By the end of this chapter, you should be able to:
Differentiate between civil, criminal, and contract law as they apply to medical assisting.
Define the four elements of negligence (malpractice) and identify the standard of care.
Apply the principles of informed consent, implied consent, and expressed consent.
Explain the HIPAA Privacy Rule, including the minimum necessary standard and permitted disclosures.
Distinguish between the Patient Bill of Rights, advance directives, living wills, and durable power of attorney.
Identify the medical assistant's role in reporting abuse, communicable diseases, and vital statistics.
Recognize the scope of practice for a CCMA and the consequences of practicing outside that scope.
Apply the AHA CPR guidelines and OSHA Bloodborne Pathogens Standard in the ambulatory care setting.
1.1 Foundations of Law and Ethics
Law is a system of rules enforced by governmental authority. Ethics is a system of moral principles guiding behavior. For the CCMA, legal compliance is mandatory; ethical behavior is a professional obligation. The two overlap, but not everything legal is ethical, and not everything ethical is legal.
Sources of Law:
Statutory law: Written laws enacted by federal or state legislatures (e.g., state medical practice acts).
Administrative law: Rules and regulations created by agencies (e.g., OSHA, CDC, state health departments).
Common law: Law established by court decisions (precedent) in cases.
Types of Law Relevant to the CCMA:
Criminal law: Wrongs against society. Examples: Medicare fraud, illegal prescribing, practicing medicine without a license. Punishment is fines or imprisonment.
Civil law: Wrongs against an individual. This includes torts (wrongful acts) and contracts.
Contract law: Enforceable agreements. In healthcare, an implied contract exists when a patient presents for treatment and the provider accepts them. A breach occurs when either party fails to fulfill the agreement (e.g., patient refuses to pay; provider abandons care).
Torts:
Intentional torts: Assault (threat of harm), battery (unwanted touching), defamation (slander—spoken; libel—written), false imprisonment (unlawful restraint, e.g., holding a patient against their will without legal authority).
Unintentional torts: Negligence and malpractice.
Negligence (Malpractice) — The Four Ds:
27.Duty: The provider had a legal obligation to care for the patient.
28.Dereliction (Breach): The provider failed to meet the standard of care (what a reasonably prudent MA with similar training would do).
29.Direct Cause: The breach directly caused the injury.
30.Damages: The patient suffered actual harm (physical, financial, or emotional).
Standard of Care: The level of competence expected of a professional with the same training and in the same situation. For a CCMA, this means performing only tasks taught in an accredited program and authorized by state law and the supervising provider.
Good Samaritan Laws: Protect individuals who provide emergency care in good faith, without expectation of payment, and outside their normal workplace. They do not protect against gross negligence. In a clinic, you are not covered by Good Samaritan laws because you have a duty to act.
1.2 Consent and Patient Rights
Informed Consent: The patient must voluntarily give permission for a treatment or procedure after receiving full disclosure of:
The diagnosis or condition.
The nature and purpose of the proposed treatment.
The risks and benefits.
Alternatives (including no treatment).
The right to refuse.
Key Rule: The provider (physician, NP, PA) is responsible for obtaining informed consent. The medical assistant may witness the signature and ensure the form is signed, but the MA must never explain the risks or answer clinical questions about the procedure. If the MA obtains consent, it is considered a breach of scope of practice.
Types of Consent:
Expressed consent: Verbal or written permission (e.g., signing a surgical consent).
Implied consent: Assumed in an emergency when the patient is unconscious or unable to consent, and immediate treatment is necessary to save life or prevent serious harm. Also applies to routine actions like taking a blood pressure when the patient extends their arm.
Involuntary consent: Given by a court or legal guardian (e.g., for a minor or incapacitated adult).
Minors: Generally, a parent or legal guardian must consent. Exceptions (emancipated minors, mature minors) vary by state. An emancipated minor is self-supporting, married, or in the military. Minors may consent without parental approval for certain services (STI testing, pregnancy care, substance abuse treatment) per state law.
Refusal of Care: A competent adult has the right to refuse treatment, even if it is life-saving. The MA must document the refusal and ensure the patient signs an "Against Medical Advice" (AMA) form. If the patient refuses to sign, document that they refused to sign.
Patient Self-Determination Act: Requires healthcare facilities to inform patients of their rights to make advance directives upon admission.
Advance Directives:
Living will: A written document stating which life-sustaining treatments the patient wants or does not want if they become incapacitated.
Durable power of attorney for healthcare (Healthcare proxy): A legal document naming a person to make healthcare decisions for the patient if they cannot.
Do Not Resuscitate (DNR) order: A physician's order to withhold CPR in the event of cardiac or respiratory arrest.
Role of the MA: File the advance directive in the chart, flag it, and inform the provider. You do not interpret or judge the document. You must honor it.
1.3 HIPAA and Confidentiality
HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule: Protects all "protected health information" (PHI) — any information that identifies a patient and relates to their physical or mental health, treatment, or payment.
PHI includes: Name, address, birth date, Social Security number, medical record number, photographs, and any clinical data.
Minimum Necessary Standard: Use or disclose only the least amount of PHI needed to accomplish the purpose. For example, a front-desk MA needs to know the patient's name and appointment time, but not their lab results.
Permitted Disclosures (without authorization):
To the patient themselves.
For treatment, payment, and healthcare operations (TPO).
To public health authorities for reporting communicable diseases.
To law enforcement in specific cases (e.g., gunshot wounds, abuse).
For organ donation, research (with IRB approval), or workers' compensation.
Authorization: Any other disclosure (e.g., to an employer, attorney, or family member) requires a signed, dated authorization from the patient specifying what information can be shared and with whom.
MA Responsibilities:
Never discuss patient information in public areas (hallways, elevators, waiting rooms).
Shred documents containing PHI.
Log off computer screens when away from the workstation.
Use secure passwords and do not share them.
Verify the identity of the person requesting information over the phone before releasing any data.
Do not leave patient charts or printed lab results unattended.
Breach: Any unauthorized acquisition, access, or disclosure of PHI. The MA must report a suspected breach to the Privacy Officer immediately. Do not attempt to cover it up.
1.4 Medical Records and Documentation
The medical record is a legal document. It is the property of the healthcare provider, but the patient has a right to access and obtain copies.
Documentation Rules:
Use black ink only.
Write legibly.
Record the date and time of every entry.
Sign every entry with your name and credentials (e.g., "J. Smith, CMA (AAMA)" or "CMA").
Never use correction fluid. Draw a single line through the error, write "error" or "mistaken entry," initial and date it, and write the correct information.
Never chart in advance or backdate.
Chart only facts, not opinions. Instead of "patient is angry," write "patient stated, 'I am upset about the wait.'"
Corrections: If a correction is needed after the fact, add a late entry with the current date and time, referencing the original entry.
Release of Records: A signed authorization is required. The MA may prepare the records but should never alter them to "help" the patient or the provider.
Electronic Health Records (EHR): Use your unique login. Never share passwords. Use the audit trail function to track who accessed a record. If you make an error in an EHR, use the "correction" function, never delete the original entry.
1.5 Professional and Legal Boundaries
Scope of Practice: The CCMA works under the supervision of a licensed provider (physician, PA, NP). You may perform tasks delegated by the provider, but you must be trained and competent. You cannot:
Diagnose or prescribe.
Interpret test results (you can report the result to the provider).
Give medical advice.
Perform invasive procedures beyond your training (e.g., starting IVs, giving IV push medications, unless state law and your training allow it).
Delegation: The provider delegates tasks. The MA is responsible for accepting or refusing a delegated task. If you are not trained or feel unsafe, you must refuse and inform the provider. Accepting a task you cannot perform is negligence.
Fraud and Abuse:
Fraud: Intentional deception for financial gain (e.g., billing for services not performed, upcoding).
Abuse: Practices that are inconsistent with sound fiscal practice (e.g., excessive charges, unnecessary tests).
Mandatory Reporting: The MA is a mandated reporter. You must report:
Suspected child abuse or neglect (to Child Protective Services).
Suspected elder abuse or neglect (to Adult Protective Services).
Communicable diseases (to the local health department) — e.g., tuberculosis, syphilis, HIV, hepatitis.
Vital statistics: births and deaths (to the state registrar).
Gunshot wounds and other violent injuries (to law enforcement).
Failure to report is a crime and a breach of ethics.
1.6 Safety, OSHA, and Infection Control
OSHA Bloodborne Pathogens Standard: Requires employers to have an Exposure Control Plan, provide PPE (gloves, gowns, masks, eye protection), offer the Hepatitis B vaccine free of charge, and provide training. The MA must:
Treat all blood and body fluids as potentially infectious (Universal Precautions).
Use engineering controls (sharps containers, safety needles).
Use work practice controls (no recapping needles, no bending needles).
CDC Standard Precautions: Apply to all patients, regardless of diagnosis. Includes hand hygiene, PPE, safe injection practices, and respiratory hygiene/cough etiquette.
Transmission-Based Precautions: Used in addition to Standard Precautions for specific diseases.
Contact precautions: For MRSA, C. diff, wound infections. Use gloves and gown.
Droplet precautions: For influenza, meningitis, pertussis. Use mask and eye protection.
Airborne precautions: For tuberculosis, measles, chickenpox. Use N95 respirator, negative pressure room.
Hand Hygiene: The single most important way to prevent infection. Wash with soap and water for at least 20 seconds when hands are visibly soiled, after using the restroom, and before eating. Use alcohol-based hand rub for routine decontamination.
Sharps Safety: Dispose of needles immediately after use in a puncture-resistant, leak-proof sharps container. Never recap. If you sustain a needlestick injury: wash the area with soap and water, report to your supervisor immediately, seek medical evaluation, and complete an incident report.
AHA CPR Guidelines: For adults, compress the chest at a rate of 100–120 per minute, depth of at least 2 inches (5 cm), allowing full chest recoil. Ratio of compressions to breaths is 30:2 for one rescuer. Use an AED as soon as available. For children, compress at least one-third the depth of the chest (about 2 inches). For infants, use two fingers or two thumbs.
CLIA Waived Testing: The CCMA may perform tests categorized as "waived" under CLIA (Clinical Laboratory Improvement Amendments). These are simple tests with low risk of error (e.g., urine dipstick, glucose meter, rapid strep test, pregnancy test). You must follow the manufacturer's instructions exactly, run quality control (QC) as required, and document QC results. You cannot perform moderate or high complexity testing without additional certification.
1.7 Patient Education and Ethics
Patient Education: The MA provides education on:
Medication administration (how to take, side effects to report).
Diet and lifestyle modifications.
Pre- and post-procedure instructions.
Preventive care (e.g., CDC immunization schedule for adults and children).
Ethical Principles:
Autonomy: Respect the patient's right to make decisions.
Beneficence: Act in the patient's best interest.
Nonmaleficence: Do no harm.
Justice: Treat all patients fairly, regardless of race, gender, insurance status, or ability to pay.
Confidentiality vs. Duty to Warn: If a patient threatens to harm a specific person, the provider has a duty to warn the intended victim and law enforcement (Tarasoff rule). This overrides confidentiality.
Common Exam Traps
136.Confusing "informed consent" with "witnessing a signature." The MA can witness, but the provider must obtain consent. If the MA explains risks, it is a scope-of-practice violation.
137.Mixing up "implied consent" and "informed consent." Implied is for emergencies or routine actions; informed is for invasive procedures.
138.Thinking HIPAA forbids ALL sharing. HIPAA permits sharing for TPO (treatment, payment, operations) without authorization. Sharing with a family member requires authorization unless the patient is present and does not object.
139.Choosing "assault" vs. "battery." Assault is the threat; battery is the actual unwanted touch. If a patient says "I will hit you" and then swings, both occurred.
140.Wrong order for the Four Ds. Duty → Dereliction → Direct Cause → Damages. Students often swap "Direct Cause" and "Damages."
141.Believing Good Samaritan laws cover you at work. They do not. You have a duty to act in your workplace.
142.Using correction fluid or erasing errors in a chart. This is a red flag for fraud. Use a single line, initial, and date.
143.Recapping needles. This is the most common cause of needlestick injuries. Never recap.
145.Forgetting that the patient owns the information, not the record. The provider owns the physical record, but the patient has a right to access and request amendments.
146.Charting opinions. "Patient is non-compliant" is an opinion. "Patient declined the medication" is a fact.
147.Thinking CLIA waived tests require no QC. They do require QC, just less frequently than high complexity tests.
148.Confusing the Hepatitis B vaccine with immune globulin. The vaccine is for pre-exposure prevention; immune globulin is for post-exposure prophylaxis.
149.Believing a minor can never consent. Emancipated minors and specific services (STI, pregnancy) are exceptions.
150.Forgetting the "minimum necessary" rule. Releasing an entire chart when only the lab result was requested is a HIPAA violation.
Summary for the Exam
Know the four Ds of negligence.
Know who obtains informed consent (provider) and who witnesses (MA).
Know the difference between living will and durable power of attorney.
Know that HIPAA allows TPO disclosures without authorization.
Know the OSHA and CDC rules for PPE, sharps, and hand hygiene.
Know the AHA CPR compression rate (100–120/min) and ratio (30:2).
Know that CLIA waived tests are the only tests an MA may perform.
Know your scope of practice: never diagnose, prescribe, or interpret.
Master these concepts, and you will be prepared for the Medical Law and Ethics portion of the NHA CCMA exam.
