18.3 Documentation, Legal Concepts & Confidentiality
Key Takeaways
- Wound documentation should record etiology, anatomic location, measurements (length, width, depth, undermining, and tunneling by clock position), tissue types by percentage, exudate, odor after cleansing, periwound skin, pain, signs of infection, treatment, patient education, and response, using consistent methods at each visit.
- Medical negligence requires four elements: a duty of care, breach of the standard of care, causation linking the breach to harm, and damages; common wound-related claims involve pressure injuries, missed ischemia or osteomyelitis, delayed referral, and incomplete documentation.
- Never alter past entries; corrections and late entries must be clearly labeled with the current date, time, author, and reason, and electronic health record audit trails preserve every change.
- Under HIPAA, wound photographs are protected health information; breaches of unsecured information require notice to affected individuals without unreasonable delay and no later than 60 days after discovery, with media and prompt HHS notice when 500 or more residents of a state or jurisdiction are affected.
- Clinicians must follow state mandatory reporting laws for suspected abuse or neglect of children, elders, and dependent adults, and wound documentation should describe findings objectively without speculation about cause.
18.3 Documentation, Legal Concepts & Confidentiality
Core Clinical Principle: The medical record is how the care team communicates, how payers judge medical necessity, and how courts decide whether care met the standard. Accurate, consistent, and timely documentation protects patients first and clinicians second, and confidentiality rules protect the trust that care depends on.
The CWSP outline lists documentation and legal concepts in Professional Issues, and complying with documentation requirements (legal and reimbursement) and following confidentiality and security regulations are listed tasks. Coding documentation and informed consent are covered in their own sections.
What Complete Wound Documentation Includes
| Element | Details |
|---|---|
| Etiology and history | Wound type, duration, prior treatments, relevant comorbidities and medications |
| Location | Precise anatomic site with laterality; numbering when there are several wounds |
| Measurements | Length (head to toe) × width (perpendicular) × depth in centimeters, using the same method each time; undermining and tunneling by clock position with the head at 12 o'clock |
| Wound bed | Percentages of granulation, slough, eschar, epithelium; exposed structures (bone, tendon, hardware) |
| Exudate and odor | Amount and type; odor assessed after cleansing |
| Edges and periwound skin | Maceration, callus, erythema, induration, rolled edges, dermatitis |
| Pain | Score with a consistent tool, timing, and response to treatment |
| Infection | Local and systemic signs, cultures, imaging |
| Perfusion and staging | Vascular studies, grading systems (NPIAP stage, Wagner, University of Texas, WIfI, CEAP) |
| Interventions | Debridement details (instrument, tissue removed, depth, area, hemostasis), dressings, offloading, compression |
| Education and plan | What was taught, teach-back results, goals, follow-up, referrals |
| Response | Progress compared with the last visit and with the 4-week trajectory |
Wound Photography
- Obtain consent according to facility policy, and store images in the medical record, not on personal devices.
- Standardize distance, angle, lighting, and background, and include a measuring guide with the date and patient identifier (not the full name in the image when avoidable).
- Photographs supplement written documentation; they do not replace it.
Legal Concepts
Negligence and the Standard of Care
A malpractice claim based on negligence must prove four elements:
- Duty: A clinician-patient relationship existed.
- Breach: Care fell below the standard of care, meaning what a reasonably prudent clinician with similar training would do in similar circumstances, often shown with expert testimony, guidelines, and facility policies.
- Causation: The breach caused the harm.
- Damages: The patient suffered actual harm (physical, financial, or emotional).
Common wound care allegations: Facility-acquired pressure injuries, failure to assess perfusion before compression or debridement, missed osteomyelitis or necrotizing infection, delayed vascular referral leading to amputation, failure to biopsy an atypical wound, inadequate follow-up, and poor communication.
Documentation Practices That Hold Up
- Contemporaneous entries written at or near the time of care.
- Objective language: Describe what was seen, measured, and done; avoid speculation, blame, or criticism of colleagues in the chart.
- Corrections: In paper records, draw a single line through the error, write the correction, and initial and date it. In electronic records, use an addendum or correction function; the audit trail keeps the original.
- Late entries: Label clearly as a late entry with the current date and time and the date of care being described.
- Never alter or destroy records after an adverse event or a request for records; doing so can be treated as spoliation of evidence and destroys credibility.
- Copy-forward caution: Cloned notes that repeat old measurements or findings are inaccurate and draw payer and legal scrutiny.
- Informed refusal: When a patient declines recommended care, document the discussion, risks explained, alternatives offered, capacity, and the plan for follow-up.
Avoidable and Unavoidable Pressure Injuries
The NPIAP recognizes that some pressure injuries are unavoidable despite appropriate care, for example in patients who are hemodynamically unstable or at the end of life. Supporting that conclusion requires documentation that risk was assessed, a prevention plan consistent with guidelines was implemented, and the plan was monitored and revised. Terms such as Kennedy terminal ulcer or skin changes at life's end should be used only when the clinical picture fits.
Surrogates and Advance Directives
When a patient lacks decision-making capacity, follow the legally authorized decision-maker: a health care agent named in a durable power of attorney for health care, then a court-appointed guardian with health care authority, and then the state's statutory surrogate order (commonly spouse, adult children, parents, adult siblings). The exact order varies by state, so know local law.
Confidentiality and Security
HIPAA Privacy Rule
- Protects protected health information (PHI) in any form, including wound photographs.
- Allows use and disclosure for treatment, payment, and health care operations without patient authorization; most other uses require written authorization.
- Minimum necessary standard applies to most disclosures other than those for treatment.
- Patients have a right of access to their records, generally within 30 days of a request with one 30-day extension allowed.
HIPAA Security Rule
Requires administrative, physical, and technical safeguards for electronic PHI: risk analysis, access controls, unique user IDs, audit controls, encryption where reasonable, secure messaging, device security, and workforce training. Texting photos from a personal phone through unsecured apps violates these safeguards.
Breach Notification Rule
| Breach Size | Notification Requirements |
|---|---|
| Any breach of unsecured PHI | Notify affected individuals without unreasonable delay and no later than 60 days after discovery |
| 500 or more residents of a state or jurisdiction | Also notify prominent media outlets and HHS within 60 days of discovery |
| Fewer than 500 individuals | Log and report to HHS within 60 days after the end of the calendar year |
Other Rules
- 42 CFR Part 2 adds protections for substance use disorder treatment records from covered programs.
- Information blocking rules under the 21st Century Cures Act require timely patient access to electronic health information, including clinical notes, unless an exception applies.
- Telehealth and remote monitoring must use secure platforms and document location, consent, and the limits of remote assessment.
Mandatory Reporting
State laws require clinicians to report suspected child abuse or neglect, and most states require reporting of suspected elder or dependent adult abuse or neglect. Unexplained pressure injuries, patterned bruises, burns, poor hygiene, and malnutrition in dependent patients can be signs. Document findings objectively with measurements and photographs, and report through the required channels; clinicians do not need proof to report reasonable suspicion.
Clinical Traps
Trap 1: "Fixing" the Chart After a Bad Outcome
Adding measurements or changing old notes after a lawsuit is threatened is discoverable through audit trails and can be far more damaging than the original gap.
Trap 2: Sharing Wound Photos From a Personal Phone
Photos are PHI. Use approved, secure clinical imaging tools that store images in the record.
A wound physician realizes the next morning that she documented the wrong depth (0.3 cm instead of 1.3 cm) for a sacral pressure injury in yesterday's electronic note. What is the most appropriate way to correct the record?
A wound clinic discovers that an employee's unencrypted laptop containing wound photographs and names of 620 patients who live in one state was stolen. Under the HIPAA Breach Notification Rule, what must the clinic do?
A patient develops a below-knee amputation after an arterial ulcer was treated with high compression for 3 months without any documented vascular assessment. In a malpractice lawsuit, which set of elements must the patient prove to establish negligence?