NPRQI collaborates with the Center for Patient Safety (CPS), a federally designated Patient Safety Organization (PSO), to ensure the protection and confidentiality of patient safety data. CPS works alongside NPRQI, its administrative home at the University of Texas, and its technology platform, Clario, to ensure that each participating organization understands and complies with the Patient Safety Act, which provides oversight and safeguards data.
PSOs create a secure, non-punitive environment for providers to collaborate, ensuring that safety data cannot be used against them.
NPRQI’s data platform, powered by Clario, an industry leader in clinical trial technology, offers a robust and secure infrastructure for managing and analyzing data.
How we ensure security and confidentiality
Site confidentiality and HIPPA compliance
NPRQI meets HIPAA standards for patient data and operates under the Patient Safety Quality Improvement Act (PSQIA), ensuring limited Protected Health Information (PHI) is collected, including only the date and time of visits. The work is also exempt from Institutional Review Board (IRB) oversight.
Encryption
All communication for data in transit is encrypted, and data at rest is secured with storage volume encryption in the datacenter. Encryption levels follow industry standards, and strong encryption key management practices are applied to protect sensitive information throughout its lifecycle.
Secure login credentials
Each site/user receives secure, password-protected login credentials, with password policies adhering to best practices, including expiration every 90 days. Authentication is managed through Active Directory Federation Service (ADFS), ensuring that only authorized users can perform key operations.
Access
EDs have full access to their raw data and performance dashboards, with security protocols ensuring data is displayed only after meeting minimum record thresholds. Access is permission-based, allowing networks, healthcare systems, and state-level partners to view specific data when authorized. Upon registration, users are assigned access levels to ensure appropriate data visibility.
Recovery and backup
We regularly test disaster recovery, backup, and restoration protocols while continuously monitoring systems for performance, availability, and disruptions.