Health Law and Ethics
Health Law and Ethics tests the legal rules governing record access, consent, disclosure, and liability, together with the ethical standards that constrain coding decisions. Items combine a legal trigger - a subpoena, a minor, a request for substance use records - with a documentation or ethics question.
Legal foundations
Sources of law run from constitution to statute to regulation to case law. HIPAA sets a federal floor; stricter state law still applies. Negligence requires duty, breach, causation, and damages; malpractice is professional negligence, and respondeat superior holds employers liable for employees acting within scope. Statutes of limitation and discovery rules determine how long records matter.
Consent and special protections
Informed consent covers the nature of the procedure, risks, benefits, alternatives, and consequences of refusal, with an emergency exception and rules for minors, emancipated minors, and guardians. 42 CFR Part 2 restricts substance use disorder records more tightly than HIPAA and generally requires specific consent for disclosure; state laws add protections for HIV, mental health, and genetic information (GINA).
Legal process and mandatory reporting
A subpoena is not a court order. HIPAA permits subpoena-driven disclosure only with satisfactory assurances, such as proof the individual was notified and given time to object, or a qualified protective order. Legal holds require preservation. Mandatory reporting covers suspected abuse and neglect, certain wounds, communicable diseases, vital records, and adverse events. EMTALA requires a medical screening examination and stabilizing treatment regardless of ability to pay.
Ethics
AHIMA's Code of Ethics and Standards of Ethical Coding require coding only documented conditions and procedures, refusing to alter codes to maximize payment, querying for clarification, protecting confidentiality, and reporting improper conduct. Fraud is intentional; abuse is inconsistent with accepted practice and may be unintentional, but both are actionable.
Worked example
A plaintiff attorney serves a subpoena for a patient record with no authorization and no court order. The correct reasoning: the subpoena alone is insufficient under HIPAA. Obtain satisfactory assurances - a written statement that the patient was notified and the objection period expired, or a qualified protective order - verify the requester's authority, release only the minimum necessary, and log the disclosure. Releasing the full record on the subpoena alone is a privacy breach.
Traps that cost marks
Treating a subpoena as a court order; assuming HIPAA preempts stricter state law; releasing more than the minimum necessary; coding a diagnosis documented only in a nursing note or in a query response never added to the record; and failing to recognize that an unethical coding instruction is reportable even when a supervisor gave it.