Medicolegal essentials: malpractice, NPDB, HIPAA, surrogates and impaired colleagues
Bottom line
Negligence needs duty, breach, causation and damages; an entity's malpractice payment for a practitioner is reportable at any amount; HIPAA allows treatment disclosures without authorization except psychotherapy notes; designated surrogates decide by substituted judgment; impaired colleagues must be stopped now.
Key points
- Malpractice has four elements. The injured patient must prove a professional duty owed, breach of that duty, injury caused by the breach, and resulting damages 1.
- Payments for a practitioner are reportable. Any entity paying to settle or satisfy a written malpractice claim for a practitioner's benefit reports it to the NPDB; payments solely for an entity that name no practitioner are not reported 2.
- Treatment disclosures need no authorization. A covered entity may disclose protected health information for another provider's treatment activities without the patient's authorization 3.
- Psychotherapy notes are protected separately. An authorization is required for most uses or disclosures of psychotherapy notes, apart from narrow exceptions such as use by the originator for treatment 4.
- Designated surrogates come first. For a patient lacking capacity, identify the surrogate named in a durable power of attorney; family serve when none was designated, and decisions follow substituted judgment 6.
- Stop an impaired colleague from endangering patients. Intervene with respect and compassion, ensure the colleague no longer endangers patients and receives evaluation and care, and seek help through institutional channels 7.
Watch for
The best-interest standard applies only when a patient's preferences are unknown and cannot reasonably be inferred; otherwise the surrogate decides as the patient would have 6.
High-yield for the exam
- The NPDB has no de minimis exception: the amount of a malpractice payment is irrelevant to reporting 2.
- Malpractice payments are reported within 30 days of the payment, including a payment made before a settlement or judgment 28.
- A payment a practitioner makes from personal funds is not reported; a payment made solely for a hospital or group practice is not reported either 2.
- A covered entity must act on a patient's request to access records no later than 30 days after receiving it, extendable once by up to 30 days 5.
- An ethics committee should be consulted when no surrogate is available or disagreement about the surrogate or treatment cannot be resolved 6.
- Physicians should advocate for physician health programs and fair, evidence-based peer review 7.
- Malpractice payments for NPDB purposes are money paid on a written complaint or claim demanding payment for damages 2.
- Money damages typically cover both economic loss and noneconomic loss such as pain and suffering 1.
Numbers to know
Common traps
Practise this topic
4 more questions on this topic in the full question bank, with explanations and sources.
Sources
- Bal BS. An introduction to medical malpractice in the United States. Clin Orthop Relat Res, 2009. pmc.ncbi.nlm.nih.gov/articles/PMC2628513/
- National Practitioner Data Bank. NPDB Guidebook: Reporting medical malpractice payments. HRSA, accessed 2026. npdb.hrsa.gov/guidebook/EMMPR.jsp
- US Code of Federal Regulations. 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations. Legal Information Institute, accessed 2026. law.cornell.edu/cfr/text/45/164.506
- US Code of Federal Regulations. 45 CFR 164.508: Uses and disclosures for which an authorization is required. Legal Information Institute, accessed 2026. law.cornell.edu/cfr/text/45/164.508
- US Code of Federal Regulations. 45 CFR 164.524: Access of individuals to protected health information. Legal Information Institute, accessed 2026. law.cornell.edu/cfr/text/45/164.524
- American Medical Association. Code of Medical Ethics Opinion 2.1.2: Decisions for adult patients who lack capacity. AMA, accessed 2026. code-medical-ethics.ama-assn.org/ethics-opinions/decisions-a
- American Medical Association. Code of Medical Ethics Opinion 9.3.2: Physician responsibilities to colleagues with illness, disability or impairment. AMA, accessed 2026. code-medical-ethics.ama-assn.org/ethics-opinions/physician-r
- US Code of Federal Regulations. 45 CFR 60.5: When information must be reported. eCFR, accessed 2026. ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-60/su
Related topics
Independent study material for the ABA Pain Medicine exam, written and reviewed by a board-certified pain physician. Not medical advice; not affiliated with the American Board of Anesthesiology.