15.2 Legal Issues, Confidentiality & Surrogate Decision Making

Key Takeaways

  • Patient confidentiality under HIPAA is mandatory, but exceptions exist for Tarasoff warnings (imminent harm to an identifiable victim), reportable infectious diseases, elder/child abuse, and impaired drivers.
  • Mandated reporting of child or elder abuse requires only reasonable suspicion, not definitive proof; physicians must report immediately to protective services and do not conduct private investigations.
  • Living Wills specify treatment preferences in end-of-life scenarios, whereas Durable Power of Attorney for Healthcare (DPOA) designates a human proxy whose interpretation overrides written living wills.
  • Surrogate decision-making uses the Substituted Judgment Standard (deciding what the patient would have chosen based on prior values) before falling back to the Best Interest Standard.
  • The standard legal surrogate hierarchy in the absence of a designated DPOA is: Legal Spouse -> Adult Children -> Parents -> Adult Siblings.
Last updated: July 2026

15.2 Legal Issues, Confidentiality & Surrogate Decision Making

Navigating legal obligations, maintaining patient privacy, and executing end-of-life decisions are essential clinical competencies for USMLE Step 2 CK. Physicians must understand the boundary between strict confidentiality and mandatory legal reporting, as well as the hierarchical framework for surrogate decision-making when patients lose capacity.

Medical Confidentiality & HIPAA Framework

The Health Insurance Portability and Accountability Act (HIPAA) establishes federal privacy standards for protected health information (PHI). Physicians and healthcare institutions are legally prohibited from disclosing identifiable health data to third parties—including family members, employers, or law enforcement—without explicit written consent from the patient.

Clinical Communication & Electronic Privacy

  • Family Members: Physicians cannot discuss medical details with a patient's spouse, adult children, or relatives unless the patient has signed a disclosure authorization or explicitly verbally permits disclosure. If an adult patient is incapacitated, clinicians may share relevant PHI with family members only if doing so directly serves the patient's best medical interest.
  • Digital Security: Discussing patient cases on public platforms, leaving unencrypted messages containing PHI, or accessing medical records of patients not under a clinician's direct care violates federal law.

Exceptions to Patient Confidentiality (Mandated Reporting)

Patient confidentiality is not absolute. Specific legal and public safety mandates require physicians to breach confidentiality without patient consent.

1. Duty to Protect / Warn (Tarasoff Ruling)

Under the landmark Tarasoff ruling, when a patient communicates a specific, credible, and serious threat of physical violence against an identifiable third party, the physician has a affirmative legal duty to protect the intended victim. The clinician must immediately:

  • Notify local law enforcement agencies.
  • Directly warn the intended victim or take reasonable steps to ensure their protection (e.g., initiating emergency involuntary psychiatric hospitalization of the patient).

2. Child and Elder Abuse or Neglect

Physicians are mandatory reporters for suspected abuse or neglect involving children (under 18 years) or vulnerable adults/elderly (typically ≥60-65 years or dependent adults).

  • Threshold for Reporting: Reporting requires only reasonable suspicion based on physical findings, history, or behavioral cues. Physicians do not require definitive proof or photographic evidence.
  • Action Required: Immediate report to Child Protective Services (CPS) or Adult Protective Services (APS). Clinicians must not conduct an independent investigation or confront suspected perpetrators.
  • Intimate Partner Violence (Domestic Abuse): Unlike child/elder abuse, domestic violence involving competent adults is not mandatorily reported to police or social services without patient consent, except where state laws mandate reporting of gunshot wounds, stab wounds, or severe felony violence. Reporting against a competent victim's wishes can escalate danger.

3. Reportable Infectious Diseases

To protect public health, physicians must report confirmed or suspected cases of specific communicable diseases to local or state health departments without patient consent. Examples include:

  • Sexually Transmitted Infections: Syphilis, Gonorrhea, Chlamydia, HIV/AIDS.
  • Airborne / Severe Pathogens: Tuberculosis, Measles, Meningococcal disease, Rabies, Hepatitis A/B/C, Cholera.

4. Impaired Drivers

Physicians must report patients with conditions causing sudden loss of consciousness or cognitive impairment (e.g., uncontrolled epilepsy, severe dementia, narcolepsy, severe visual acuity loss) to the state Department of Motor Vehicles (DMV) or advise the patient to cease driving, as mandated by state licensing statutes.

Exception CategoryLegal TriggerRequired Action / Recipient
Tarasoff ExceptionCredible, specific threat to an identifiable personNotify intended victim and law enforcement immediately
Child / Elder AbuseReasonable suspicion of abuse or neglectReport immediately to CPS or APS; do not self-investigate
Communicable DiseasesDiagnosis of reportable pathogen (TB, Syphilis, HIV)Notify local/state Public Health Department
Impaired DriverUncontrolled seizures, dementia, severe visual lossReport to DMV / advise driver cessation per state law
Intimate Partner ViolenceAbuse of a competent non-vulnerable adultOffer resources/safety plan; do NOT report without consent

Advance Directives & End-of-Life Planning

Advance directives are legal instruments executed by competent individuals to guide medical care if they subsequently lose decision-making capacity.

Living Will vs. Durable Power of Attorney for Healthcare

  • Living Will: A written document detailing specific medical interventions a patient desires or refuses (e.g., mechanical ventilation, cardiopulmonary resuscitation, hemodialysis, artificial nutrition and hydration) in scenarios of terminal illness or persistent vegetative state.
  • Durable Power of Attorney for Healthcare (DPOA / Healthcare Proxy): A legal document designating a specific individual (the healthcare proxy) to make medical decisions on the patient's behalf if capacity is lost.

Exam Distinction: If a conflict arises between a written Living Will and a designated DPOA proxy, the DPOA proxy's verbal decisions take precedence, because the proxy is authorized to interpret how the patient's values apply to the real-time clinical situation.

Do Not Resuscitate (DNR) and POLST Orders

A DNR order is a specific medical order signed by a clinician directing healthcare providers to withhold CPR and intubation in the event of cardiac or respiratory arrest. DNR orders do not withhold other active medical treatments such as intravenous antibiotics, vasopressors, or surgical procedures unless explicitly specified. POLST (Physician Orders for Life-Sustaining Treatment) forms translate patient preferences into actionable medical orders across out-of-hospital and hospital settings.

Surrogate Decision-Making Hierarchy & Standards

When an incapacitated patient lacks an advance directive or designated DPOA proxy, physicians must turn to family surrogates established by state statutory hierarchy laws.

Statutory Surrogate Hierarchy

In the absence of a court-appointed legal guardian or designated DPOA, the legal order of priority for family surrogates is:

  1. Legal Spouse
  2. Adult Children (majority consensus)
  3. Parents
  4. Adult Siblings
  5. Other Close Relatives / Friends

Decision-Making Standards

Surrogates are legally and ethically obligated to apply decision-making standards in strict order:

  1. Substituted Judgment Standard: The surrogate must make the decision the patient would have made if they were competent, based on the patient's previously expressed values, religious beliefs, and prior statements. Personal desires of the surrogate must be set aside.
  2. Best Interest Standard: Used only when the patient's prior wishes and values are completely unknown or unreachable. The surrogate and clinical team determine what a reasonable person would decide in the patient's overall best medical interest.
[Incapacitated Adult Patient Needs Medical Decision]
       |
       v
[Does Patient Have Designated DPOA / Healthcare Proxy?]
  |-- YES --> [DPOA Proxy Makes Decision Using Substituted Judgment]
  +-- NO  --> [Is There an Executed Living Will?]
                 |-- YES --> [Follow Living Will Instructions]
                 +-- NO  --> [Identify Family Surrogate by Hierarchy]
                                (Spouse -> Adult Children -> Parents -> Siblings)
                                |-- Apply Substituted Judgment (Known Wishes)
                                +-- Apply Best Interest Standard (Unknown Wishes)
Test Your Knowledge

A 32-year-old man comes to the clinic for a routine physical examination. During the interview, he expresses intense anger toward his former business partner, stating, 'He stole my company, and I am going to shoot him with my revolver when he leaves his office tonight at 6 PM.' The patient provides the partner's exact name and office address. He appears entirely serious and unremorseful. Which of the following is the most appropriate immediate action?

A
B
C
D
Test Your Knowledge

A 2-year-old girl is brought to the emergency department by her stepfather with a chief complaint of right arm pain. Physical examination reveals multiple ecchymoses in various stages of healing across her back, a torn upper labial frenulum, and a spiral fracture of the right humerus on radiography. The stepfather states she fell off the couch. Which of the following is the most appropriate management step?

A
B
C
D
Test Your Knowledge

A 76-year-old woman with end-stage chronic obstructive pulmonary disease is admitted to the intensive care unit with hypercapnic respiratory failure and becomes unresponsive. She has no written advance directive and has not designated a formal Durable Power of Attorney for Healthcare. The medical team determines that mechanical ventilation is necessary. The patient's legal spouse and three adult children gather at the bedside. The spouse states, 'She explicitly told me last month that she never wanted to be kept alive on a breathing machine.' The adult children disagree and demand intubation. Which of the following is the most appropriate decision-maker and standard?

A
B
C
D