• Plan what you intend to say and review your plan with a ProAssurance Claims Specialist, if possible.
• Consider having a fact witness present during the discussion, perhaps your nurse or one of your partners.
• Spend plenty of time with the patient and family members. Listen to their questions and answer them to the best of your ability.
• Focus on the patient, not on yourself.
• Sincerely acknowledge the patient’s and/or family’s suffering. Do not belittle a complication. Do not point fingers or blame other physicians or staff members.
• Apologizing for the fact that the incident occurred may be appropriate. Example: “I’m sorry this has happened to you, and I want to assure you I’ll continue to oversee your care.”
• Do not overwhelm the patient and family with information. In complicated cases, it is best to schedule multiple conversations so they can better digest your information.
• Discuss the patient’s current condition and continued treatment, as well as the event’s definitive medical consequences on the patient’s health (if known).
• Do not speculate. If you do not know what happened, admit this. Then tell the patient and family you are investigating the situation and will let them know as soon as you have answers.
• Assume all conversations with patients are being recorded and conduct conversations accordingly.
• Provide the patient and family with your contact information.

• The date, time, and location of the discussion.
• The parties and relationships of those present.
• Your commitment to share additional information as it becomes available and to assist the patient and family.

Do not make any admissions of liability or statements of blame. Do not make any references to the cause of the outcome or any future peer review proceedings.

For more information, see Two Minutes: What’s the Risk? Unexpected Outcomes.

It is the physician’s non-delegable responsibility to educate the patient about the proposed course of treatment or surgical procedure, and to discuss the associated risks, benefits, and alternatives, including no treatment.

It is the patient’s responsibility to weigh the information and make an informed decision. Informed consent is NOT only a signed form but is a process that encompasses three elements:

• Discussion
• Decision
• Documentation

The purpose of an informed consent discussion is to encourage questions, dialogue, and understanding, allowing the patient to make an informed decision about whether to proceed with the physician’s recommendations. Explain what is known, what is suspected, and risks if left untreated. Conduct informed consent discussions in easily understood lay terminology, with ample time for questions. The discussion should include:

• Diagnosis
• Recommended treatment
• Alternative treatments
• Prognosis/risks/benefits

Informed consent to medical treatment is fundamental in both ethics and law. It empowers patients to make well-considered decisions about their treatment and appreciate the risks and benefits involved. Ensuring patients are fully informed about their medical condition and options is critical in shared decision making and is necessary to make a voluntary decision. The first step is assessing the patient’s ability to understand relevant medical information, the implications of treatment, and alternatives.

Document the informed consent process in the patient’s medical record, including:

• An informed consent discussion occurred including the associated risks, benefits, and alternatives
• The patient had the opportunity to ask questions
• The patient understood the information provided, the possible risks, and agreed to proceed
• If the patient refuses treatment (see sample form below)
• If the patient received or viewed handouts, with a brief description of the material provided

Download Refusal of Treatment Form.

In addition to documenting the informed consent discussion, obtaining the patient’s signature on a consent form provides evidence that an informed consent discussion occurred. Consent forms should include the same elements as the discussion, written in easily understood lay language.

• Consider using procedure-specific forms that identify the most common risks and complications. However, it is helpful to provide space to list additional risks and alternatives, depending on the patient’s condition.
• Whether procedure-specific or generic forms are used, complete the forms in their entirety.
• The patient should sign only if they understand the risks, benefits, and alternatives of the proposed procedure or treatment.
• The physician should consider personally signing the consent form.
• Include the patient signature, date, and time stamp.
• You can access sample consent forms at ProAssurance.com/SampleForms.

In some jurisdictions, state law dictates provisions that must be included in informed consent forms. Be sure to comply with your state’s requirements.

(Surrogate Decision Makers)

State law covers surrogate healthcare decision-making, including patients’ designation of proxies and court appointment of decision-makers, so physicians should know and follow the rules in their states. The American Medical Association has developed additional guidance on this topic. 

When a series of treatments is indicated, the informed consent discussion should include:

•  A specified number or schedule of treatments (e.g., one per week for four weeks, etc.) and indicate a specified end date.
•  During each visit, review the established consent to determine any changes to the patient’s condition, necessitating the initiation of a new consent process and form.

Discuss and document that you advised the patient of the risks involved in refusing treatment and note the patient’s rationale for their decision. Consider having the patient sign an informed refusal form and provide a copy to the patient. This form should indicate the treatment/procedure was explained, the risks of refusing treatment were discussed, and the patient elected to refuse. When a patient refuses treatment, encourage them to obtain a second opinion and document this discussion.

Consent to treat a minor is generally obtained from a parent, legal guardian, or an individual legally recognized to act on the minor’s behalf. This may be complicated when parents are divorced, the minor is in foster care or emancipated, or a state statute governs consent for a specific treatment.

Divorced parents generally retain the right to consent for treatment of their children unless a court order denies that right. If it is unclear which divorced parent can legally consent to a minor’s treatment, request a copy of the court order and maintain a copy in the minor’s medical record.

If a minor is in foster care, the relevant court order should cover who has the authority to consent for the minor’s treatment.

Many states have laws defining minors who are competent to consent for treatment. Most states also have provisions in which competent minors may arrange for their own care involving contraceptives, pregnancy, drug and alcohol abuse, and psychiatric disorders. ProAssurance strongly encourages you to familiarize yourself with your state’s specific informed consent requirements for minors.

It is prudent to follow these guidelines regarding minors and informed consent:

• Develop written informed consent policies and procedures for consent by minors.
• In most situations, state law requires physicians to obtain parental consent.
• When a minor has a serious medical emergency and the physician cannot locate a parent or legal guardian, the physician may choose to render emergency treatment immediately, and then continue to search for a parent or legal guardian.
• When a minor is legally emancipated or permitted by state law to consent to medical treatment—and there is a risk the minor will not receive care if the physician notifies a parent or legal guardian—informed consent may be obtained directly from the minor patient.
• Establish a written policy and procedure for obtaining informed consent via telephone. Include a provision that two witnesses listen to the informed consent discussion and obtain the signatures of both witnesses.
• State law may govern a minor patient’s right to consent to testing or treatment. Before agreeing to test a minor without the minor’s consent (e.g., when a parent or legal guardian requests drug testing), it is important to determine whether any state-specific laws apply. If a minor patient has the right to consent without the additional consent of a parent or guardian, the minor patient may need to be informed and be provided the ability to consent before any tests are performed.
• Physicians who wish to accommodate unaccompanied minors may have a parent or guardian sign an authorization that consents to treatment for a certain period, for a specific diagnosis.

Please see the Informed Consent Form and Informed Consent Checklist at ProAssurance.com/SampleForms.

Documentation problems or errors may arise necessitating clarification and changes to the medical record. In these situations, it is imperative that proper procedures be followed to maintain the integrity of the medical record.

There is a difference between correcting an error and altering a record. Altering a medical record destroys credibility, casts doubt on the trustworthiness of every record and note in the chart, and severely damages defensibility in the event of a medical professional liability lawsuit. Plaintiffs’ attorneys can access metadata to discover alterations in an electronic medical record and can utilize techniques such as ink dating to discover alterations in a paper chart. Recommended techniques for making corrections to a medical record are outlined below.

Do not delete mistakes or errors in a paper medical record. Draw a thin line through the incorrect entry, then make the correct entry next to or above it. Note the date and time and sign the correction. Never render an original entry unreadable.

Corrections in an electronic medical record should follow the same principles as a paper record, and track the author, date, and time of the correction. If it does not, consider describing and authenticating the correction in a separate note.

When adding information to the medical record, reference the entry as an “addendum”. Sign, date and time it. Note the original entry date so that it is traceable to what is being changed.

Never make a correction or addendum to a medical record after a claim or lawsuit has been filed or after receiving notice that a claim or lawsuit might be filed. Correcting the record at that point is viewed as self-serving and undermines defensibility.

Copying previous or outdated information such as vital signs or notes may perpetuate medical errors and create liability issues. Develop policies designed to address inappropriate use of copy and paste functions to minimize non-compliance. For more detailed guidance, visit the American Health Information Management Association’s website.

Documentation templates may improve the efficiency of data collection and ensure all relevant elements are collected in a structured format. However, templates have limitations and may not reflect the clinical accuracy of the encounter. Use free text to supplement the inherent limitations associated with templates.

A federal law that went into effect in April 2021 requires electronic health information, including certain categories of clinical notes created in an electronic health record (EHR), to be provided to patients without undue delay. Such information is commonly provided through a secure online portal. For more information, please see the Office of the National Coordinator for Health Information Technology’s website.

 Develop a document retention policy, comply with all state and federal legal, regulatory, and accreditation requirements. Specify how long medical records should be retained, where they should be stored, and when and by whom they may be destroyed.

Assuming there are no conflicting laws or regulations, basic record-retention guidelines include:

1. Adult patients—Retain medical records for a minimum of 10 years after the last date of service.
2. Minor patients—Keep medical records until minors reach the age of majority as defined by the state, plus the time period specified by the state’s statute of limitations.

Store the medical record indefinitely if a claim or lawsuit is filed, notice is received that a claim might be filed in the future, or there is a significant or unexpected adverse outcome.

Keep all active paper medical records on site. Inactive patients’ paper records may be stored in an offsite facility if onsite storage space becomes an issue—or convert inactive patients’ records older than five years to electronic storage. You may also transfer active patients’ records to electronic storage if they are voluminous. There are vendors that provide electronic record storage, if needed.

Patient information must be protected from unauthorized access. Please consider potential issues with protected health information (PHI) being stored on electronic equipment (such as copiers and fax machines) that is used in the office prior to that equipment’s destruction or removal from use. If a paper record is stolen or damaged, contact a ProAssurance Risk Management Consultant for advice on how best to proceed (call 844-223-9648 or email RiskAdvisor@ProAssurance.com).

Other Considerations

1. If electronic records have been compromised or subjected to a cyberattack, contact a ProAssurance Risk Management Consultant for advice on how best to proceed (call 844-223-9648 or email RiskAdvisor@ProAssurance.com).
2. Take all necessary precautions to protect medical records from damage or loss due to fire, flood, or natural disaster.

For additional references, see the American Health Information Management Association website at AHIMA.org.

In general, the HIPAA Privacy Rule (“Rule”) prohibits physicians and all other healthcare providers from using or disclosing any PHI unless they have obtained permission from the patient or unless the Rule allows disclosure without the patient’s permission. It is recommended that practices consult their corporate attorney to help ensure HIPAA compliance.

Patient authorizations grant permission to release protected health information and patients can revoke authorizations at any time before they have been acted upon.  If the authorization is signed by a personal representative, a description of the representative’s authority to act for the patient should be included. Keep authorizations for at least six years in the event a patient requests an accounting of any disclosure of their protected health information.

Please see our Patient Authorization to Release Medical Information Sample Form at ProAssurance.com/SampleForms.

With a few exceptions, HIPAA gives patients the right to inspect and make a copy of information maintained in their record. Practices must act on a patient’s request for access within 30 days of the request (60 days if the records are kept off-site). Practices with an EMR are also subject to the “information blocking” provisions of the 21st Century Cures Act and must generally make medical records available to patients “without unnecessary delay.”

A reasonable, cost-based fee is allowed for copy requests. This fee may only include the costs of copying and postage. Many states have rules limiting the amount a practice may charge for copying a medical record. Be sure to review your state’s rules regularly as some are adjusted annually.

When an attorney makes a request for records, have the physician review the request and the patient’s records, so they can take appropriate action, including notifying a ProAssurance Claims Specialist. Establish a screening process to help ensure the physician is notified of requests for records from attorneys.

Patients can request amendments to their protected health information (PHI) if they believe it is incorrect or incomplete. This right is a critical aspect of HIPAA, aiming to give individuals more control over their health records. Covered entities must provide a process for making such requests and respond within a specified timeframe. As a provider, you have the right to deny a patient’s request to amend the record if any of the following conditions exist:

1. You or your practice did not create the note in question. You cannot change another practice’s note.
2. It is not part of the designated record set. This is why it is best to have a policy to state what records are included in the designated record set.
3. The information documented is accurate and complete.

For detailed guidelines and procedures refer to Code of Federal Regulations Title 45 and consult with healthcare legal experts.

Refer to the ProAssurance sample Patient Request to Amend the Medical Record Form on the ProAssurance Sample Forms, Checklists, and Letters resource page.

Under the HIPAA Privacy Rule, a deceased patient’s protected health information is protected for fifty (50) years following the date of death of the individual. During this period, the personal representative of the deceased patient can request and access the individual’s medical records. In certain circumstances, applicable law may allow for the release of a deceased patient’s records to the deceased next of kin, or other legally authorized individuals.

If a member of the practice has any doubt about whether a person has the legal authority to request the release of a deceased patient’s records, consult with legal counsel or contact ProAssurance’s Risk Management department.

HIPAA preempts state laws that are less stringent than HIPAA, but states may enact laws that are more stringent than HIPAA. Federal and state laws may impose additional requirements to protect the confidentiality of certain classes of information or medical conditions (e.g., information pertaining to treatment of behavioral health, diagnosis and/or treatment of alcohol or substance abuse, and HIV test results). Those laws require, among other things, a separate patient authorization for each disclosure of that type of health information or medical records containing such health information. Physicians should seek legal counsel’s advice about laws and regulations relative to the release of these categories of information.

The United States Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA. The OCR website provides helpful HIPAA compliance information and a “frequently asked questions” on HIPAA Privacy regulations. Access the website at HHS.gov/HIPAA/index.html.

• Consult state laws and regulations regarding licensure.
• Review the telehealth resource page provided by the U.S. Department of Health and Human Services.

• Assess your system to determine if improvements are needed.
• Plan the telehealth workflow.
• Verify patients are tech-ready (e.g., reliable internet access, smartphone, tablet, etc.). Technological fluency and internet-access limitations of a patient population may limit the efficacy of telemedicine.
• Identify conditions for which telemedicine allows an appropriate assessment.
• Ensure the patient has the technology and connectivity necessary to be adequately examined, the capability to utilize the technology needed, and a condition that does not require an in-person visit. Have a back-up plan, such as switching to a telephone conference or rescheduling an in-person examination.

There are multiple factors a physician should consider when obtaining consent. Some states specifically regulate the process for informed consent in telemedicine.

The informed consent process includes that the patient agrees to and understands the limits of confidentiality when communicating via an electronic medium and that it may be determined that telehealth is not appropriate for the diagnosis and treatment of his or her condition.

For more information view Two Minutes: What's the Risk? Telemedicine and Informed Consent above and consider ProAssurance sample Telehealth Informed Consent form.

Download Telehealth Informed Consent Sample Form.

• Follow standard documentation practices with all telemedicine encounters, including all communications with or about the patient; tests and results; follow-up recommendations.
• Develop a system to identify and monitor patients requiring subsequent in-person evaluation and treatment (i.e., recall, tracking, follow-up).
• Document any technical issues that interfered with, delayed, or complicated the telehealth encounter. For example, poor internet connectivity or signal quality, camera or device malfunction, patient inability to manage technical aspects of the exam, or peripheral device unavailability.
• In states without independent practice regulations, physicians supervising allied healthcare professionals should document training of all supervised clinicians in the use of the chosen telemedicine platform.

For further information see The National Telehealth Policy Resource Center maintained by the Center for Connected Health Policy (CCHP).