By: Hannah DePoy Hayden and Brad Oakley
In Baptist Healthcare Sys. v. Kitchen, the Kentucky Supreme Court defined when internal hospital investigations and reports are protected by privilege under the federal Patient Safety and Quality Improvement Act (“PSQIA”) and Kentucky’s peer review privilege statute, KRS 311.377. Nos. 2025-SC-0154-MR, 2025-SC-0165-MR (Ky. Dec. 18, 2025).
Specifically, the Court drew a line between: (1) documents created to satisfy external regulatory or operational reporting duties, and (2) documents created as part of retrospective patient-safety / peer-review analysis. The Court held that documents in the former were not protected by PSQIA or Kentucky’s peer review privilege statute even if they were later placed in a peer review file. There, the Court held:
- The Root Cause Analysis was fully protected by PSQIA;
- The Incident Report was not protected by PSQIA; and
- The Incident Report was also not protected by Kentucky’s peer review privilege, KRS 311.377.
The Court differentiated between the Root Cause Analysis and Incident Report based on why the documents were created, when the documents were created, and the context in which the documents are generated.
The Root Cause Analysis was found to be privileged under PSQIA because (1) was an analysis; (2) was prepared for reporting to a patient safety organization (PSO); (3) was actually reported to a PSO; and (4) contained analysis and improvement recommendations that could improve patient safety. Since the Root Cause Analysis met PSQIA elements, the Court emphasized the entire document was privileged—rejecting plaintiff’s argument that the factual portions were discoverable.
The Incident Report, however, was not found to be privileged under either the federal or state peer review protections. The Court relied on an exception in PSQIA that exempts “information that is collected, maintained, or developed separately, or exists separately, from a patient safety evaluation system.” 42 U.S.C. § 299b-21(7)(B)(ii). This includes “records generated or maintained as part of providers’ existing mandatory information collection activities” pursuant to “external reporting or recordkeeping obligations.” In Kitchen, the Incident Report was created to satisfy the hospital’s state obligation to track incidents under 902 KAR 20:016 § 3(4)(g) and the hospital’s own policy requiring completion of a SAFE report before the end of the shift. Thus, because it was created pursuant to an external reporting obligation, it fell within PSQIA’s exclusion for information “collected, maintained, or developed separately” from the PSO.
The Court also rejected that Kentucky’s peer review privilege statute protected the Incident Report because it was prepared contemporaneously as a factual account of the event, not a retrospective review of provider competency. To reach its conclusion, the Court relied on the following facts: it was generated the same day as the fall, it documented the circumstances of the incident, and it triggered the Root Cause Analysis rather than constituting the Root Cause Analysis itself. In practical terms, KRS § 311.377 protects the evaluative process of retrospective professional review.
The Kentucky Supreme Court has held that peer review privilege is tied to the function being performed, not merely the location of the document or the hospital’s labeling of it. Kitchen links peer review privilege to retrospective peer review rather than to all internal risk-management activity. This is consistent with the Clouse Court, which held that peer review privilege does not allow providers to shield documents simply by placing them in the PSO.
How to Maintain Privilege After Kitchen
1. Keep Separate any Analysis from Event Reporting
a. Best Practice: maintain two streams of event documentation:
i. Operational and Compliance Records
1. Incident reports
2. Occurrence reports
3. Records compliant with state, federal, and accreditation reporting obligations
ii. Privilege Review Records
1. Root cause analysis
2. Peer Review Committee Materials
3. Committee deliberations
4. Recommendations
5. Action plans developed in retrospective review
6. PSO submission materials
b. Healthcare facilities should assume that operational and compliance records will be discoverable after Kitchen, as they are generally prepared contemporaneously and pursuant to an external reporting obligation. If a record is required by state regulation, Medicare/Medicaid conditions, licensing standards, accreditation, or mandatory internal compliance policies tied to external obligations, it should be maintained as a separate record outside the PSO.
c. Any analysis/evaluative commentary in these documents will not make the document privileged. Therefore, hospitals should keep separated, to the extent consistent with applicable laws and regulations, any compliance event reporting documents and analysis of any event.
2. Assume Incident Reports are Potentially Discoverable at the Start
a. Best Practice: keep any incident report limited to what is required to document for operations, safety response, and compliance with applicable laws and regulations.
i. After Kitchen, Kentucky providers should assume that a same-day incident report documenting what happened, who was involved, and what immediate response occurred may be discoverable if it also serves as the hospital’s mandatory incident-tracking function.
b. To the extent possible, the following should be avoided in incident reports:
i. fault assessments
ii. staff-competency conclusions
iii. root-cause theories
iv. legal conclusions
v. committee impressions
vi. recommendations for future systems improvement
vii. candid admissions beyond necessary factual reporting
c. Staff should be trained on what to report. Specifically, staff completing discoverable event reports should be trained to record ONLY objective facts, timing, observations, immediate care, and notifications.
3. Have a clear Patient Safety Evaluation System
a. Best Practice: Make sure the patient safety evaluation system and its protocols are clearly documented and compliant with PSQIA.
b. The patient safety evaluation system should identify:
i. When and how documents are submitted to the PSO
ii. What documents are collected within the PSO
iii. Who has authority to create and access PSO-bound analyses;
iv. How documents are designated for PSO reporting; and
v. Retention and segregation rules.
c. Healthcare facilities should maintain records showing when documents were actually reported to the PSO. A court is more likely to uphold PSQIA privilege when there is concrete evidence that the materials were created for and routed through the PSO process, not simply stamped privileged on an unknown date.
Key takeaways:
• Not every patient safety document is privileged.
• Labeling a document “confidential” or “peer review” does not make a document privileged.
• Documents required by law, regulation, accreditation, or ordinary business operations generally remain discoverable.
• Underlying facts may be discoverable even when deliberative analysis may be privileged.
• Whether privilege applies is a case-by-case determination, depending on process, structure, and documentation.