• Plan what you intend to say and review your plan with a ProAssurance Claims Specialist, if possible.
• Consider having a fact witness present during the discussion, perhaps your nurse or one of your partners.
• Spend plenty of time with the patient and family members. Listen to their questions and answer them to the best of your ability.
• Focus on the patient, not on yourself.
• Sincerely acknowledge the patient’s and/or family’s suffering. Do not belittle a complication. Do not point fingers or blame other physicians or staff members.
• Apologizing for the fact that the incident occurred may be appropriate. Example: “I’m sorry this has happened to you, and I want to assure you I’ll continue to oversee your care.”
• Do not overwhelm the patient and family with information. In complicated cases, it is best to schedule multiple conversations so they can better digest your information.
• Discuss the patient’s current condition and continued treatment, as well as the event’s definitive medical consequences on the patient’s health (if known).
• Do not speculate. If you do not know what happened, admit this. Then tell the patient and family you are investigating the situation and will let them know as soon as you have answers.
• Assume all conversations with patients are being recorded and conduct conversations accordingly.
• Provide the patient and family with your contact information.

• The date, time, and location of the discussion.
• The parties and relationships of those present.
• Your commitment to share additional information as it becomes available and to assist the patient and family.

Do not make any admissions of liability or statements of blame. Do not make any references to the cause of the outcome or any future peer review proceedings.

For more information, see Two Minutes: What’s the Risk? Unexpected Outcomes.

Since the landmark Cobbs v. Grant decision in 1972, California healthcare professionals in the state have had a legal obligation to ensure that their patients are fully informed about a proposed treatment.

According to the California Hospital Association, the physician who is performing the procedure is responsible for obtaining the patient’s consent. If a nonphysician will perform the procedure, the ordering physician is responsible for obtaining consent. In cases in which more than one doctor is involved, and the hospital policy does not specify, they can determine among themselves which provider will obtain the consent.

In obtaining a patient’s or surrogate’s informed consent, the physician should: 1) assess the patient’s capacity to understand the treatment and make an informed decision; 2) discuss the diagnosis and the risks, benefits, and alternatives of the proposed treatment, including the risks, benefits, and alternatives of refusing treatment; 3) Confirm patient’s understanding and obtain informed consent or refusal; and 4) Thoroughly document the informed consent conversation and have patient sign consent form, if using. The process is designed to give patients the information necessary to make a voluntary and informed decision about a proposed treatment or procedure—even if that patient’s ultimate decision is not what the physician believes to be in the patient’s best interest. (see also: AMA Code of Medical Ethics Opinion 2.1.1)

Physicians may incur liability for consent issues even when their medical care otherwise met the standard of care. Although consent issues are not usually the central focus of malpractice claims, they often become important associated issues or secondary allegations. A lack of informed consent or an insufficient disclosure may not necessarily have a causal connection to medical injuries in a malpractice case, but those issues can discredit physicians at trial or during settlement discussions.

The physician ordering or providing the care, is responsible for obtaining the patient’s informed consent prior to the provision of the care. Physicians may not delegate to others the duty of informing patients about the treatment options, associated risks, and material information needed by patients to make an informed decision. Physicians may delegate to a nurse or office staff member the task of getting a consent form signed, but the physician is ultimately responsible for the consent process and should be available to answer any questions the patient has prior to scheduling, ordering, or carrying out the procedure. Meeting this responsibility is considered best practice from a patient safety and risk management perspective.

There are generally two exceptions to informed consent standards. There may be other state-specific exceptions, so providers should review their state’s guidelines:

• Emergency situations: In an emergency situation, if the patient does not have the capacity to make decisions, there is no legally designated decision-maker or representative available, and all reasonable efforts have been made to contact the legal representative, then a patient will be presumed to have consented to necessary medical treatment. This exception does not apply if the patient has already refused similar treatments in the past in writing (e.g., through an advance directive, durable power of attorney, or by signing a Do Not Resuscitate order).
• Therapeutic privilege: A very rare exception arises when a physician can prove that disclosure of medical information would cause the patient such serious psychological distress that disclosure is contraindicated.

After being appropriately informed of risks, benefits, and alternatives of a contemplated treatment, procedure, or high-risk medication, a patient (or their designated decision-making authority) has the right to refuse. Physicians should emphasize the importance of the treatment or procedure and the consequences of no treatment, and the patient should be made aware of the ramifications of his or her decision. However, if the patient understands the risks of no treatment and still chooses to refuse, the informed refusal decision must be respected, regardless of how detrimental the physician or healthcare team members think the decision is. If, after receiving information about risks and benefits, a patient refuses a treatment or procedure, the patient’s refusal should be documented in the medical record and the patient should be asked to sign a refusal of treatment form. The physician should also document the process related to the informed refusal (the main points of the discussions about risks, benefits, and consequences of declining treatment).

Documentation of the informed consent discussion is important. Having a patient sign a form is supportive evidence that the informed consent process took place. However, a signed form cannot replace the elements documented in a patient’s record summarizing the discussion and education provided in the informed consent process that took place. Additional notation in the patient’s record about the details of the informed consent discussion (e.g., questions answered, risks pointed out that were specific to that person, or educational elements reviewed) can be crucial in defending a lawsuit for an alleged failure to obtain the patient’s informed consent. Informed consent litigation often pits the memory of the patient against the documentation of the physician. A doctor’s best defense in these types of cases is the information contained in the medical record, including not only a consent form signed by the patient but a description of the content of the informed consent discussion in the progress notes. This type of evidence significantly reinforces the physician’s testimony.

Physician practices should develop informed consent forms that meet state and federal requirements. The consent form should include the same elements as the consent discussion and should be written in language that the patient can understand. The elements on the form should include disclosure of information that a reasonable person would regard as significant in deciding to accept or reject a recommended procedure, including the following:

• An explanation of the patient’s problem and proposed procedure
• Complications (e.g., bleeding, possibility of additional procedures)
• Severity (e.g., death, paralysis and loss of function)
• Incidence of risks (e.g., 1 in 1000 experience this complication), which helps the patient put the risk, including loss of life or limb, in perspective
  • Information about common side effects (e.g., swelling or pain)
  • Names of other physicians/clinicians who will be performing parts of the procedure, e.g. PA harvesting a leg vein for a CABG procedure
• An explanation of the benefits of the procedure
• A discussion of alternative treatments
• A statement that there are no guarantees that the procedure will be 100% successful
• Information about potential outcomes if treatment is refused
• Encouragement of the patient to ask questions
• Acknowledgment that the patient can withdraw consent
• The offer of a second opinion, if applicable

If the person having the legal authority to consent for the patient is not available to discuss informed consent in person, the physician must obtain consent remotely by telephone, email, or facsimile. The responsible physician must, to the extent possible, provide the legal representative with the information needed to obtain consent just as if that person were present.

Excluding emergency situations, prior to obtaining consent by remote means (including telehealth), it is important to have an established relationship with the patient. When obtaining consent remotely:

• Verify the authenticity of the person legally authorized to consent for the patient by asking questions regarding DOB, address, phone numbers, etc.
• Have a second responsible person witness the call.
• Follow standard consenting process discussing the risks, benefits, and alternatives with the person authorized to consent as if the discussion were in-person.
• Document in the patient’s medical record that consent was obtained remotely, who consented, who obtained the consent, and who witnessed it.

After the consent discussion, you may request that the person provide documentation of consent by email or fax. Have the person giving consent send a declarative statement of the consent, such as:

“I, [their name and relationship to the patient], have been informed by Dr. X of the risks, benefits, and alternatives associated with the proposed treatment and grant permission for Dr. X to provide medical treatment [or a specific procedure or treatment] to [me or Patient’s Name].”

Attach or scan a copy of the email or fax to the medical record. Whenever possible, original, signed consents should be obtained and filed or scanned into the medical record.

Many factors, including a patient’s limited literacy skills, fear, sensory issues, level of intimidation, degree of modesty, or expectations regarding a specific outcome can diminish the patient’s ability to comprehend the consent process. Cultural and linguistic differences can also be barriers to a patient’s understanding. Since the informed consent process relies on discussion and education so that a patient can make an informed choice, it is a process that is heavily dependent on clear communication.

A study published in 2006 in the Journal of General Internal Medicine suggests various strategies for modifying the consent process for patients who may have problems understanding consent information. Specific modifications that were shown to reduce barriers and improve the consent process include:

• Using a more readable consent form (written with plain language, large font, short paragraphs, a lot of white space)
• Arranging for consent forms to be read to patients in their native languages
• Using an iterative “teach to goal” strategy (asking patients to answer questions to show their comprehension of material)

• Recognize that informed consent is a process, not a form. The consent form should never replace the discussion and education provided.
• Consider establishing a policy requiring consent within a certain period (e.g., 30 days) before the treatment.
  • If no specific time policy is imposed by a facility, reassess the situation to ensure the underlying framework for the consent is still applicable by questioning the patient about changes to doctors, prescriptions, over-the-counter medication, hospital visits, or new treatments.
• Develop a policy and procedure for the informed consent process that ensures that patients’ rights are honored. Recognize that the office setting is the best place for the discussion to occur when providing the patient with information that allows the patient to make a meaningful medical care decision.

Education

• Use educational pamphlets, handouts, pictures, and pre-op and post-op instructions to help patients understand what they need to know in order to make an informed decision.
  • Document in the patient’s record that the patient received these materials.
  • Referencing educational materials could be used as reminders of the discussion or if the consent is challenged at a later date.

The following resources from ProAssurance Risk Management are available to assist in developing and using the informed consent process.

• 2 Minutes: What’s the Risk video: Misconceptions About Informed Consent
• Sample Forms:
  • Informed Consent - General Use
  • Informed Consent Form - Telehealth
  • Informed Consent Checklist
  • Informed Consent - Dental
  • Informed Consent Form (Dental) Checklist
  • Refusal of Treatment Form

Documentation problems or errors may arise necessitating clarification and changes to the medical record. In these situations, it is imperative that proper procedures be followed to maintain the integrity of the medical record.

There is a difference between correcting an error and altering a record. Altering a medical record destroys credibility, casts doubt on the trustworthiness of every record and note in the chart, and severely damages defensibility in the event of a medical professional liability lawsuit. Plaintiffs’ attorneys can access metadata to discover alterations in an electronic medical record and can utilize techniques such as ink dating to discover alterations in a paper chart. Recommended techniques for making corrections to a medical record are outlined below.

Do not delete mistakes or errors in a paper medical record. Draw a thin line through the incorrect entry, then make the correct entry next to or above it. Note the date and time and sign the correction. Never render an original entry unreadable.

Corrections in an electronic medical record should follow the same principles as a paper record, and track the author, date, and time of the correction. If it does not, consider describing and authenticating the correction in a separate note.

When adding information to the medical record, reference the entry as an “addendum”. Sign, date and time it. Note the original entry date so that it is traceable to what is being changed.

Never make a correction or addendum to a medical record after a claim or lawsuit has been filed or after receiving notice that a claim or lawsuit might be filed. Correcting the record at that point is viewed as self-serving and undermines defensibility.

Copying previous or outdated information such as vital signs or notes may perpetuate medical errors and create liability issues. Develop policies designed to address inappropriate use of copy and paste functions to minimize non-compliance. For more detailed guidance, visit the Joint Commission and CMS.

Documentation templates may improve the efficiency of data collection and ensure all relevant elements are collected in a structured format. However, templates have limitations and may not reflect the clinical accuracy of the encounter. Use free text to supplement the inherent limitations associated with templates.

A federal law that went into effect in April 2021 requires electronic health information, including certain categories of clinical notes created in an electronic health record (EHR), to be provided to patients without undue delay. Such information is commonly provided through a secure online portal. For more information, please see the Office of the National Coordinator for Health Information Technology’s website.

 Develop a document retention policy, comply with all state and federal legal, regulatory, and accreditation requirements. Specify how long medical records should be retained, where they should be stored, and when and by whom they may be destroyed.

Assuming there are no conflicting laws or regulations, basic record-retention guidelines include:

1. Adult patients—Retain medical records for a minimum of 10 years after the last date of service.
2. Minor patients—Keep medical records until minors reach the age of majority as defined by the state, plus the time period specified by the state’s statute of limitations.

Store the medical record indefinitely if a claim or lawsuit is filed, notice is received that a claim might be filed in the future, or there is a significant or unexpected adverse outcome.

Keep all active paper medical records on site. Inactive patients’ paper records may be stored in an offsite facility if onsite storage space becomes an issue—or convert inactive patients’ records older than five years to electronic storage. You may also transfer active patients’ records to electronic storage if they are voluminous. There are vendors that provide electronic record storage, if needed.

Patient information must be protected from unauthorized access. Please consider potential issues with protected health information (PHI) being stored on electronic equipment (such as copiers and fax machines) that is used in the office prior to that equipment’s destruction or removal from use. If a paper record is stolen or damaged, contact a ProAssurance Risk Management Consultant for advice on how best to proceed (call 844-223-9648 or email RiskAdvisor@ProAssurance.com).

Other Considerations

1. If electronic records have been compromised or subjected to a cyberattack, contact a ProAssurance Risk Management Consultant for advice on how best to proceed (call 844-223-9648 or email RiskAdvisor@ProAssurance.com).
2. Take all necessary precautions to protect medical records from damage or loss due to fire, flood, or natural disaster.

For additional references, see the American Health Information Management Association website at AHIMA.org.

In general, the HIPAA Privacy Rule (“Rule”) prohibits physicians and all other healthcare providers from using or disclosing any PHI unless they have obtained permission from the patient or unless the Rule allows disclosure without the patient’s permission. It is recommended that practices consult their corporate attorney to help ensure HIPAA compliance.

Patient authorizations grant permission to release protected health information and patients can revoke authorizations at any time before they have been acted upon.  If the authorization is signed by a personal representative, a description of the representative’s authority to act for the patient should be included. Keep authorizations for at least six years in the event a patient requests an accounting of any disclosure of their protected health information.

Please see our Patient Authorization to Release Medical Information Sample Form at ProAssurance.com/SampleForms.

With a few exceptions, HIPAA gives patients the right to inspect and make a copy of information maintained in their record. Practices must act on a patient’s request for access within 30 days of the request (60 days if the records are kept off-site). Practices with an EMR are also subject to the “information blocking” provisions of the 21st Century Cures Act and must generally make medical records available to patients “without unnecessary delay.”

A reasonable, cost-based fee is allowed for copy requests. This fee may only include the costs of copying and postage. Many states have rules limiting the amount a practice may charge for copying a medical record. Be sure to review your state’s rules regularly as some are adjusted annually.

When an attorney makes a request for records, have the physician review the request and the patient’s records, so they can take appropriate action, including notifying a ProAssurance Claims Specialist. Establish a screening process to help ensure the physician is notified of requests for records from attorneys.

To help prevent incurring fines or breaching patient confidentiality, consider developing a process for responding to subpoenas in the timely and proper manner required by law. A subpoena can be for medical records or witness testimonies. A subpoena response policy should include the following elements:

• Designate someone (and a backup) to follow up on all subpoenas received.
• Develop and use a log to record the receipt of the subpoena with the date and time, the name of the server (if served in person), and the initials of the receiver.
• If you receive a subpoena contact the Claims Intake Line at 877-778-2524 or ReportClaim@ProAssurance.com. A ProAssurance Claims Specialist will help determine the validity of a subpoena, what process applies to the type of subpoena received, and what you can or cannot release in response to the subpoena.
• Designate who will locate relevant records and who will review them before release.
• With the help of the Proassurance Claims Specialist, describe the circumstances in which a physician will review the records before releasing them.
• Describe the process for copying the records and for calculating the copying and delivery fees you may charge. All applied fees should be in accordance with state law and HIPAA regulations.

For more information on responding to subpoenas, see the Two Minutes: What's the Risk? video, “Responding to Subpoenas.”

Patients can request amendments to their protected health information (PHI) if they believe it is incorrect or incomplete. This right is a critical aspect of HIPAA, aiming to give individuals more control over their health records. Covered entities must provide a process for making such requests and respond within a specified timeframe. As a provider, you have the right to deny a patient’s request to amend the record if any of the following conditions exist:

1. You or your practice did not create the note in question. You cannot change another practice’s note.
2. It is not part of the designated record set. This is why it is best to have a policy to state what records are included in the designated record set.
3. The information documented is accurate and complete.

For detailed guidelines and procedures refer to Code of Federal Regulations Title 45 and consult with healthcare legal experts.

Refer to the ProAssurance sample Patient Request to Amend the Medical Record Form on the ProAssurance Sample Forms, Checklists, and Letters resource page.

Watch our Two Minutes: What's the Risk? video, Amending Medical Records.

Under the HIPAA Privacy Rule, a deceased patient’s protected health information is protected for fifty (50) years following the date of death of the individual. During this period, the personal representative of the deceased patient can request and access the individual’s medical records. In certain circumstances, applicable law may allow for the release of a deceased patient’s records to the deceased next of kin, or other legally authorized individuals.

If a member of the practice has any doubt about whether a person has the legal authority to request the release of a deceased patient’s records, consult with legal counsel or contact ProAssurance’s Risk Management department.

HIPAA preempts state laws that are less stringent than HIPAA, but states may enact laws that are more stringent than HIPAA. Federal and state laws may impose additional requirements to protect the confidentiality of certain classes of information or medical conditions (e.g., information pertaining to treatment of behavioral health, diagnosis and/or treatment of alcohol or substance abuse, and HIV test results). Those laws require, among other things, a separate patient authorization for each disclosure of that type of health information or medical records containing such health information. Physicians should seek legal counsel’s advice about laws and regulations relative to the release of these categories of information.

The United States Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA. The OCR website provides helpful HIPAA compliance information and a “frequently asked questions” on HIPAA Privacy regulations. Access the website at HHS.gov/HIPAA/index.html.