for peer review seems to be evolving. while it is premature to judge the potential effectiveness of this model, a 2009 study confirmed these findings in a separate sampling of hospitals. it also showed that important differences among programs predict a meaningful portion of the variation on 32 objective measures of patient care quality and safety. these findings were extended by cohort follow-up studies conducted in 2011 and 2015–16. the 2015-16 study refined qi model identifying 20 features that distinguish the most effective programs. these include among other factors: aiming first and foremost at improving quality, standardizing review process, maintaining high quality of case review, promoting self-reporting of adverse events, near misses and hazardous conditions, identifying opportunities for improvement in the review process (as opposed to casting blame), providing timely clinical performance feedback, recognizing clinical excellence, and establishing effective program governance. as additional multivariate predictors of the impact of clinical peer review on quality and safety, medical staff perceptions of the program, and clinician engagement in quality and safety initiatives. the online supplement to the report includes a program self assessment tool which is also available as a free online utility. despite a persistently high annual rate of major program change, about two-thirds of programs still have significant opportunity for improvement. it is argued that the outmoded qa model perpetuates a culture of blame that is toxic to efforts to advance quality and high reliability among both physicians and nurses. legal and regulatory environment united states in the us, peer review activity is generally protected under state statutes. the protection may include confidentiality of the review process and protection to reviewers and institutions for good faith efforts to improve quality and safety through review activity. such statutes may also specify whether or not the physician conducting the review must be in active practice. the nature of that protection varies widely. for example, texas is generally considered to have fairly robust protections, whereas florida protections were undermined by a constitutional amendment that exposed peer review data to discovery. health care quality improvement act us federal law generally trumps state law. the federal health care quality improvement act ("hcqia"), 42 u.s.c. § 11112, enacted in 1986, sets standards that professional review actions must meet in order to receive protection under the act. it requires that the action be taken in the reasonable belief that it will advance healthcare quality based on facts obtained through reasonable efforts with due process and fairness to the involved physician. when peer review leads to an action to limit or revoke clinical privileges, the physician is entitled to both a fair hearing and the right of appeal. congress explicitly stated the rationale for this legislation as follows: (1) the increasing occurrence of medical malpractice and the need to improve the quality of medical care have become nationwide problems that warrant greater efforts than those that can be undertaken by any individual state. (2) there is a national need to restrict the ability of incompetent physicians to move from state to state without disclosure or discovery of the physician's previous damaging or incompetent performance. (3) this nationwide problem can be remedied through effective professional peer review. (4) the threat of private money damage liability under federal laws, including treble damage liability under federal antitrust law, unreasonably discourages physicians from participating in effective professional peer review. (5) there is an overriding national need to provide incentive and protection for physicians engaging in effective professional peer review. from the time of the hcqia, there has been good alignment between regulatory and accrediting bodies with respect to due process requirements for physician disciplinary actions. these formalities apply primarily to questions of competence (credentialing and privileging) rather than performance (routine clinical peer review). it would be most unusual to find a hospital whose medical staff bylaws did not conform. national practitioner data bank hcqia enabled the creation of a national practitioner data bank and required hospitals, state medical boards and other health care entities who engage in formal peer review activities to report all disciplinary actions that affect clinical privileges for more than 30 days. this includes incidents in which a provider voluntarily resigns privileges while under investigation. an entity that fails to report as required may lose hcqia protections for three years. the hcqia (§ 11135) requires hospitals to query the npdb in their initial credentialing and bi-annual provider re-credentialing processes. structurally, this process fulfills the congressional intention of restricting movement of incompetent physicians. disciplinary actions may be a red flag for issues of global incompetence, but the problem may be focal, not global. thus, the npdb has been criticized for having the unintended consequence of having adverse economic impact on providers who were reported regardless of the magnitude of the issue. even so, gross under-reporting of adverse actions remains an issue. patient safety and quality improvement act the patient safety and quality improvement act of 2005 ("patient safety act"), public law 109–41, usc 299b-21-b-26 amended title ix of the public health service act to create a general framework to support and protect voluntary initiatives to improve quality and patient safety in all healthcare settings through reporting to patient safety organizations (pso). this was intended to include peer review. the final rule promulgated by the agency for healthcare research and quality in 2008 at 42 cfr part 3 also includes protections against reprisals for good-faith reporters of adverse events, near misses and hazardous conditions. several florida health systems subsequently formed psos in expectation of using federal statutory protections to maintain the confidentiality of peer review activity that would have been exposed under amendment 7. the subsequent legal challenges to this strategy go beyond the scope of this article. external peer review in the us, following enactment of the hcqia, executives from various national medical associations and health care organizations formed the non-profit american medical foundation for peer review and education to provide independent assessment of medical care. a 2007 study showed that the vast majority of physician peer review is done "in house": 87% of us hospitals send less than 1% of their peer review cases to external agencies. the external review process is generally reserved for cases requiring special expertise for evaluation or for situations in which the independent opinion of an outside reviewer would be helpful. the process is significantly more costly than in-house review, since the majority of hospital review is done as a voluntary contribution of the medical staff. mandated external peer review has not played an enduring role in the us, but was tested back in the 70s. a 1972 amendment to the social security act established professional standards review organizations (psro) with a view to controlling escalating medicare costs through physician-organized review. the psro model was not considered to be effective and was replaced in 1982 by a further act of congress which established utilization and quality control peer review organizations (pros). this model too was fraught with limitations. studies of its methods called into question its reliability and validity for peer review. a survey of iowa state medical society members in the early 90s regarding perceptions of the pro program illustrated the potential harm of a poorly designed program. furthermore, the institute of medicine issued a report identifying the system of care as the root cause of many instances of poor quality. as a result, in the mid-90s, the pros changed their focus and methods; and began to de-emphasize their role as agents of external peer review. the change was completed by 2002, when they were renamed quality improvement organizations. in contrast, external peer review has been used by german hospitals to lower their standardized mortality rate abuse main article: sham peer review sham peer review is a name given to the abuse of a medical peer review process to attack a doctor for personal or other non-medical reasons. state medical boards have withheld medical records from court to frame innocent physicians as negligent. another type of review similar to sham peer review is "incompetent peer review," in which the reviewers are unable to accurately assess the quality of care provided by their colleagues. controversy exists over whether medical peer review has been used as a competitive weapon in turf wars among physicians, hospitals, hmos, and other entities and whether it is used in retaliation for whistleblowing. many medical staff laws specify guidelines for the timeliness of peer review, in compliance with jcaho standards, but state medical boards are not bound by such timely peer review and occasionally litigate cases for more than five years. abuse is also referred to as "malicious peer review" by those who consider it endemic, and they allege that the creation of the national practitioner data bank under the 1986 healthcare quality improvement act (hcqia) facilitates such abuse, creating a 'third-rail' or a 'first-strike' mentality by granting significant immunity from liability to doctors and others who participate in peer reviews. the american medical association conducted an investigation of medical peer review in 2007 and concluded that while it is easy to allege misconduct, proven cases of malicious peer review are rare. parenthetically, it is difficult to prove wrongdoing on behalf of a review committee that can use their clinical and administrative privileges to conceal exculpatory evidence. the california legislature framed its statutes so as to allow that a peer review can be found in court to have been improper due to bad faith or malice, in which case the peer reviewers' immunities from civil liability "fall by the wayside". dishonesty by healthcare institutions is well-described in the literature and there is no incentive for those that lie to the public about patient care to be honest with a peer review committee. incidents of alleged sham peer review are numerous and include cases such as khajavi v. feather river anesthesiology medical group, mileikowsky v. tenet, and roland chalifoux. defenders of the health care quality improvement act state that the national practitioner data bank protects patients by helping preventing errant physicians who have lost their privileges in one state from traveling to practice in another state. physicians who allege they have been affected by sham peer review are also less able to find work when they move to another state, as roland chalifoux did. moreover, neither opponents or supporters of the npdb can be completely satisfied, as chalifoux' case shows that just as physicians who were unjustly accused may be deprived of work in this way, those who have erred might still find work in other states.