An organization, in carrying out its functions under a contract entered into under this part, shall not be a Federal agency for purposes of the provisions of section 552 of title 5 (commonly referred to as the Freedom of Information Act). Any data or information acquired by any such organization in the exercise of its duties and functions shall be held in confidence and shall not be disclosed to any person except—

(1) to the extent that may be necessary to carry out the purposes of this part,

(2) in such cases and under such circumstances as the Secretary shall by regulations provide to assure adequate protection of the rights and interests of patients, health care practitioners, or providers of health care, or

(3) in accordance with subsection (b).

An organization having a contract with the Secretary under this part shall provide in accordance with procedures and safeguards established by the Secretary, data and information—

which may identify specific providers or practitioners as may be necessary—

(A) to assist Federal and State agencies recognized by the Secretary as having responsibility for identifying and investigating cases or patterns of fraud or abuse, which data and information shall be provided by the quality improvement organization to any such agency at the request of such agency relating to a specific case or pattern;

(B) to assist appropriate Federal and State agencies recognized by the Secretary as having responsibility for identifying cases or patterns involving risks to the public health, which data and information shall be provided by the quality improvement organization to any such agency— (i) at the discretion of the quality improvement organization, at the request of such agency relating to a specific case or pattern with respect to which such agency has made a finding, or has a reasonable belief, that there may be a substantial risk to the public health, or (ii) upon a finding by, or the reasonable belief of, the quality improvement organization that there may be a substantial risk to the public health;

(C) to assist appropriate State agencies recognized by the Secretary as having responsibility for licensing or certification of providers or practitioners or to assist national accreditation bodies acting pursuant to section 1395bb of this title in accrediting providers for purposes of meeting the conditions described in subchapter XVIII, which data and information shall be provided by the quality improvement organization to any such agency or body at the request of such agency or body relating to a specific case or to a possible pattern of substandard care, but only to the extent that such data and information are required by the agency or body to carry out its respective function which is within the jurisdiction of the agency or body under State law or under section 1395bb of this title; and

(D) to provide notice in accordance with section 1320c–3(a)(9)(B) of this title;

(2) to assist the Secretary, and such Federal and State agencies recognized by the Secretary as having health planning or related responsibilities under Federal or State law (including health systems agencies and State health planning and development agencies), in carrying out appropriate health care planning and related activities, which data and information shall be provided in such format and manner as may be prescribed by the Secretary or agreed upon by the responsible Federal and State agencies and such organization, and shall be in the form of aggregate statistical data (without explicitly identifying any individual) on a geographic, institutional, or other basis reflecting the volume and frequency of services furnished, as well as the demographic characteristics of the population subject to review by such organization.

It shall be unlawful for any person to disclose any such information described in subsection (a) other than for the purposes provided in subsections (a) and (b), and any person violating the provisions of this section shall, upon conviction, be fined not more than $1,000, and imprisoned for not more than 6 months, or both, and shall be required to pay the costs of prosecution.

No patient record in the possession of an organization having a contract with the Secretary under this part shall be subject to subpoena or discovery proceedings in a civil action. No document or other information produced by such an organization in connection with its deliberations in making determinations under section 1320c–3(a)(1)(B) or 1320c–5(a)(2) of this title shall be subject to subpoena or discovery in any administrative or civil proceeding; except that such an organization shall provide, upon request of a practitioner or other person adversely affected by such a determination, a summary of the organization’s findings and conclusions in making the determination.

For purposes of this section and section 1320c–6 of this title, the term “organization with a contract with the Secretary under this part” includes an entity with a contract with the Secretary under section 1320c–3(a)(4)(C) [1] of this title.

(Aug. 14, 1935, ch. 531, title XI, § 1160, as added Pub. L. 97–248, title I, § 143, Sept. 3, 1982, 96 Stat. 391; amended Pub. L. 99–509, title IX, § 9353(d)(1), Oct. 21, 1986, 100 Stat. 2047; Pub. L. 100–203, title IV, § 4039(h)(6), Dec. 22, 1987, as added Pub. L. 100–360, title IV, § 411(e)(3), July 1, 1988, 102 Stat. 776; Pub. L. 101–508, title IV, § 4205(d)(1)(B), (e)(1), Nov. 5, 1990, 104 Stat. 1388–113, 1388–114; Pub. L. 103–432, title I, § 156(b)(2)(B), (4), Oct. 31, 1994, 108 Stat. 4441; Pub. L. 112–40, title II, § 261(a)(2)(C), Oct. 21, 2011, 125 Stat. 423.)