8.4 Malpractice, Risk Management, CLIA & EMTALA
Key Takeaways
Medical negligence requires four elements: a duty owed to the patient, breach of the standard of care, causation, and damages.
A claims-made malpractice policy covers claims made while the policy is in force, so a physician who leaves needs tail (extended reporting) or prior-acts (nose) coverage; an occurrence policy covers incidents that happened during the policy period.
Any practice that performs laboratory tests on human specimens for diagnosis or treatment needs a CLIA certificate; a Certificate of Waiver covers waived tests only, and certificates last two years.
EMTALA applies to Medicare-participating hospitals with emergency departments, requiring a medical screening examination and stabilization or appropriate transfer regardless of ability to pay.
A physician on a hospital's on-call list who refuses to come in for an emergency patient can face EMTALA civil monetary penalties along with the hospital.
Malpractice, Risk Management, CLIA & EMTALA
Quick Summary: Fraud and abuse laws protect payers; malpractice law, risk management, the Clinical Laboratory Improvement Amendments (CLIA), and the Emergency Medical Treatment and Labor Act (EMTALA) protect patients. AAPC's compliance content area names all of them. A practice manager does not practice medicine, but the manager buys the malpractice insurance, runs the incident reporting system, holds the CLIA certificate, and manages physicians' hospital call agreements. (OSHA, the other compliance statute AAPC lists, is covered in the employment law section of Chapter 11.)
Medical Malpractice Basics
Medical malpractice is professional negligence by a health care provider. To win, the patient (plaintiff) must prove four elements:
| Element | Meaning | Example |
|---|---|---|
| Duty | A provider-patient relationship created a duty of care | The patient was seen and treated at the practice |
| Breach | The provider failed to meet the standard of care—what a reasonably prudent provider in the same specialty would do | An abnormal mammogram report was filed without being reviewed |
| Causation | The breach caused the injury | The delayed diagnosis allowed the cancer to spread |
| Damages | The patient suffered harm the law recognizes | Additional treatment, lost income, pain and suffering |
Related concepts that appear on management exams:
- Respondeat superior (vicarious liability): An employer is liable for employees' negligent acts within the scope of employment. A practice can be sued for a medical assistant's error.
- Informed consent: Before a procedure, the clinician explains the nature of the procedure, material risks, benefits, and alternatives (including no treatment), and the patient agrees. The manager keeps consent forms current and ensures they are filed, but the discussion itself belongs to the clinician.
- Statute of limitations: Each state sets the deadline for filing a malpractice suit, commonly two to three years, often measured from when the injury was or should have been discovered, with longer periods for minors.
- Abandonment: Ending care without reasonable notice while the patient still needs it (see the patient dismissal protocol in Chapter 5).
Malpractice Insurance: Occurrence vs. Claims-Made
| Feature | Occurrence Policy | Claims-Made Policy |
|---|---|---|
| What triggers coverage | The incident happened while the policy was in force, whenever the claim is filed | The claim is made (and the incident occurred after the retroactive date) while the policy is in force |
| Cost pattern | Higher, level premium | Lower in early years, rising ("stepping") to a mature rate over about five years |
| When a physician leaves | Nothing more is needed | Needs tail coverage (an extended reporting endorsement) from the old carrier or prior-acts ("nose") coverage from the new carrier |
Common limits are written as per-claim and annual aggregate amounts (for example, $1 million/$3 million), but required limits vary by state, hospital bylaws, and payer contracts. When recruiting physicians, the employment agreement must state who pays for tail coverage—a frequent and expensive negotiating point.
National Practitioner Data Bank (NPDB): Any entity that makes a malpractice payment on behalf of a physician or other practitioner must report it to the NPDB within 30 days of the payment. That is one reason credentialing committees query the NPDB (Chapter 11).
Building a Risk Management Program
Risk management identifies, analyzes, and reduces the chance of injury to patients, staff, and visitors and of financial loss to the practice. Core elements:
- Incident reporting: A simple, non-punitive system for reporting errors, near misses, falls, needlesticks, and patient complaints. Reports are reviewed promptly and trended.
- Analysis: Use root cause analysis for serious events and failure mode and effects analysis for new processes (Chapter 15).
- Loss prevention in high-risk areas: closed-loop tracking of test results and referrals (Chapter 2), accurate medication lists, clear documentation, telephone triage protocols, chaperone policies, and informed consent.
- Communication after harm: Many states have apology laws that make expressions of sympathy inadmissible, and many insurers support structured disclosure programs. Notify the malpractice carrier promptly when an event could lead to a claim; late notice can jeopardize coverage.
- Claims management: Preserve records, never alter a chart after a claim is threatened (late entries must be dated and labeled as addenda), and route all legal correspondence to the carrier and counsel.
CLIA: Laboratory Testing in the Practice
The Clinical Laboratory Improvement Amendments of 1988 (CLIA) set quality standards for every facility that tests human specimens to diagnose, prevent, or treat disease—including a physician office that runs a single rapid strep test. CMS administers CLIA with the FDA (which categorizes tests by complexity) and the CDC.
Test Complexity
- Waived tests: simple tests with low risk of error, such as urine dipsticks, fingerstick glucose, rapid strep, and many rapid flu and COVID-19 antigen tests. Labs must follow the manufacturer's instructions exactly.
- Moderate-complexity tests, including provider-performed microscopy (PPM) procedures such as wet mounts performed by the clinician during the visit.
- High-complexity tests, which carry the strictest personnel, proficiency testing, and quality control requirements.
CLIA Certificate Types
| Certificate | Allows | Oversight |
|---|---|---|
| Certificate of Waiver | Waived tests only | No routine inspection, but CMS may visit |
| Certificate for Provider-Performed Microscopy (PPM) | PPM procedures plus waived tests | No routine inspection |
| Certificate of Registration | Temporary certificate letting a new moderate- or high-complexity lab operate until its first survey | Leads to a compliance or accreditation certificate |
| Certificate of Compliance | Moderate and/or high complexity | Biennial surveys by the state agency |
| Certificate of Accreditation | Moderate and/or high complexity | Surveys by a CMS-approved accreditor such as CAP, COLA, or The Joint Commission |
Certificates are valid for two years and must be renewed. The CLIA number appears on claims for lab services, and Medicare requires the QW modifier on many waived test codes. Performing a test that is not covered by the practice's certificate type is a compliance violation, and Medicare will not pay for it.
EMTALA: The Hospital Emergency Obligation
The Emergency Medical Treatment and Labor Act (EMTALA), enacted in 1986, applies to Medicare-participating hospitals with emergency departments. When anyone comes to the emergency department requesting care, the hospital must:
- Provide an appropriate medical screening examination to determine whether an emergency medical condition exists, without first asking about insurance in a way that delays screening;
- If an emergency condition exists, stabilize the patient within its capability; and
- Transfer an unstable patient only through an appropriate transfer (the benefits outweigh the risks, the receiving facility accepts, and records go with the patient). Hospitals with specialized capabilities must accept appropriate transfers when they have capacity.
Why EMTALA Matters to a Physician Practice
A freestanding physician office is not subject to EMTALA. The law reaches practices through their physicians' hospital on-call duties: a hospital must maintain an on-call list, and an on-call physician who fails or refuses to respond within a reasonable time can be penalized along with the hospital. HHS's 2025 inflation adjustment sets the maximum civil monetary penalty at $136,886 per violation for hospitals with 100 or more beds (and responsible physicians) and $68,445 for smaller hospitals. Practice managers should keep physicians' call schedules current, make sure call coverage agreements with hospitals are in writing and at fair market value, and route after-hours emergency calls to 911 or the emergency department according to written triage protocols.
Exam Traps
Caution
Tail Coverage Goes with Claims-Made Policies: A physician leaving a practice with an occurrence policy needs no tail. A physician leaving a claims-made policy does—either tail from the old carrier or nose coverage from the new one.
Warning
A Waiver Certificate Is Not a License for Every Test: A Certificate of Waiver covers only FDA-waived tests. Adding a moderate-complexity analyzer requires upgrading the certificate first.
A physician leaves a group practice that insured her under a claims-made malpractice policy. A patient she treated two years ago files a lawsuit six months after she left. What coverage would have protected her for this claim?
Nothing further was needed, because the incident occurred while the policy was in force
A general liability policy covering slip-and-fall injuries at the office
A higher per-claim limit on the practice's workers' compensation policy
Tail (extended reporting) coverage from the old carrier or prior-acts (nose) coverage from a new carrier
A family medicine office performs only urine dipsticks, fingerstick glucose tests, and rapid strep tests that the FDA has categorized as waived. Which CLIA certificate does the office need?
Certificate of Accreditation
Certificate of Waiver
Certificate of Compliance
No certificate, because physician offices are exempt from CLIA
Which statement best describes EMTALA's reach into a physician practice?
EMTALA applies to Medicare-participating hospitals with emergency departments, and a practice's physicians who take hospital call can be penalized for failing to respond to an emergency patient.
EMTALA requires every freestanding physician office to provide a medical screening examination to any walk-in patient.
EMTALA applies only to patients without insurance and requires the hospital to bill them at Medicare rates.
EMTALA allows hospitals to transfer unstable patients once their insurance is verified.
Sections you finish are checked off in the contents.