16.2 Legal & Regulatory Foundations

Key Takeaways

  • The provider performing the procedure is responsible for obtaining informed consent; the nurse witnesses the signature and verifies understanding, but does not explain the procedure's risks and benefits
  • A competent adult may refuse any treatment and may leave against medical advice (AMA) after being informed of the risks — holding a competent patient against their will is false imprisonment
  • HIPAA's minimum necessary standard means accessing only the information needed to do your job; casual browsing of any chart — even a coworker's or celebrity's — is a breach
  • Negligence/malpractice requires proving four elements: duty, breach of duty, causation, and damages
  • Documentation is a legal record: chart facts and observations, never opinions or blame; never alter, backdate, or obliterate an entry — correct errors with a single line and a late-entry notation
Last updated: August 2026

Legal questions on the exam test whether you know where the nurse's responsibility begins and ends. The recurring pattern: protect the competent patient's rights, stay inside your scope, and document accurately.

Informed Consent

Informed consent is a process, not a signature. Its elements are: (1) disclosure of the diagnosis, the nature and purpose of the proposed treatment, its risks and benefits, and alternatives including doing nothing; (2) comprehension — the patient must understand the information; (3) competence/capacity — the patient must be an adult able to make and communicate a decision; and (4) voluntariness — free of coercion.

The division of responsibility is heavily tested:

  • The provider performing the procedure is legally responsible for explaining it and obtaining consent.
  • The nurse witnesses the signature — verifying that the patient signed voluntarily and appears to understand — and confirms the patient's understanding, answering general questions and notifying the provider if the patient is confused or has unanswered questions about risks.
  • If the patient says, "I don't really understand what they're going to do," the correct action is to notify the provider and delay the procedure — not to explain the surgical risks yourself (outside nursing scope) and not to proceed anyway.

Advance Directives

DocumentWhat It DoesKey Point
Living willStates treatment wishes (e.g., no ventilator, no tube feeding) if the patient becomes incapacitatedWritten while competent; activates only when the patient cannot decide
Durable power of attorney for healthcare (DPOA-HC / healthcare proxy)Names a surrogate decision-makerThe proxy decides only when the patient cannot; the proxy must follow the patient's known wishes, not their own preferences
POLST (Physician Orders for Life-Sustaining Treatment)Converts wishes into actionable medical orders (code status, interventions) that travel across settingsA medical order set, not just a wish list; appropriate for seriously ill or frail patients

The Patient Self-Determination Act requires facilities receiving Medicare/Medicaid funds to ask patients on admission whether they have advance directives and to provide information about them. The nurse asks, documents, and never conditions care on having one.

Right to Refuse and AMA Discharges

A competent adult may refuse any treatment — including life-sustaining treatment — and may leave against medical advice (AMA). The nurse's responsibilities: verify capacity, ensure the provider informs the patient of the risks of refusal or leaving, notify the provider, have the AMA form signed (or document the refusal to sign), and document the patient's mental status and the teaching provided. Forcibly detaining or restraining a competent patient who wants to leave is false imprisonment; threatening a patient to coerce compliance is assault. Note that removing treatment against a competent patient's wishes is battery — an intentional tort — distinct from negligence.

HIPAA Privacy Rule

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects protected health information (PHI) in any form. Essentials:

  • Minimum necessary standard — access, use, and disclose only the information needed to perform your job. Looking up a neighbor, coworker, or celebrity out of curiosity is a violation even if you never repeat what you saw.
  • Permitted disclosures without authorization — treatment, payment, and healthcare operations; certain public interest exceptions (public health reporting, abuse reporting, court orders).
  • Patients have the right to access and obtain copies of their records, request amendments, and receive an accounting of disclosures.
  • Breaches (impermissible acquisition, access, use, or disclosure) must be reported internally per policy and may require notification to the patient and to the Department of Health and Human Services.
  • Practical rules: no patient discussion in elevators or cafeterias, no posting on social media (even "de-identified" stories can identify patients), log off shared computers, verify identity before giving information by phone.

Confidentiality Exceptions: Mandatory Reporting

Confidentiality is not absolute. Nurses are mandatory reporters for: suspected child abuse or neglect, suspected elder or vulnerable-adult abuse (in most states), certain communicable diseases (tuberculosis, sexually transmitted infections per state lists), wounds from violence (gunshot, stabbing, per state law), and credible threats of harm to an identifiable third party (duty to warn/protect). Reporting is made to the appropriate agency per policy — the nurse does not need proof, only reasonable suspicion, and is legally protected when reporting in good faith.

Documentation as a Legal Record

The chart is a legal document: if it wasn't documented, it wasn't done. Rules that show up on exams:

  • Chart facts and observations, not opinions or judgments — write "patient pacing, voice raised, states 'I want to leave'" rather than "patient is hostile."
  • Never document blame or incident reports in the chart (note the facts of the event and the patient's response; the incident report itself is an internal quality document, not part of the medical record).
  • Late entries: add them as a clearly labeled late entry with the current date/time and reference to the event time — never backdate.
  • Never alter, delete, or obliterate an entry. Correct a paper error with a single line, initial, and date; correct electronic entries per system audit trail.
  • Document refusals, AMA situations, and patient/family teaching thoroughly — these are the records most scrutinized in litigation.

Negligence and Malpractice

Malpractice is professional negligence. All four elements must be proven:

  1. Duty — a nurse–patient relationship existed creating an obligation to meet the standard of care.
  2. Breach — the nurse failed to meet that standard (an act of commission or omission a reasonably prudent nurse would not have done).
  3. Causation — the breach directly caused the injury.
  4. Damages — actual harm (physical, emotional, financial) resulted.

An error without injury, or an injury unrelated to the error, does not complete a malpractice claim — though it still warrants an incident report.

Good Samaritan Laws

Good Samaritan laws protect healthcare professionals who provide voluntary, uncompensated emergency care outside their employment, in good faith, within their competence, from liability for ordinary negligence. They do not protect gross negligence or care given for pay, and once you begin care you generally must not abandon the person until help arrives.

Nurse Practice Acts and Licensure Discipline

Each state's Nurse Practice Act (NPA) defines the scope of nursing practice, grounds for discipline, and the authority of the Board of Nursing (BON). The BON — not the employer — grants, renews, and disciplines licenses. Grounds for discipline include practicing while impaired, diversion of drugs, fraud, patient abuse, practicing beyond scope, and criminal convictions. Consequences range from reprimand and probation to suspension and revocation. Impaired practice must be reported per the NPA and ANA Code (Provision 3) — protecting the patient overrides loyalty to a colleague.

Test Your Knowledge

A patient scheduled for a colon resection in the morning tells the nurse, "The surgeon explained something about my bowel, but I honestly don't understand what they're removing or what could go wrong." The consent form is already signed. What is the nurse's best action?

A
B
C
D
Test Your Knowledge

Which nursing action violates the HIPAA minimum necessary standard?

A
B
C
D
Test Your Knowledge

A nurse forgets to reposition an immobile patient for an entire shift despite a turning schedule ordered every 2 hours. The patient develops a Stage 2 pressure injury. For a malpractice claim to succeed, which additional element must be proven beyond duty and breach?

A
B
C
D