Discoverability of incident reports varies substantially by jurisdiction and depends on how state and federal laws define peer review privilege, quality improvement protections, and confidentiality—plus how courts interpret those protections. Risk management objectives include structuring reporting and investigation workflows to maximize protected quality review where legally available: routing analyses through designated committees, labeling and handling documents per policy, limiting distribution, and avoiding mixing risk/peer review materials with ordinary business records. However, privilege is not automatic; mishandling (broad email distribution, using reports for disciplinary actions outside protected structures, inconsistent committee practices) can weaken protections. A defensible program uses legal counsel guidance, staff training, and clear documentation rules so the organization learns from events while reducing unnecessary legal exposure.