Internal risk management program.

(1) Every licensed facility shall, as a part of its administrative functions, establish an internal risk management program that includes all of the following components:

(a) The investigation and analysis of the frequency and causes of general categories and specific types of adverse incidents to patients.

(b) The development of appropriate measures to minimize the risk of adverse incidents to patients, including, but not limited to:

1. Risk management and risk prevention education and training of all nonphysician personnel as follows:

a. Such education and training of all nonphysician personnel as part of their initial orientation; and

b. At least 1 hour of such education and training annually for all personnel of the licensed facility working in clinical areas and providing patient care, except those persons licensed as health care practitioners who are required to complete continuing education coursework pursuant to chapter 456 or the respective practice act.

2. A prohibition, except when emergency circumstances require otherwise, against a staff member of the licensed facility attending a patient in the recovery room, unless the staff member is authorized to attend the patient in the recovery room and is in the company of at least one other person. However, a licensed facility is exempt from the two-person requirement if it has:

a. Live visual observation;

b. Electronic observation; or

c. Any other reasonable measure taken to ensure patient protection and privacy.

3. A prohibition against an unlicensed person from assisting or participating in any surgical procedure unless the facility has authorized the person to do so following a competency assessment, and such assistance or participation is done under the direct and immediate supervision of a licensed physician and is not otherwise an activity that may only be performed by a licensed health care practitioner.

4. Development, implementation, and ongoing evaluation of procedures, protocols, and systems to accurately identify patients, planned procedures, and the correct site of the planned procedure so as to minimize the performance of a surgical procedure on the wrong patient, a wrong surgical procedure, a wrong-site surgical procedure, or a surgical procedure otherwise unrelated to the patient’s diagnosis or medical condition.

(c) The analysis of patient grievances that relate to patient care and the quality of medical services.

(d) A system for informing a patient or an individual identified pursuant to s. 765.401(1) that the patient was the subject of an adverse incident, as defined in subsection (5). Such notice shall be given by an appropriately trained person designated by the licensed facility as soon as practicable to allow the patient an opportunity to minimize damage or injury.

(e) The development and implementation of an incident reporting system based upon the affirmative duty of all health care providers and all agents and employees of the licensed health care facility to report adverse incidents to the risk manager, or to his or her designee, within 3 business days after their occurrence.

(2) The internal risk management program is the responsibility of the governing board of the health care facility. Each licensed facility shall hire a risk manager who is responsible for implementation and oversight of the facility’s internal risk management program and who demonstrates competence, through education or experience, in all of the following areas:

(a) Applicable standards of health care risk management.

(b) Applicable federal, state, and local health and safety laws and rules.

(c) General risk management administration.

(d) Patient care.

(e) Medical care.

(f) Personal and social care.

(g) Accident prevention.

(h) Departmental organization and management.

(i) Community interrelationships.

(j) Medical terminology.

(3) In addition to the programs mandated by this section, other innovative approaches intended to reduce the frequency and severity of medical malpractice and patient injury claims shall be encouraged and their implementation and operation facilitated. Such additional approaches may include extending internal risk management programs to health care providers’ offices and the assuming of provider liability by a licensed health care facility for acts or omissions occurring within the licensed facility. Each licensed facility shall annually report to the agency and the Department of Health the name and judgments entered against each health care practitioner for which it assumes liability. The agency and Department of Health, in their respective annual reports, shall include statistics that report the number of licensed facilities that assume such liability and the number of health care practitioners, by profession, for whom they assume liability.

(4) The agency shall adopt rules governing the establishment of internal risk management programs to meet the needs of individual licensed facilities. Each internal risk management program shall include the use of incident reports to be filed with an individual of responsibility who is competent in risk management techniques in the employ of each licensed facility, such as an insurance coordinator, or who is retained by the licensed facility as a consultant. The individual responsible for the risk management program shall have free access to all medical records of the licensed facility. The incident reports are part of the workpapers of the attorney defending the licensed facility in litigation relating to the licensed facility and are subject to discovery, but are not admissible as evidence in court. A person filing an incident report is not subject to civil suit by virtue of such incident report. As a part of each internal risk management program, the incident reports shall be used to develop categories of incidents which identify problem areas. Once identified, procedures shall be adjusted to correct the problem areas.

(5) For purposes of reporting to the agency pursuant to this section, the term “adverse incident” means an event over which health care personnel could exercise control and which is associated in whole or in part with medical intervention, rather than the condition for which such intervention occurred, and which:

(a) Results in one of the following injuries:

1. Death;

2. Brain or spinal damage;

3. Permanent disfigurement;

4. Fracture or dislocation of bones or joints;

5. A resulting limitation of neurological, physical, or sensory function which continues after discharge from the facility;

6. Any condition that required specialized medical attention or surgical intervention resulting from nonemergency medical intervention, other than an emergency medical condition, to which the patient has not given his or her informed consent; or

7. Any condition that required the transfer of the patient, within or outside the facility, to a unit providing a more acute level of care due to the adverse incident, rather than the patient’s condition prior to the adverse incident;

(b) Was the performance of a surgical procedure on the wrong patient, a wrong surgical procedure, a wrong-site surgical procedure, or a surgical procedure otherwise unrelated to the patient’s diagnosis or medical condition;

(c) Required the surgical repair of damage resulting to a patient from a planned surgical procedure, where the damage was not a recognized specific risk, as disclosed to the patient and documented through the informed-consent process; or

(d) Was a procedure to remove unplanned foreign objects remaining from a surgical procedure.

(6)(a) Each licensed facility subject to this section shall submit an annual report to the agency summarizing the incident reports that have been filed in the facility for that year. The report shall include:

1. The total number of adverse incidents.

2. A listing, by category, of the types of operations, diagnostic or treatment procedures, or other actions causing the injuries, and the number of incidents occurring within each category.

3. A listing, by category, of the types of injuries caused and the number of incidents occurring within each category.

4. A code number using the health care professional’s licensure number and a separate code number identifying all other individuals directly involved in adverse incidents to patients, the relationship of the individual to the licensed facility, and the number of incidents in which each individual has been directly involved. Each licensed facility shall maintain names of the health care professionals and individuals identified by code numbers for purposes of this section.

5. A description of all malpractice claims filed against the licensed facility, including the total number of pending and closed claims and the nature of the incident which led to, the persons involved in, and the status and disposition of each claim. Each report shall update status and disposition for all prior reports.

(b) The information reported to the agency pursuant to paragraph (a) which relates to persons licensed under chapter 458, chapter 459, chapter 461, or chapter 466 shall be reviewed by the agency. The agency shall determine whether any of the incidents potentially involved conduct by a health care professional who is subject to disciplinary action, in which case the provisions of s. 456.073 shall apply.

(c) The report submitted to the agency must also contain the name of the risk manager of the licensed facility, a copy of its policy and procedures which govern the measures taken by the facility and its risk manager to reduce the risk of injuries and adverse incidents, and the results of such measures. The annual report is confidential and is not available to the public pursuant to s. 119.07(1) or any other law providing access to public records. The annual report is not discoverable or admissible in any civil or administrative action, except in disciplinary proceedings by the agency or the appropriate regulatory board. The annual report is not available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or the appropriate regulatory board. However, the agency or the appropriate regulatory board shall make available, upon written request by a health care professional against whom probable cause has been found, any such records which form the basis of the determination of probable cause.

(7) Any of the following adverse incidents, whether occurring in the licensed facility or arising from health care prior to admission in the licensed facility, shall be reported by the facility to the agency within 15 calendar days after its occurrence:

(a) The death of a patient;

(b) Brain or spinal damage to a patient;

(c) The performance of a surgical procedure on the wrong patient;

(d) The performance of a wrong-site surgical procedure;

(e) The performance of a wrong surgical procedure;

(f) The performance of a surgical procedure that is medically unnecessary or otherwise unrelated to the patient’s diagnosis or medical condition;

(g) The surgical repair of damage resulting to a patient from a planned surgical procedure, where the damage is not a recognized specific risk, as disclosed to the patient and documented through the informed-consent process; or

(h) The performance of procedures to remove unplanned foreign objects remaining from a surgical procedure.

The agency may grant extensions to this reporting requirement for more than 15 days upon justification submitted in writing by the facility administrator to the agency. The agency may require an additional, final report. These reports shall not be available to the public pursuant to s. 119.07(1) or any other law providing access to public records, nor be discoverable or admissible in any civil or administrative action, except in disciplinary proceedings by the agency or the appropriate regulatory board, nor shall they be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or the appropriate regulatory board. However, the agency or the appropriate regulatory board shall make available, upon written request by a health care professional against whom probable cause has been found, any such records which form the basis of the determination of probable cause. The agency may investigate, as it deems appropriate, any such incident and prescribe measures that must or may be taken in response to the incident. The agency shall review each incident and determine whether it potentially involved conduct by the health care professional who is subject to disciplinary action, in which case the provisions of s. 456.073 shall apply.

(8) The agency shall publish on the agency’s website, no less than quarterly, a summary and trend analysis of adverse incident reports received pursuant to this section, which shall not include information that would identify the patient, the reporting facility, or the health care practitioners involved. The agency shall publish on the agency’s website an annual summary and trend analysis of all adverse incident reports and malpractice claims information provided by facilities in their annual reports, which shall not include information that would identify the patient, the reporting facility, or the practitioners involved. The purpose of the publication of the summary and trend analysis is to promote the rapid dissemination of information relating to adverse incidents and malpractice claims to assist in avoidance of similar incidents and reduce morbidity and mortality.

(9) The internal risk manager of each licensed facility shall:

(a) Investigate every allegation of sexual misconduct which is made against a member of the facility’s personnel who has direct patient contact, when the allegation is that the sexual misconduct occurred at the facility or on the grounds of the facility.

(b) Report every allegation of sexual misconduct to the administrator of the licensed facility.

(c) Notify the family or guardian of the victim, if a minor, that an allegation of sexual misconduct has been made and that an investigation is being conducted.

(d) Report to the Department of Health every allegation of sexual misconduct, as defined in chapter 456 and the respective practice act, by a licensed health care practitioner that involves a patient.

(10) Any witness who witnessed or who possesses actual knowledge of the act that is the basis of an allegation of sexual abuse shall:

(a) Notify the local police; and

(b) Notify the hospital risk manager and the administrator.

For purposes of this subsection, “sexual abuse” means acts of a sexual nature committed for the sexual gratification of anyone upon, or in the presence of, a vulnerable adult, without the vulnerable adult’s informed consent, or a minor. “Sexual abuse” includes, but is not limited to, the acts defined in s. 794.011(1)(j), fondling, exposure of a vulnerable adult’s or minor’s sexual organs, or the use of the vulnerable adult or minor to solicit for or engage in prostitution or sexual performance. “Sexual abuse” does not include any act intended for a valid medical purpose or any act which may reasonably be construed to be a normal caregiving action.

(11) A person who, with malice or with intent to discredit or harm a licensed facility or any person, makes a false allegation of sexual misconduct against a member of a licensed facility’s personnel is guilty of a misdemeanor of the second degree, punishable as provided in s. 775.082 or s. 775.083.

(12) In addition to any penalty imposed pursuant to this section or part II of chapter 408, the agency shall require a written plan of correction from the facility. For a single incident or series of isolated incidents that are nonwillful violations of the reporting requirements of this section or part II of chapter 408, the agency shall first seek to obtain corrective action by the facility. If the correction is not demonstrated within the timeframe established by the agency or if there is a pattern of nonwillful violations of this section or part II of chapter 408, the agency may impose an administrative fine, not to exceed $5,000 for any violation of the reporting requirements of this section or part II of chapter 408. The administrative fine for repeated nonwillful violations may not exceed $10,000 for any violation. The administrative fine for each intentional and willful violation may not exceed $25,000 per violation, per day. The fine for an intentional and willful violation of this section or part II of chapter 408 may not exceed $250,000. In determining the amount of fine to be levied, the agency shall be guided by s. 395.1065(2)(b).

(13) The agency shall have access to all licensed facility records necessary to carry out the provisions of this section. The records obtained by the agency under subsection (6), subsection (7), or subsection (9) are not available to the public under s. 119.07(1), nor shall they be discoverable or admissible in any civil or administrative action, except in disciplinary proceedings by the agency or the appropriate regulatory board, nor shall records obtained pursuant to s. 456.071 be available to the public as part of the record of investigation for and prosecution in disciplinary proceedings made available to the public by the agency or the appropriate regulatory board. However, the agency or the appropriate regulatory board shall make available, upon written request by a health care professional against whom probable cause has been found, any such records which form the basis of the determination of probable cause, except that, with respect to medical review committee records, s. 766.101 controls.

(14) The meetings of the committees and governing board of a licensed facility held solely for the purpose of achieving the objectives of risk management as provided by this section shall not be open to the public under the provisions of chapter 286. The records of such meetings are confidential and exempt from s. 119.07(1), except as provided in subsection (13).

(15) The agency shall review, as part of its licensure inspection process, the internal risk management program at each licensed facility regulated by this section to determine whether the program meets standards established in statutes and rules, whether the program is being conducted in a manner designed to reduce adverse incidents, and whether the program is appropriately reporting incidents under this section.

(16) There shall be no monetary liability on the part of, and no cause of action for damages shall arise against, any risk manager for the implementation and oversight of the internal risk management program in a facility licensed under this chapter or chapter 390 as required by this section, for any act or proceeding undertaken or performed within the scope of the functions of such internal risk management program if the risk manager acts without intentional fraud.

(17) A privilege against civil liability is hereby granted to any risk manager or licensed facility with regard to information furnished pursuant to this chapter, unless the risk manager or facility acted in bad faith or with malice in providing such information.

(18) If the agency, through its receipt of any reports required under this section or through any investigation, has a reasonable belief that conduct by a staff member or employee of a licensed facility is grounds for disciplinary action by the appropriate regulatory board, the agency shall report this fact to such regulatory board.

(19) It shall be unlawful for any person to coerce, intimidate, or preclude a risk manager from lawfully executing his or her reporting obligations pursuant to this chapter. Such unlawful action shall be subject to civil monetary penalties not to exceed $10,000 per violation.