., 79 So.3d at 7. More importantly, however, W. Florida Reg’l Med. Ctr. did not limit discovery to only incidents documented in “code 15” and annual reports. Id. at 15 ("More specifically, [Fla. Const, art. X, § 25] provides that patients shall have access to records of adverse incidents, including those records 'reported to or reviewed by any health care facility ... “risk management" committee.”) (emphasis added). [18] The dissent acknowledges this point, but would nevertheless grant protection for the incident report information until such time as the healthcare organization is forced to disgorge the material in other litigation in some other form.