No single US law tells every provider how to analyze an adverse event. Instead, several overlapping requirements push organizations toward structured analysis: accreditation, federal Conditions of Participation, state adverse event laws, VA policy for federal facilities, and the Patient Safety Act's protections. Knowing which ones apply to your setting tells you what a review must produce and how its documents are protected.

Goals for this lesson

Summarize what an accredited organization owes The Joint Commission after a sentinel event.
Explain how CMS hospital rules and state reporting laws create a need for event analysis.
Identify the legal protections that may apply to analysis documents.

Accreditation: the comprehensive systematic analysis

Under its Sentinel Event Policy, The Joint Commission looks for a comprehensive systematic analysis and a corrective action plan, due 45 business days after the event occurs or after the organization learns of it. In the policy's terms, a sentinel event reaches the patient, is not chiefly explained by the natural course of the illness or underlying condition, and ends in death, permanent harm or severe harm. Most organizations meet the requirement with a root cause analysis. Surveyors look for work that is thorough and credible: it examines systems and processes rather than one person's performance, keeps going past the first plausible answer, and ends with named vulnerabilities and changes that lower risk. The Joint Commission's Framework for Root Cause Analysis and Corrective Actions gives organizations a ready-made structure if they want one. The policy is revised from time to time, so confirm the version that applies to your accreditation program.

Other accreditors and certification bodies have their own expectations, and organizations accredited by them often adopt RCA² anyway because it satisfies most requirements in one method.

Federal Conditions of Participation

Under the hospital Conditions of Participation, 42 CFR 482.21 obliges every Medicare-participating hospital to maintain a quality assessment and performance improvement (QAPI) program. That program has to track adverse patient events, work out why they happened and put preventive actions in place. The regulation names no particular method; an RCA² program is simply a convenient way to demonstrate that causes are examined and acted on. Nursing homes, home health agencies and other provider types carry QAPI duties of their own.

State adverse event laws

Many states run mandatory adverse event reporting systems for hospitals and other facilities, often built on the National Quality Forum's Serious Reportable Events. Some require an analysis and corrective action plan to be filed after the initial report, with their own deadlines and formats; state health departments in some states, such as Minnesota, publish root cause analysis toolkits to support facilities. Your organization's patient safety officer will know which state rules apply. This course does not list them, because they differ and change; the separate course on incident reporting covers the reporting side.

VA and other federal facilities

VA medical centers follow NCPS policy and guidance. The NCPS Guide to Performing a Root Cause Analysis (revision February 5, 2021) requires that every RCA be formally chartered by the facility director and completed, signed and documented within 45 calendar days of the facility becoming aware that one is needed. VA review documents are confidential and privileged under 38 U.S.C. 5705, but only when the charter is properly signed, and the guide warns that email correspondence is not protected.

The Patient Safety Act

Outside federal facilities, review documents are mainly shielded, if at all, by the Patient Safety and Quality Improvement Act of 2005 and its implementing rule at 42 CFR Part 3. When analyses, deliberations and reports are assembled inside a provider's patient safety evaluation system and destined for a listed Patient Safety Organization (PSO), they can qualify as patient safety work product, which carries privilege and confidentiality. The underlying medical record, and the facts it holds, stay unprotected. Many states also have peer review or quality improvement privilege statutes, which vary in scope; ask your organization how its reviews are structured.

Source	What it expects	Typical timing
The Joint Commission (accredited organizations)	Comprehensive systematic analysis and corrective action plan for sentinel events	45 business days
CMS QAPI, 42 CFR 482.21 (hospitals)	Track adverse events, analyze causes, implement preventive actions	Ongoing program; no single deadline
State adverse event laws	Report listed events; some states require an analysis and action plan	Varies by state
VA NCPS policy (VA facilities)	Chartered RCA signed by the facility director	45 calendar days
RCA² guidance (voluntary best practice)	Start within 72 hours; complete within 30 to 45 days	30 to 45 days

Case study

A rural hospital in Oregon

A critical access hospital accredited by The Joint Commission has a patient death after an unrecognized esophageal intubation in the emergency department. The quality director has never led a full analysis. She checks three things on day one: whether the event meets the sentinel event definition, whether the state's reporting law applies, and whether the hospital's PSO agreement covers the review.

Analysis

The event is a sentinel event, so the 45-business-day clock has started. She charters the review inside the hospital's patient safety evaluation system so that analysis documents can be protected as patient safety work product, while the original record remains available as usual.

Learning point

The framework decides the deadline, the deliverables and the protection, so it must be checked before the first interview, not after the report is written.

Apply it

Find out which of the sources in the table apply to your workplace. Who in your organization decides whether an event needs a full analysis, and is your organization a member of a PSO?

Lesson 1.2 · Key points

For a sentinel event, a Joint Commission-accredited organization has 45 business days to finish its comprehensive systematic analysis and corrective action plan.
CMS QAPI rules require hospitals to analyze the causes of adverse events and act on them.
Some states require an analysis and corrective action plan after a mandatory report.
VA RCAs must be chartered by the director and finished within 45 calendar days; protection depends on a signed charter.
PSO-linked analysis can be privileged patient safety work product; original records are not.