Resource Library

The informed consent process is an excellent time to engage patients. Ideally, an informed consent to treatment is the end result of a shared decision making process between a clinician and patient. This process, when executed appropriately, can have many benefits. It can decrease liability exposure, increase patient adherence, protect the patient’s right to self-determination and increase patient satisfaction.¹

Although physician empathy may seem to be a low priority in comparison to clinical skill, research indicates that physician empathy has wide-ranging effects for both physicians and patients, including better patient outcomes, greater patient satisfaction, less stress and burnout, and — as the following case studies show — it can affect whether a patient files a medical liability lawsuit.

A common scenario in email security breaches is seen when a billing service sends a bill to an incorrect email address. In most practice arrangements, a third-party billing company will have signed a business associate agreement. According to HIPAA, business associates must inform covered entities when they discover a security breach; however, HHS gives covered entities and business associates flexibility in defining, in the business associate agreements, how and when a business associate should notify the covered entity of a potential breach.¹ Consider the following case. (Please note that the following case focuses on the clinic’s responsibility to analyze the risk and perform the breach notification, even though the breach was caused by a business entity.)

According to HHS data, more than a third of all data breaches reported through 2017 involved a laptop, desktop, or mobile device.¹ Compare Cases One and Two, and consider how better security practices protected the covered entity in Case Two.

Employees access PHI for various illegitimate reasons. Including error and misuse, 71% of all cyber incidents in healthcare have an insider source¹— the only industry that has more internal sources than external. Although the following case study involves only one patient, the covered entity was required to complete a data breach analysis and notify the patient and HHS.