§ 2805-m. Confidentiality. 1. The information required to be collected and maintained pursuant to sections twenty-eight hundred five-j and twenty-eight hundred five-k of this article, reports required to be submitted pursuant to section twenty-eight hundred five-l of this article and any incident reporting requirements imposed upon diagnostic and treatment centers pursuant to the provisions of this chapter shall be kept confidential and shall not be released except to the department or pursuant to subdivision four of section twenty-eight hundred five-k of this article. 2. Notwithstanding any other provisions of law, none of the records, documentation or committee actions or records required pursuant to sections twenty-eight hundred five-j and twenty-eight hundred five-k of this article, the reports required pursuant to section twenty-eight hundred five-l of this article nor any incident reporting requirements imposed upon diagnostic and treatment centers pursuant to the provisions of this chapter shall be subject to disclosure under article six of the public officers law or article thirty-one of the civil practice law and rules, except as hereinafter provided or as provided by any other provision of law. No person in attendance at a meeting of any such committee shall be required to testify as to what transpired thereat. The prohibition relating to discovery of testimony shall not apply to the statements made by any person in attendance at such a meeting who is a party to an action or proceeding the subject matter of which was reviewed at such meeting. 3. There shall be no monetary liability on the part of, and no cause of action for damages shall arise against, any person, partnership, corporation, firm, society, or other entity on account of the communication of information in the possession of such person or entity, or on account of any recommendation or evaluation, regarding the qualifications, fitness, or professional conduct or practices of a physician, to any governmental agency, medical or specialists society, or hospital as required by sections twenty-eight hundred five-j, twenty-eight hundred five-k and twenty-eight hundred five-l of this article or any incident reporting requirements imposed upon diagnostic and treatment centers pursuant to the provisions of this chapter. The foregoing shall not apply to information which is untrue and communicated with malicious intent. 4. (a) Hospital sepsis data submitted to the department, shall for the initial phase of data collection be considered a "pilot phase", the purpose of which is to ensure the completeness and accuracy of reporting by hospitals.

(b) For data reported during the pilot phase, hospital identifiers shall be encrypted by the department in any and all public databases and reports. The department shall provide each hospital with an encryption key for that hospital only to permit access to its own performance data for internal quality improvement purposes. Hospital specific public reporting of sepsis data including, but not limited to risk adjusted sepsis mortality rates, may require up to, but no more than, two years of "pilot phase" collection depending on the validity and reliability outcomes of the data collected.

(c) As described in the regulations pertaining to the submission of data on sepsis to the department, consultation with appropriate national, hospital and expert stakeholders will assist in determining the appropriate public release of hospital performance.

(d) The department shall issue regular reports as needed to hospitals assessing the accuracy of the data submitted during the pilot phase and provide guidance for improving the accuracy of data reporting.

(e) After the pilot phase is completed, all data submitted under this section and compiled in the database established herein and all public reports derived therefrom shall include hospital identifiers.

(f) Clinical performance data, including but not limited to individual hospital mortality rates adjusted for potential differences in risk factors and comparisons with state (or national, if available) averages, shall be developed and posted on the department's web site.