2.1.1. AHRQ's Confidentiality Statute

All identifiable research data obtained by the Agency for Health Research and Quality (AHRQ) is protected by the agency's confidentiality statute.¹⁹ The statute requires that data collected by AHRQ-sponsored entities that identify individuals or establishments be used only for the purposes for which the data are supplied. Any effort to determine the identity of a person in an AHRQ database, or to use the information for any purpose other than for research, analysis, and aggregate statistical reporting, violates the AHRQ confidentiality statute. Recipients of a data set are also prohibited from releasing, disclosing, publishing, or presenting any individually identifying information. Specifically, the statute provides:

No information, if an establishment or person supplying the information or described in it is identifiable, obtained in the course of activities undertaken or supported under this subchapter may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented (as determined under regulations of the Director) to its use for such other purpose. Such information may not be published or released in other form if the person who supplied the information or who is described in it is identifiable unless such person has consented (as determined under regulations of the Director) to its publication or release in other form.¹⁹

Concerns have been raised that this protection may be vulnerable if the information is disclosed to an outside entity such as a registry. However, AHRQ has interpreted this provision to protect all AHRQ-funded research from discovery requests, including discovery requests in the course of litigation. A memorandum from senior AHRQ attorney Susan Merewitz noted that “if individuals inside a health care institution are gathering identifiable medical error information as part of AHRQ-supported grant or contract research, and it is conveyed outside the institution (e.g., for analysis in an AHRQ-supported central databank), even if the reporters lost their protection against being subpoenaed to testify under State law, the Federal statute would cover and protect the identifiable information they acquired pursuant to AHRQ's statutory research authority.”²⁰ While this memorandum is not binding on any court of law and has yet to be introduced in a legal challenge, it clearly establishes AHRQ's protective position as it relates to any information collected under the auspices of an AHRQ-supported project. Registries participating in AHRQ-sponsored activities would certainly be able to avail themselves of this protection and, given Merewitz's comments, this protection may even extend to non-AHRQ activities in which an AHRQ-sponsored entity holds the data as a repository or intermediary.

Importantly, this protection is limited to AHRQ-sponsored registries. Therefore, registries maintained by professional associations or other organizations that are not sponsored by or otherwise participating in an AHRQ-sponsored project would not benefit from the protections the AHRQ confidentiality statute affords.

2.1.2. HHS Certificate of Confidentiality

The U.S. Department of Health and Human Services (HHS) may issue a “Certificate of Confidentiality” for any research project that collects personally identifiable, sensitive information and has been approved by an institutional review board. A Certificate protects an investigator, and others who have access to research records, from being required to disclose identifying information on research participants in any Federal or State judicial, administrative, or legislative proceeding. The Certificate may be used for biomedical, behavioral, clinical, or other types of research.

In the research arena, the National Institutes of Health (NIH) is the most common source for Certificates of Confidentiality. The NIH considers research to be sensitive if disclosing the information could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation. According to NIH, examples of studies that may be considered sensitive include those collecting genetic information; information on subjects' psychological well-being; information on sexually transmitted diseases or on subjects' sexual attitudes, preferences or practices; and information on substance abuse or other illegal conduct; as well as studies where subjects may be involved in litigation related to exposures under study (i.e., breast implants, environmental or occupational exposures).²¹

The specific statutory language provides that:

The Secretary [of the U.S. Department of Health and Human Services] may authorize persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals.²²

The application of Certificates of Confidentiality to registries has four inherent shortcomings.²³ First, the protections apply only to the identity of research subjects, or to data that would allow the possible identification of such individuals. Thus, de-identified patient safety data is still potentially discoverable. Second, there are questions as to whether a Certificate applies to patients who presumably have not consented to becoming research subjects. Third, individual patients may be able to waive the Certificate protections as to their own information, which they presumably would do if they were plaintiffs in a malpractice lawsuit. Fourth, the protections apply only to research information for which a Certificate of Confidentiality has been applied for and has been granted. Therefore, the protections afforded by a Certificate of Confidentiality are limited and do not provide meaningful opportunities for registries that are not engaged in research and that have not applied for and been granted a Certificate.

2.1.3. The Patient Safety and Quality Improvement Act of 2005

The Patient Safety and Quality Improvement Act of 2005 (PSQIA)²⁴ creates a Federal privilege from discovery in connection with Federal or State judicial or administrative proceedings for certain information identified as patient safety work product. To claim the privilege, providers must create the patient safety work product by collecting event information and reporting it to a formally recognized patient safety organization (PSO) for aggregation and analysis. The term “patient safety work product” encompasses any data, reports, records, memoranda, analyses, or written or oral statements that meet one of two criteria: (1) the materials “could improve patient safety, health care quality, or health care outcomes” and are gathered by a provider to be reported and are reported to a PSO or are developed by a PSO to conduct patient safety activities; or (2) the materials “identify or constitute the deliberations or analysis of, or fact of reporting to, a patient safety evaluation system.”

Materials not gathered to be reported to the PSO and not actually transmitted to a PSO would not qualify for a privilege. The privilege specifically does not apply to medical records, billing and discharge information, or other records kept outside of a patient safety evaluation system. Furthermore, providers must comply with any State laws that require reporting of patient safety information and may not use PSO activities to shield them from reporting. Thus, if a patient safety investigation references medical records, the records themselves do not become part of the work product eligible for protection.

Documents created, maintained, or developed separately from a patient safety evaluation system are excluded from the definition of patient safety work product. Thus, individual patient medical records, billing and discharge information, and any original patient or provider records are not considered work product and are thus not privileged. In addition, information collected to comply with external reporting requirements is not work product.

The preamble to the final regulations (44 FR 70,732) implementing the confidentiality protections of the PSQIA identifies several examples of information that must be reported and that does not merit protection as work product. These examples of required reportinginclude State incident reporting, adverse drug event information reporting, records for compliance with health oversight agency requirements, reporting physician disciplinary actions to the National Practitioner Data Bank, and disclosures required under Medicare's conditions of participation. Thus, a significant amount of data remains outside the patient safety work product definition. This includes registry data that is not maintained by a PSO and used for specific patient safety activities or is not identifiable. Therefore, the PSO statute and regulations provide no protection for registries acting outside the protected scope of the PSO arena.

2.1.4. Quality Improvement Organization Statute and Regulations

Quality Improvement Organizations (QIOs) are responsible for improving the effectiveness, efficiency, economy, and quality of services delivered to Medicare beneficiaries. The Centers for Medicare & Medicaid Services (CMS) contracts with one private, generally not-for-profit organization in every State, as well as the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, to serve as that jurisdiction's QIO. QIO employees, consisting primarily of doctors and other health care professionals, are instructed to review medical care and assist beneficiaries with quality of care issues and complaints, as well as to implement improvements to the quality of providers' care.

The QIO statute states that any data or information acquired by a QIO in its course of duties must be kept confidential and may not be disclosed to any person, except as the information assists Federal and State agencies responsible for investigating fraud, abuse, and risks to the public health, or assists appropriate State agencies and national accreditation bodies responsible for licensing or certifying providers or practitioners.²⁵

Furthermore, the statute explicitly states that “no patient record in the possession of” a QIO may be subject to subpoena or discovery proceedings in a civil action.²⁶ Additionally, no document or other information produced by a QIO in connection with its deliberations may be subject to subpoena or discovery in any administrative or civil proceeding. However, a QIO is required to provide, upon the request of a practitioner or other person adversely affected by such deliberations, a summary of the QIO's findings and conclusions.

Additionally, QIO regulations state that quality review study information with a patient identifier is not subject to subpoena or discovery in a civil action, including administrative, judicial, or arbitration proceedings.²⁷ This restriction, however, does not apply to HHS administrative subpoenas issued in the course of an audit or investigation of HHS programs, in the course of administrative hearings held under the Social Security Act, or to disclosures to the U.S. Government Accountability Office as necessary to carry out its statutory responsibilities.

Similar to the PSQIA, the QIO statute and regulations provide protection only to information that has been collected by a QIO under contract with CMS to perform specific statutory functions. To the extent a QIO is the owner and operator of a registry used to perform required functions, the information included in the registry would be protected. However, this does not apply to the vast majority of registries currently in existence today.

2.1.5. HIPAA Privacy Rule

The HIPAA Privacy Rule protects the privacy of individually identifiable health information.²⁸ The Privacy Rule applies to “covered entities,” which include health plans, health care clearinghouses, and health care providers who conduct certain electronic health care transactions. Some of the Privacy Rule's provisions also apply to business associates of covered entities (e.g., contractors performing specific functions on their behalf).²⁹ The purpose of the Rule is to protect “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. “Individually identifiable health information” is information, including demographic data, that relates to an individual's (1) past, present, or future physical or mental health condition; (2) receipt of health care; or (3) past, present, or future payment for health care. The information also must either directly identify the individual or be able to reasonably lead to identification of the individual. Common identifiers include an individual's name, address, birth date, and Social Security number.²⁹ The Privacy Rule refers to this information as “protected health information” (PHI).

The Privacy Rule permits the disclosure of PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal.³⁰ Absent a court order, a covered entity also may respond to a subpoena or discovery request from a party to the proceeding if the covered entity obtains either: (1) satisfactory assurances that reasonable efforts have been made to give the individual whose information has been requested notice of the request; or (2) satisfactory assurances that the party seeking such information has made reasonable efforts to secure a qualified protective order that will guard the confidentiality of the information.

In meeting the first test, a covered entity is considered to have received satisfactory assurances from the party seeking the information if the covered entity receives a written statement and documentation that the party has made a good-faith effort (such as by sending a notice to the individual's last known address) to provide written notice to the individual whose information is the subject of the request, that the written notice included sufficient information about the proceeding to permit the individual to raise an objection, and that the time for the individual to raise objections to the court or administrative tribunal has elapsed and no objections were filed, or any objections the individual filed have been resolved.

A “qualified protective order” means an order of a court or of an administrative tribunal or a stipulation that: (1) prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which the records are requested; and (2) requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. Satisfactory assurances of reasonable efforts to secure a qualified protective order are a statement and documentation that the parties to the dispute have agreed to a protective order and that it has been submitted to the court or administrative tribunal with jurisdiction, or that the party seeking the protected health information has requested a qualified protective order from such court or tribunal.

Importantly, the protections of the HIPAA Privacy Rule will apply only if a registry is considered a covered entity or the business associate of a covered entity. A registry may be considered a covered entity if the registry is maintained and administered by a HIPAA-covered health care provider. More commonly, the registry will be acting as the business associate of a covered entity (e.g., collecting and processing PHI on behalf of provider(s) and/or health plan(s)). Even if the registry is considered a covered entity or business associate, the HIPAA requirements that apply to disclosures pursuant to a court order, subpoena, or discovery request only apply to PHI. To the extent the requested information does not include PHI (e.g., the information is considered to be de-identified according to the requirements of the Privacy Rule and thus does not contain identifiable health information about individuals), HIPAA does not protect information about providers, manufacturers, or any other entities. Therefore, in the case of providers, manufacturers, and health plans seeking protection for information specific to them or their products but not part of PHI, HIPAA does not shield them from discovery requests in litigation or any other court proceedings.

2.1.6. Privacy Act of 1974

The Privacy Act of 1974³¹ protects information about individuals, such as patients and providers, held or collected by the Federal Government that can be retrieved by personal identifiers such as name, Social Security number, or other identifying number or symbol. The Privacy Act authorizes a Federal agency to release individually identifiable information to identified persons or to their designees with written consent or pursuant to 1 of 12 exemptions for disclosure. These exemptions include disclosure to Federal agency employees, the Census Bureau, the National Archives and Records Administration, other government entities for civil and criminal law enforcement purposes, the Comptroller General, Congress or its committees, and a consumer reporting agency.³² Additional exemptions include disclosures for statistical research, disclosures required by Freedom of Information Act, disclosures in response to emergency circumstances, and importantly for purposes of this chapter, disclosures pursuant to a court order.

Unless the Federal Government maintains the registry, the Privacy Act of 1974 offers no protection from discovery for litigation or related court proceedings. Furthermore, even if the Federal Government maintains the registry, the Privacy Act specifically allows for the release of identifiable information about individuals without their written consent pursuant to a court order. This could include information not only about individual patients, but also individual providers (e.g., individual practitioners).

2.1.7. Freedom of Information Act

Enacted by Congress in 1966, and expanded in 1996 to cover electronic records,³³ the U.S. Freedom of Information Act (FOIA)³⁴ generally provides that any person has the right to obtain access to information contained in the records of Federal agencies, unless FOIA specifically protects the information from disclosure. With a goal of ensuring an informed citizenry, capable of holding the government accountable, FOIA effectively establishes a statutory right of public access to executive branch information, requiring that virtually every record held by a Federal agency be provided to individuals upon request.³⁵ Information that is subject to FOIA is likely to be disclosable pursuant to a discovery request or other court proceeding. However, FOIA does have limited exemptions and exclusions to the broad disclosure requirements. The most relevant exemptions for purposes of protection of registry information—in order of their importance—are Exemptions 4, 6, and 3.

Exemption 4 protects “trade secrets and commercial or financial information obtained from a person and privileged or confidential.”³⁶ Importantly, however, it is not a mandatory bar to disclosure, but rather limits an agency's obligation to disclose specified information. “Trade secrets” are defined as commercially valuable plans or formulas for producing trade commodities to which has been invested substantial effort or innovation.³⁷ In the case of registries that contain information supplied by or about providers, medical device or pharmaceutical manufacturers, and health plans, it is likely that only the pharmaceutical and medical device manufacturers and health plans would have information that could be considered “trade secrets.” Furthermore, information that manufacturers contribute to a registry is more likely to be considered “commercial” or “financial.” For example, in Public Citizen Health Research Group v. Food & Drug Administration,³⁸ the court found that “because documentation of the health and safety experience of their products will be instrumental in gaining market approval for their products it seems clear that the manufacturers … have a commercial interest in the requested information.”³⁹

Exemption 6 states that Federal agencies can withhold from disclosure information about individuals in “personnel and medical files and similar files” when the disclosure of such information “would constitute a clearly unwarranted invasion of personal privacy.”⁴⁰ In order to warrant protection under Exemption 6, the information at issue must first meet the threshold requirement of falling into one of three categories—personnel files, medical files, and similar files. The Supreme Court found that Congress intended these categories to be interpreted broadly and to protect information that “applies to a particular individual.”⁴¹ Once it has been established that the information meets this threshold, the focus shifts to whether the disclosure of such information would be an unwarranted invasion of privacy. This requires balancing the public's right to disclosure of the information against the individual's right to privacy. After determining that a protectable privacy interest exists, the public's interest in disclosure of the information will be weighed against the individual's privacy interest in not disclosing the information.

The landmark Supreme Court decision in United States Department of Justice v. Reporters Committee for Freedom of the Press⁴² governs how privacy interests under Exemption 6 are determined and balanced with public interest in the information. First, the Court clarified that a substantial privacy interest may exist in information that has already been released to the public at some point. Second, the Court held that the identity of the individual or party requesting the information may not be taken into consideration when determining if information should be released and “has no bearing on the merits of his or her FOIA request.”⁴³ When considering the public interest in disclosing the information, the Court ruled that the determination should be based on the nature of the requested information and its relationship to the public interest generally, and not solely the purpose for which the request is made. Finally, the Court narrowed the scope of the public interest to the kind of interest to information that will “shed light on an agency's performance of its statutory duties.”⁴⁴

It is important to note, however, that Exemption 6 protects only information that identifies the individual in question. Thus, while patient records included in a registry are likely to be protected, if identifying information is removed, the information is no longer protected under Exemption 6. The most common types of information protected under Exemption 6 are age, home address, Social Security number, medical information about individuals participating in clinical research trials, claims files, and other personal information held by CMS.⁴⁵

Exemption 3 protects information if it is “specifically exempted from disclosure by statute, provided that such statute (A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.”⁴⁶ An example of a statute that may prevent disclosure or discovery of information contained in a registry under FOIA Exemption 3 would be the Patient Safety Quality Improvement Act of 2005 (discussed above), if the information met the PSQIA requirements.

2.1.8. Federal Trade Secrets Act

The Federal Trade Secrets Act⁴⁷ imposes fines or imprisonment on any Federal employee who discloses any information that relates to trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses or expenditures of any person or corporation. The Act applies only to public disclosures, and does not reach internal agency use of the data.

There is no private right of action under the statute; however, the Administrative Procedure Act may create a right of action to prevent a violation of the Trade Secrets Act or review a decision to disclose information.⁴⁸ Similar to Exemption 4 under FOIA, the Federal Trade Secrets Act may protect proprietary information, however, only to the extent that is held by the Federal Government and disclosed publicly (e.g., the Act may not reach information disclosed pursuant to a protection order as part of a discovery proceeding).

2.1.9. Federal Rules of Evidence and Civil Procedure

Federal legal rules of evidence and civil procedure may place limits on what information may be discoverable or otherwise used in a court proceeding. For example, Rule 401 of the Federal Rules of Evidence defines “relevant evidence” as evidence having any tendency to make the existence of any fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence.”⁴⁹ Rule 403 narrows the scope of Rule 401 stating “although relevant, evidence may be excluded if its probative value is substantially outweighed by the danger of unfair prejudice, confusion of the issues, or misleading the jury…”⁵⁰ Often of the most relevance to information contained in registries is the prohibition in Rule 404 against “evidence of other … acts … to prove the character of a person in order to show action in conformity therewith.”⁵¹ This may apply in instances where information is sought from a registry to show evidence of similar medical outcomes.

Turning to Civil Procedure, Rule 26(b)(2)(C)(iii) of the Federal Rules of Civil Procedure provides that a court may limit discovery if “the burden or expense of the proposed discovery outweighs its likely benefit, considering … the importance of the discovery in resolving the issues.”⁵² Rule 26(c) also allows parties from whom discovery is sought to move for a protective order.⁵³ Rule 45(c) protects individuals from unduly burdensome or expensive subpoenas. Specifically, 45(c) states, “a party or attorney responsible for issuing and serving a subpoena must take reasonable steps to avoid imposing undue burden or expense on a person subject to the subpoena. The issuing court must enforce this duty and impose an appropriate sanction—which may include lost earnings and reasonable attorney's fees—on a party or attorney who fails to comply.”⁵⁴ It is left to the discretion of the court in each case to determine whether the facts and circumstances merit quashing a specific subpoena.

While these Federal rules of evidence and civil procedure may offer protection against discovery of registry information in certain situations, their application is left entirely to the discretion of the particular court in which the case is heard. Thus, the case law is mixed, with some courts allowing discovery and others not, depending on their application of a balancing test of the need for confidentiality versus hardship to the party seeking discovery. For example, in Andrews v. Eli Lilly & Co., Inc., E.R. Squibb & Sons and Rexall Drug Company,⁵⁵ Squibb sought production of data from a University of Chicago registry that included information about a disease related to a products liability action against Squibb. The University of Chicago claimed that the contents of the registry were privileged and confidential. In balancing the privacy interests of the registry against the need for the information, the court stated, “the balance … tips in favor” of the registry.⁵⁶ “Squibb's need for the information is speculative and uncertain. Its essentially private interest in defending itself is outweighed by the compelling social interest in preventing harm to the Registry and the vital work it conducts.”⁵⁶ The court, however, did allow discovery of information contained in the registry related to the plaintiffs. Squibb appealed, and in Deitchman v. E.R. Squibb & Sons,⁵⁷ the appellate court noted that the privilege was not “absolute” and remanded the case back to the lower court to determine the best way to provide information from the registry while preserving confidentiality.⁵⁸ In a secondhand-smoke case, Wolpin v. Phillip Morris, Inc.,⁵⁹ the court ordered disclosure of data from a statewide tumor registry from a study by the University of South California and California Department of Health, despite objections that the data was protected by State and Federal privacy laws. The court held that the need for the information in the lawsuit outweighed the confidentiality interest, but did require patient names to be removed prior to release.

2.1.10. Patient Protection and Affordable Care Act: Release of Medicare Claims Data for Provider Performance Measurement and Reporting

Section 10332 of the Affordable Care Act requires the Secretary to make Medicare claims data available to qualified entities for the evaluation of provider performance on measures of quality, efficiency, effectiveness, and resource use.⁶⁰ The data are standardized extracts of claims data under Medicare Parts A, B, and D, for items and services furnished for one or more specified geographic areas and time periods requested by a qualified entity. The qualified entities will be required to pay a fee to obtain the data and must submit to the Secretary of HHS a description of the methodologies that will be used to evaluate the performance of providers and suppliers.

All subsequent reports a qualifying entity publishes must include an understandable description of the measures, risk adjustment methods, physician attribution methods, other applicable methods, data specifications and limitations, and the sponsors, so that consumers, providers of services and suppliers, health plans, researchers, and other stakeholders can assess such reports. In addition, the reports must be made available to any provider or supplier identified in the report, with an opportunity to appeal and correct any errors. Finally, the reports may include information on a provider or supplier only in an aggregate form as the Secretary determines appropriate.

The Secretary may not make claims data available to a qualified entity unless the entity agrees to release the information on the evaluation of performance of providers of services and suppliers. Section 10332 requires that data released to a qualified entity shall not be subject to discovery or admission as evidence in judicial or administrative proceedings without consent of the applicable provider or supplier.⁶¹

While limited in application to Medicare claims data provided to qualified entities, this provision is a significant recognition by Congress of concerns related to the “chilling effect” the fear of disclosure has on provider, supplier (including manufacturer), and health plan participation in quality measurement, improvement, and reporting programs. By shielding this information from discovery or admission as evidence without consent, Congress has explicitly protected and incentivized the activities of qualified entities, including the development of registries to support their performance measurement and reporting efforts.

2.2.1. State Surveillance Laws

To encourage practitioner participation in State surveillance registries, many States have passed legislation providing immunity from civil and criminal penalties that may arise in conjunction with such reports. Most States protect providers from any liability that may result from a disease report unless the provider acted with some level of negligence or malicious intent.⁶² Fewer States provide complete immunity for reporting disease cases to a registry, with no distinction made for negligent or intentionally malicious reports.⁶³ Additionally, other States provide immunity only for certain causes of action related to the information reported, or protect from civil liability only.⁶⁴ However, case law implicating such State harbors is sparse, with most cases affording immunity for health care professionals who report sexually transmitted diseases discovered in minors in potential child abuse cases.⁶⁵

2.2.2. State Peer Review and Quality Assurance Laws

Presently, all 50 States have enacted statutes to protect the confidentiality of the peer review process. Most statutes offer a blanket protection for all accounts, records, and conclusions of the review process from being introduced into evidence during any court proceeding.⁶⁶ Without such protection, providers and hospitals may be less inclined to truthfully monitor their peers, evaluate the quality of care that is provided to patients, or adequately prevent or correct for adverse events.

A few States also have passed legislation specifically protecting information collected for quality improvement and other related purposes. These “safe harbor” laws protect a broader set of information beyond the traditional peer review process, including collection by organizations outside the scope of an internal peer review board or committee. For example, in Minnesota, information relating to patient care a nonprofit organization collects for purposes of “evaluating and improving the quality of health care” or “reviewing the safety, quality or cost of health care services” provided to health plan enrollees “shall not be disclosed to anyone … and shall not be subject to subpoena or discovery.”⁶⁷ The Virginia Patient Safety Act protects the collection of patient safety data by “statewide or local associations” representing licensed health care providers. It treats the information collected as “privileged communications which may not be disclosed or obtained by legal discovery proceedings unless a circuit court, after a hearing and for good cause arising from extraordinary circumstances being shown, orders the disclosure of such proceedings, minutes, records, reports, or communications.”⁶⁸ Similarly, the Illinois Medical Studies Act protects all information “used in the course of internal quality control or of medical study for the purpose of reducing morbidity or mortality, or for improving patient care or increasing organ and tissue donation.” Such information is “privileged, strictly confidential, and shall be used only for medical research, increasing organ and tissue donation, [or] the evaluation and improvement of quality care.”⁶⁹ It is not “admissible as evidence, nor discoverable in any action of any kind in any court or before any tribunal, board, agency or person.”⁶⁹

However, it is important to note that the peer review privilege and other State-based protections are often not recognized in Federal cases outside the jurisdiction of State law. Federal courts have been resistant to the establishment of a Federal peer review or other privilege, and often subordinate the State peer review privileges in favor of other interests. For instance, the 11th Circuit Court of Appeals recently declined to recognize such a privilege during a Federal civil rights discrimination case, ordering the discovery of peer review documents.⁷⁰ Similar outcomes have been reached in many other Federal courts, including cases deciding Federal antitrust⁷¹ and wrongful termination claims.⁷²