Health Services (Quality and Safety) Regulations 2020

The regulations introduce a layered vocabulary of patient harm that is critical to determining when a SAPSE review must occur. Harm is defined broadly in regulation 3A to include moderate harm, severe harm and prolonged psychological harm. Moderate harm requires a moderate increase in treatment such as an unplanned return to surgery but explicitly excludes permanent damage or injury. Severe harm causes a permanent lessening in functioning unrelated to the natural course of the patient’s condition, including permanent impairment, disability, or death. Prolonged psychological harm must have been experienced or be likely to be experienced for a continuous period of at least 28 days. These definitions matter because they set the thresholds for triggering a SAPSE; an event that causes only minor or transient harm may fall outside the definition. The rigidity of the 28‑day threshold for psychological harm may generate disputes over whether a patient’s distress qualifies, especially in contexts where symptoms resolve slightly before that mark.

A serious adverse patient safety event (SAPSE) is defined in regulation 3B by reference to two elements: the event must occur while the patient is receiving health services from a health service entity, and it must meet the reasonable‑opinion test of a registered health practitioner that unintended or unexpected harm has resulted or is likely. Notably, the event is not confined to the period of admission; it includes events identified after discharge. This expands the time window for health service entities to identify and report potential SAPSEs. The definition relies on the subjective “reasonable opinion” of a registered health practitioner, which introduces clinical judgment variability. Two practitioners may reasonably disagree on whether an outcome was unintended or unexpected, leading to inconsistent application across entities.

A sentinel event is a subset of adverse events defined in regulation 3A as infrequent, unexpected events that result in death or serious physical or psychological injury due to system and process deficiencies. Sentinel events carry additional procedural requirements: any SAPSE review panel dealing with a sentinel event must include a consumer representative (regulations 3C(d) and 3D(b)). This elevates the role of a lay participant in what is otherwise a clinical and managerial process, potentially improving transparency but also adding complexity in panel logistics.

The SAPSE review panel is the body that conducts the review of a serious adverse patient safety event. Regulations 3C and 3D prescribe its composition. For a joint panel (involving more than one health service entity), there must be at least one member from each entity and no fewer than four members total; the Secretary may appoint a representative; and if a sentinel event, a consumer representative is mandatory. For a single‑entity panel (governed by s 128Q of the Act), the panel must have at least three members, again with a consumer representative for sentinel events. Panel members must disclose actual or potential conflicts of interest to other members.

A quality and safety body is an entity prescribed in regulation 4 that can collect, use and disclose confidential information for a quality and safety purpose under Part 6B of the Act. Currently, two bodies are prescribed: Safer Care Victoria (an administrative office) and the Chief Quality and Safety Officer. The 2022 amendment substituted regulation 4(b) to replace a previously prescribed entity (likely Safer Care Victoria itself) with the Chief Quality and Safety Officer, meaning the Chief Quality and Safety Officer is now separately recognised as a quality and safety body alongside the administrative office.

The suspension and recommencement procedure in regulation 3F applies when a SAPSE review panel’s activities are suspended due to a suspected prohibited act (likely an attempt to conceal or destroy evidence, or to interfere with the review). After suspension, the panel must notify the CEO of the health service entity in writing about the suspected prohibited act. The panel may recommence only after receiving written notice from the CEO that either the prohibited act did not occur or that it can be investigated independently of the SAPSE review. This places significant power in the hands of the CEO to determine when the review can resume, which could be used to delay a review if the CEO is implicated or wishes to protect the entity’s reputation.

The regulations directly affect health service entities that provide health services under the Health Services Act 1988. These entities, which include public hospitals, private hospitals, community health centres and other licensed providers, are the sites where serious adverse patient safety events occur. They must comply with the SAPSE review framework: they may be required to participate in joint panels, provide information to panels, appoint members to panels, and manage the suspension procedure. They also bear the administrative cost of identifying events that meet the SAPSE definition, which relies on the judgment of registered health practitioners within the entity.

Registered health practitioners are the gatekeepers of the SAPSE definition. Their reasonable opinion determines whether an event has resulted in unintended or unexpected harm. They are also potential members of SAPSE review panels or providers of information to panels. The regulations impose a duty on panel members to disclose conflicts of interest (regulation 3D(c)), which applies to practitioner members.

Patients are the subjects of SAPSE reviews. They may suffer harm that triggers a review, and their medical information may be collected, used and disclosed by quality and safety bodies. The regulations themselves do not give patients rights to participate in reviews, except indirectly through the consumer representative requirement for sentinel events. Patients who provide information to panels have their names and addresses prescribed as report content (regulation 3E), which may deter some from volunteering feedback if they fear being identified in a report.

Consumer representatives are affected because the regulations mandate their inclusion on panels for sentinel events. This creates a role for lay participants in what would otherwise be a clinical and managerial process. Their involvement may improve accountability but also requires health service entities to recruit and brief suitable consumers, adding to compliance costs.

Safer Care Victoria and the Chief Quality and Safety Officer are the two prescribed quality and safety bodies. They are empowered to collect, use and disclose confidential information for quality and safety purposes. They may also be involved in SAPSE reviews (e.g., the Secretary may appoint a representative to a joint panel under regulation 3C(c)). These bodies are government entities that now have greater access to health service confidential data, which centralises oversight but also concentrates sensitive information in the hands of a few state officials.

The Secretary (of the Department of Health) has a role under regulation 3C(c) to appoint a representative to a joint SAPSE review panel. This gives the department a direct role in the review process, potentially influencing outcomes or gaining insight into health service operations.

Chief executive officers of health service entities have a specific duty under regulation 3F: when a panel’s activities are suspended due to a suspected prohibited act, the CEO must receive written notification from the panel and then must determine whether the suspected prohibited act occurred or can be investigated independently. The CEO’s written satisfaction is the condition that allows the panel to recommence. This places the CEO in a gatekeeping role that could be used to control the pace and scope of the review.

Individuals who provide information to a SAPSE review panel (other than those specified in s 128T(3)(a) of the Act) have their names and addresses prescribed as content of the review report. This affects their privacy, as their identifying details will appear in a report that may be disclosed internally or to quality and safety bodies. This could chill the willingness of staff, patients or third parties to come forward with information.

The regulations create few direct duties; most duties flow from the Health Services Act itself. However, the regulations specify how certain framework duties are to be performed.

Duty of health service entities to participate in joint SAPSE review panels. Regulation 3C(a) requires that a joint panel must include at least one member from each health service entity involved with the serious adverse patient safety event. This imposes on entities the duty to nominate a representative when a joint review is established. There is no right for an entity to opt out; if an event involves multiple entities, they must all contribute a member.

Duty of panel members to disclose conflicts of interest. Regulation 3D(c) requires that any member of a SAPSE review panel who has a potential or actual conflict of interest with respect to a review must disclose that conflict to the other members. The regulation does not prescribe what happens after disclosure; the Act or other procedures presumably govern removal or recusal. The duty is ongoing, applying from appointment through the review.

Duty of the CEO regarding suspended reviews. When a SAPSE review panel suspends its activities due to a suspected prohibited act (described in the Act’s s 128Z), the panel must notify the CEO in writing of the suspected prohibited act (regulation 3F(a)). The CEO then has the duty to make a determination and provide written notice to the panel that either the prohibited act did not occur or that it can be investigated independently. The panel may recommence only after receiving this notice. The CEO thus has a duty to respond, but the regulation gives the CEO discretion as to the timing of that response; there is no deadline specified.

Right of the panel to recommence. Regulation 3F(b) gives the SAPSE review panel the right to recommence its activities once the CEO provides the required written notice. This condition is a pre‑requisite: the panel cannot unilaterally resume after suspension.

Right of the Secretary to appoint a representative to a joint panel. Regulation 3C(c) states that a joint panel “may include a representative appointed by the Secretary”. This is a discretionary right of the Secretary, not a duty. The Secretary can inject a departmental representative into the review.

Right of consumer representatives to be included. For sentinel events, regulation 3C(d) (joint panel) and regulation 3D(b) (single‑entity panel) require that the panel contain a consumer representative. This grants a right of representation to consumers, but the regulation does not specify how that representative is chosen or appointed; presumably the health service entity or the panel convenor selects them.

Right of information providers to be named in reports. Regulation 3E prescribes that the name and address of a person who has provided information to a SAPSE review panel (other than a person specified in s 128T(3)(a) of the Act) must be included in the review report. This is a duty on the panel to include that information, but it also grants the person a right of attribution (or, if they wish to remain anonymous, a duty on the panel to include their name may override their privacy preference unless the Act provides an exemption).

Rights of health service entities to designate quality and safety bodies. Regulation 4 does not create duties or rights directly but rather designates which bodies are quality and safety bodies for the Act. This gives Safer Care Victoria and the Chief Quality and Safety Officer the legal authority to collect, use and disclose confidential information for quality and safety purposes. It does not grant health service entities any corresponding rights to access that information or to participate in how it is used.

The regulations do not confer any new individual rights on patients or staff to initiate a SAPSE review or to appeal panel findings. Those rights, if they exist, must be found in the Health Services Act itself.

The regulations themselves contain no penalty provisions. They do not set fines, imprisonment terms, infringement notices, or any other sanction for non‑compliance. Instead, the regulations operate within the enforcement framework of the Health Services Act 1988. The Act’s Part 6B, which the regulations support, includes provisions that make it an offence to unlawfully collect, use or disclose confidential information. Those offences and their penalties are found in the Act, not in the regulations. The regulations merely prescribe who may lawfully handle such information (regulation 4) and set out the SAPSE review procedures; contravention of those procedures may be a breach of the Act’s requirements, but the regulations do not separately criminalise any conduct.

The suspension and recommencement procedure in regulation 3F may have enforcement implications. If a CEO fails to provide the required notice after being notified of a suspected prohibited act, the panel cannot recommence, which could delay or obstruct a review. Such a failure could be a breach of the Act’s requirement to cooperate with a SAPSE review, but the regulations do not specify any penalty for that failure. Enforcement would depend on the Act or on broader provisions about obstruction of public functions.

The conflict of interest disclosure duty under regulation 3D(c) is a procedural requirement. Non‑disclosure could lead to a review being invalidated or could expose the member to action under the Act’s provisions regarding panel member conduct, but again the regulations are silent on consequences. The duty is likely enforced via internal governance and potential civil liability if a failure to disclose leads to a flawed review.

The requirement to include names and addresses in reports (regulation 3E) is prescriptive. If a panel fails to include those details, the report would not comply with the Act’s requirements, which could affect the validity of the review or expose the panel to challenge. The regulations do not impose a penalty for non‑compliance, but the Act may treat an invalid report as a procedural breach.

Because the regulations are relatively new (the SAPSE provisions commenced 30 November 2022), there is no public enforcement history available from the source. Enforcement is likely to be handled through the health department’s regulatory arm, which may issue directions, impose conditions on health service entity licenses, or refer matters to professional boards for practitioner misconduct. The absence of direct penalties in the regulations is notable: it means that the primary enforcement mechanism is the threat that a health service entity could lose its ability to conduct confidential internal reviews if it fails to comply with the prescribed procedures. That is a bureaucratic rather than punitive enforcement model, relying on compliance with procedural norms rather than financial deterrence.

The regulations are made under section 158 of the Health Services Act 1988 (the Act). They directly interact with Part 6B of the Act, which deals with quality and safety purposes and the protection of confidential information. The regulations prescribe entities that are “quality and safety bodies” for the purposes of the Act’s definition in s 134V. They also prescribe the definition of “serious adverse patient safety event” for s 3(1) of the Act, panel composition for ss 128P and 128Q, report content for s 128T, and procedures for s 128Z. The regulations cannot expand or conflict with the Act; they merely fill in details.

The regulations refer to the Public Administration Act 2004 in identifying Safer Care Victoria as an Administrative Office. That interaction means Safer Care Victoria’s employees are subject to the public sector code of conduct and other obligations under that Act, which may impose additional accountability for how confidential information is handled.

The definition of registered health practitioner in regulation 3A adopts the meaning from the Health Practitioner Regulation National Law (which operates as a scheduled law in Victoria). This means that only practitioners registered under that national scheme (doctors, nurses, etc.) can form the “reasonable opinion” that triggers a SAPSE. It excludes unregistered health workers, which may limit the identification of events in settings where unregistered practitioners are the primary care providers.

The Subordinate Legislation Act 1994 governs the making, tabling and sunsetting of statutory rules. Regulation 3 states that these regulations sunset 10 years after the day of making, i.e., 28 July 2030. This means the regulations have a finite life unless re‑made. The sunset provision interacts with the Act’s rule‑making power and imposes a periodic review mechanism.

The Interpretation of Legislation Act 1984 applies to the construction of the regulations. The endnotes confirm that headings, examples, diagrams, notes, punctuation and provision numbers form part of the regulations. This matters when interpreting definitions: for example, the examples in the endnotes are non‑binding explanatory material that does not form part of the regulations (as stated under “Other material” in the endnotes). The distinction between legislative and non‑legislative material is critical for litigation.

The regulations interact with privacy and confidentiality laws. Part 6B of the Health Services Act provides a framework for handling confidential information for quality and safety purposes. The regulations identify which bodies can access that information. This interacts with the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) to the extent that health information is also protected under those Acts. The regulations do not override those laws; they operate as a statutory authorisation for disclosure that may otherwise be restricted. However, the interaction creates complexity: a health service entity must ensure that any disclosure to Safer Care Victoria or the Chief Quality and Safety Officer complies with both the Health Services Act and the privacy legislation.

The Charter of Human Rights and Responsibilities Act 2006 (Vic) may be engaged. The regulations affect the right to privacy (s 13 of the Charter) through the collection and disclosure of personal information, and the inclusion of names and addresses in SAPSE reports. Any limitation on privacy must be reasonable and demonstrably justified. The regulations themselves do not refer to the Charter, but government entities must consider Charter compatibility when acting under them.

The regulations do not reference Commonwealth laws, such as the Competition and Consumer Act 2010 or privacy principles, but state health entities may be subject to the National Health Reform Agreement and other federal funding arrangements that impose quality reporting obligations. The prescribed quality and safety bodies may also interact with Australian Commission on Safety and Quality in Health Care activities, though the regulations do not mention them.

The Health Services (Quality and Safety) Regulations 2020 were originally made as Statutory Rule No. 77/2020 on 28 July 2020 and commenced on 27 August 2020. At that time, the regulations consisted of only four provisions: objective, authorising provision, commencement, and regulation 4 prescribing quality and safety bodies (Safer Care Victoria and one other entity). There were no SAPSE provisions, no definitions of harm, and no panel composition rules. The original version was a short, purely designating instrument.

The only amendment to date is the Health Services (Quality and Safety) Amendment Regulations 2022 (S.R. No. 121/2022), made on 18 October 2022 and commencing on 30 November 2022. This amendment significantly expanded the regulations. It inserted new regulations 3A (definitions), 3B (definition of SAPSE), 3C (appointment of joint panel), 3D (membership of panel), 3E (report content), and 3F (restrictions on reviews). It also amended regulation 2 (authorising provision) and substituted regulation 4(b) to change the second prescribed entity from whatever it was originally to "the Chief Quality and Safety Officer". The table of amendments confirms that the 2022 regulations made these changes.

The 2022 amendment appears to have been a response to the addition of Part 6B to the Health Services Act (likely by the Health Legislation Amendment Act 2022 or similar). The regulations now implement the SAPSE review framework that was created in the Act. The amendment inserted detailed procedural rules that were absent from the original regulations.

There are no other amendments recorded in the version as at 30 November 2022. The regulations have a sunset date of 28 July 2030, meaning they will automatically repeal unless re‑made before then. The amendment history is thus brief but operationally significant: the regulations transformed from a simple listing of bodies to a comprehensive procedural framework for adverse event reviews.

The version number "002" indicates that the current version incorporates one set of amendments. A version history like this is relevant for practitioners to ensure they are relying on the current wording, especially because definitions like “harm” and “sentinel event” were not original to the regulations and are key to determining when a SAPSE occurs.

The regulations themselves contain no reference to any litigation. There is no discussion of court cases, tribunal decisions, or legal challenges in the text of the regulations or the endnotes. As subordinate legislation made in 2020 and amended in 2022, the regulations are relatively recent, and the SAPSE provisions commenced only in November 2022. It is plausible that no litigation has yet arisen directly from these regulations, or if it has, it has not been incorporated into the published version of the regulations.

Given the nature of the regulations (procedural and designating), litigation is more likely to arise from the underlying Health Services Act rather than from the regulations themselves. For example, a dispute over whether an event qualifies as a SAPSE under regulation 3B could be challenged, or a health service entity could dispute the validity of a panel’s composition. The regulations’ conflict of interest disclosure requirement (regulation 3D(c)) could also be a ground for challenging a review if a panel member failed to disclose and the review was conducted tainted.

The inclusion of names and addresses in reports under regulation 3E could lead to privacy‑related litigation if a person claims the report improperly disclosed their identity, particularly if they are not one of the persons excluded under s 128T(3)(a) of the Act. Such a claim would likely be based on the Privacy and Data Protection Act or the Health Records Act, using the regulations as the justification for disclosure.

The suspension and recommencement procedure (regulation 3F) creates a power imbalance between the CEO and the panel. If a CEO refuses to give written notice delaying the review indefinitely, a panel or a health service entity might seek judicial review or an injunction. But again, no such litigation is recorded in the source.

The absence of litigation history in the source does not mean no cases exist; it simply means the legislation text does not reference them. A deeper search of Victorian case law might reveal decisions on the Health Services Act’s Part 6B, but that is beyond the scope of this document. For the purposes of this deep dive, the source‑grounded answer is that the regulations contain no litigation history, and no cases are cited or discussed.

Several aspects of the regulations are traps for the unwary. First, the definition of harm in regulation 3A is deceptively precise. Moderate harm is defined as harm that requires a moderate increase in treatment, such as an unplanned return to surgery, but explicitly excludes “permanent damage or injury”. This means a patient who suffers a permanent injury from a surgical error would not meet the moderate harm threshold; it would likely be severe harm or a sentinel event. But the line between moderate and severe is not drawn clearly: a harm that requires a moderate increase in treatment but also causes some permanent lessening of function would arguably be severe harm. Practitioners may disagree on classification, and misclassification could lead to failure to trigger a SAPSE review.

Second, the SAPSE definition in regulation 3B(1) relies on “the reasonable opinion of a registered health practitioner”. This introduces a subjective element that can vary between practitioners. Importantly, the definition does not require that the harm in fact occurred; it is sufficient that it is “likely to result” in harm. This means a near‑miss that has a high probability of harm could qualify, even if no actual harm eventuated. Health service entities must train their practitioners to exercise judgment consistently, and a single practitioner’s opinion can trigger the entire review apparatus.

Third, regulation 3B(2) states that an event includes one identified after discharge. This extends the reporting window indefinitely, meaning a health service entity could be required to conduct a SAPSE review for an event discovered months after the patient left the facility. There is no statute of limitations in the regulations. This creates a practical burden: the entity must maintain systems to capture post‑discharge events and keep records for an indefinite period.

Fourth, the consumer representative requirement for sentinel events (regulations 3C(d) and 3D(b)) sounds benign but raises practical issues. The regulations do not specify who appoints the consumer representative, what qualifications they need, how conflicts of interest are managed for them, or how they are to be compensated. A health service entity that cannot find a suitable consumer representative in time could find itself unable to proceed with a sentinel event review, potentially breaching the Act’s timeliness requirements.

Fifth, the conflict of interest disclosure requirement in regulation 3D(c) is mandatory but lacks teeth. Failure to disclose is not penalised in the regulations, and there is no mechanism for excluding a conflicted member. If a member discloses a conflict, the other members may decide whether the person can continue, but the regulations do not say. This could lead to inconsistent practices.

Sixth, the suspension procedure in regulation 3F gives the CEO unilateral power to control the recommencement of a review. The CEO can stall indefinitely by failing to provide the required written notice. There is no time limit for the CEO’s response, and no recourse for the panel if the CEO refuses to act. This creates a risk that a review could be derailed by a CEO who, for example, is implicated in the suspected prohibited act.

Seventh, the prescription of names and addresses in reports (regulation 3E) includes all persons who provided information except those specified in s 128T(3)(a) of the Act. The source does not reproduce s 128T(3)(a), so we cannot know who is excluded. That cross‑reference is critical: if a person’s category is not excluded, their identity must appear in the report, which could deter whistleblowers. A health service entity that promises anonymity to a staff member for reporting a safety concern may later find that the panel is legally required to include the person’s name in the report, undermining the promise and potentially exposing the staff member to reprisals.

Eighth, the regulations sunset on 28 July 2030 unless re‑made. This gives a finite period during which the current framework operates. If the Act is not amended, the regulations could lapse, leaving quality and safety bodies with uncertain authority to handle confidential information. Health service entities should track the sunset date and participate in any consultation on re‑making.

Compliance with the Health Services (Quality and Safety) Regulations 2020 requires health service entities to integrate the regulatory requirements into their existing clinical governance and risk management systems. The following steps are based on the regulations’ provisions.

Step 1: Understand the definitions. The entity must ensure that all registered health practitioners are familiar with the definitions in regulation 3A: moderate harm, severe harm, prolonged psychological harm, sentinel event, and serious adverse patient safety event. Training should focus on distinguishing between harm levels, particularly the exclusion of permanent damage from moderate harm and the 28‑day threshold for psychological harm. The entity should develop internal guidance on what constitutes “unintended or unexpected harm” in the context of its services.

Step 2: Identify SAPSEs promptly. Under regulation 3B, a SAPSE occurs when a registered health practitioner holds a reasonable opinion that the event has resulted or is likely to result in unintended or unexpected harm. The entity should have a clear process for practitioners to report such opinions, and a mechanism to escalate them to the person responsible for initiating a SAPSE review. Because events can be identified after discharge (regulation 3B(2)), the entity must maintain a system for receiving and reviewing post‑discharge complaints, readmissions, and other indicators.

Step 3: Establish panel appointment procedures. For each SAPSE, the entity must determine whether a single‑entity or joint panel is required. For a single‑entity panel, the entity must ensure the panel has at least three members (regulation 3D(a)). For a joint panel involving multiple entities, the entity must appoint at least one member (regulation 3C(a)) and ensure the total panel has at least four members (regulation 3C(b)). If the SAPSE involves a sentinel event, the panel must include a consumer representative (regulations 3C(d) and 3D(b)). The entity should maintain a pool of potential panel members and consumer representatives.

Step 4: Manage conflicts of interest. Regulation 3D(c) requires that any panel member with a potential or actual conflict must disclose it to other members. The entity should include conflict disclosure as a standard agenda item at the first panel meeting and require a written declaration from each member. The panel’s procedures should address how to handle disclosures, including whether the member may continue or should be replaced.

Step 5: Prepare SAPSE review reports. Regulation 3E requires that the report include the name and address of any person who provided information to the panel (other than persons specified in s 128T(3)(a) of the Act). The entity must ensure that the report includes this information for each information provider, subject to that exception. It should also check the Act to identify which persons are excluded (e.g., the affected patient or their representatives). The entity must ensure that the report does not inadvertently omit required identifying details.

Step 6: Handle suspension of panel activities. If a panel suspects a prohibited act (such as destruction of records or interference), regulation 3F sets out the procedure. The panel must notify the CEO of the health service entity in writing of the suspected prohibited act. The entity’s CEO must then assess the situation and, when satisfied, provide written notice to the panel that either the act did not occur or can be investigated independently. Only then may the panel recommence. The entity should have internal policies for how the CEO will respond promptly, including who will investigate the suspected act and within what timeframe.

Step 7: Ensure quality and safety body designations. Regulation 4 designates Safer Care Victoria and the Chief Quality and Safety Officer as quality and safety bodies. The entity must ensure that any collection, use or disclosure of confidential information for quality and safety purposes is done in accordance with Part 6B of the Act and that the information is provided only to these prescribed bodies unless another provision in the Act authorises a different recipient.

Step 8: Monitor sunset and legislative changes. The regulations sunset on 28 July 2030. The entity should track the regulations’ status and any proposed re‑making or amendment. Participation in stakeholder consultations can help shape the next iteration. In the interim, the entity must watch for any further amendments that may adjust definitions or procedures.

Step 9: Document compliance. The entity should maintain records of all SAPSE decisions, panel appointments, conflict disclosures, suspension notifications, and reports. This documentation demonstrates compliance in the event of an audit or review by the quality and safety bodies.

Step 10: Review privacy implications. Because the regulations authorise disclosure of confidential information, the entity must also comply with the Health Services Act’s confidentiality protections and any applicable privacy laws. The entity should have information‑sharing protocols that align with regulation 4 and the Act. If the entity promises anonymity to information providers, it must ensure that the SAPSE report will not override that promise; advise providers that regulation 3E may require their details in the report unless they are in the excluded category under s 128T(3)(a).