What does “Patient safety organization” mean?
Short answer
A patient safety organization (PSO) is a group HHS lists to collect and study safety data. Data sent to it can be legally protected.
Also known as: PSO
What a PSO is
42 CFR 3.20 defines a PSO as a private or public group, or part of one, that the HHS Secretary lists as a PSO. A health insurance issuer cannot be a PSO.
Patient safety work product means data, reports, notes and analyses, such as root cause analyses, that could improve patient safety. They must be made to send to a PSO and then sent, or made by a PSO for safety work.
What is protected
Under 42 CFR 3.204, patient safety work product is privileged, which means legally protected. It is not open to subpoena, discovery, Freedom of Information Act requests, or use as evidence in the listed cases. The exceptions are:
- Some criminal cases
- Equitable relief
- Provider consent
- Data that cannot identify anyone
Limits: it leaves out the patient's medical record, billing and discharge data and other original records. Copying data to a PSO does not protect it. Duties to report to authorities still apply.
Mix-up: sending an event report to a PSO does not replace required reports to the state or CMS.
Frequently asked questions
Does reporting to a PSO satisfy state reporting requirements?
No. Required reports still go where the law sends them, because data that is not patient safety work product can still go to government agencies.
Is a root cause analysis privileged if we send it to a PSO?
It can be, if it was made for the PSO and sent, or sits in your patient safety evaluation system. The rule lists RCAs as an example.
Is a PSO a business associate?
Generally, yes, if it handles protected health information for a provider. HIPAA's business associate definition includes patient safety work (42 CFR 3.20).
Sources
- 42 CFR 3.20: Patient safety organization definitions
- 42 CFR 3.204: Privilege of patient safety work product
- 45 CFR 160.103: HIPAA definitions (protected health information, business associate)
- AHRQ PSNet: Patient safety event reporting (primer)
Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.
Put the definition to work.
IncidentKit turns these terms into workflow: reports, investigations, corrective actions and packets.