RMA Medical Law and Ethics 2 — Questions and Answers

Question 1: A physician examines a patient and determines that the diagnosis is terminal cancer. The patient's family asks the physician not to tell the patient. What ethical principle supports the physician's obligation to inform the patient?

Beneficence
Nonmaleficence
Autonomy (Correct answer)
Justice

Correct answer: Autonomy

Autonomy — the patient's right to self-determination — requires that competent patients receive accurate information about their diagnosis and prognosis so they can make informed decisions about their own care.

The four core principles of biomedical ethics (Beauchamp and Childress) are autonomy, beneficence, nonmaleficence, and justice. Autonomy refers to an individual's right to self-determination — to make informed decisions about their own healthcare without coercion. Respecting autonomy requires providing patients with accurate, complete information about their diagnosis, prognosis, and treatment options. Withholding a terminal diagnosis at the family's request, while perhaps well-intentioned, violates the patient's autonomy by depriving them of information needed to make decisions about end-of-life care, legal matters (wills, advance directives), relationships, and personal goals. The family's desire to protect the patient, though understandable, does not override the competent patient's right to know. Beneficence (doing good) and nonmaleficence (avoiding harm) sometimes create tension with autonomy — the physician might worry about causing emotional distress. However, ethical guidelines in the United States firmly support disclosure to competent patients. Justice concerns equitable distribution of resources and fair treatment. Understanding these principles is essential for navigating ethical dilemmas in clinical practice and for the RMA exam.

Question 2: Which of the following actions by a medical assistant would constitute a breach of patient confidentiality under HIPAA?

Discussing a patient's care with another provider directly involved in that patient's treatment
Faxing records to a specialist with a signed patient authorization
Mentioning a patient's name and diagnosis in a conversation with a friend outside of work (Correct answer)
Releasing records to the patient themselves after verifying their identity

Correct answer: Mentioning a patient's name and diagnosis in a conversation with a friend outside of work

Discussing a patient's protected health information (PHI) with anyone not involved in their care — including friends, family, or colleagues outside their treating team — is a HIPAA violation regardless of where the conversation takes place.

HIPAA's Privacy Rule protects all individually identifiable health information (protected health information, or PHI) held by covered entities and their business associates. This protection applies 24/7 and does not stop when the medical assistant leaves the building. Permitted disclosures include: treatment (sharing with other providers directly involved in the patient's care), payment (billing activities), and healthcare operations (quality improvement, training, accreditation). Patients are also entitled to access their own records. A signed authorization from the patient is required for most other disclosures. Social conversations about patients — even without using the full name, if the individual could be identified by the context — constitute a privacy breach. Medical assistants must also be careful about social media posts, text messages, and email discussions involving patient information. HIPAA violations can result in civil penalties ranging from $100 to $50,000 per violation (up to $1.9 million per year for identical violations) and criminal penalties of up to 10 years imprisonment for egregious violations.

Question 3: A minor presents to the clinic requesting treatment for a sexually transmitted infection. In most states, which legal doctrine allows a medical assistant and provider to treat this patient without parental consent?

The emancipated minor doctrine
The implied consent doctrine
The mature minor doctrine / statutory exception (Correct answer)
The Good Samaritan law

Correct answer: The mature minor doctrine / statutory exception

Most states have statutory exceptions allowing minors to consent to diagnosis and treatment of STIs, contraception, substance abuse, and mental health services without parental consent to encourage them to seek needed care.

Generally, minors (persons under 18) cannot legally consent to their own medical treatment, and parents or legal guardians must provide consent. However, all 50 states have enacted statutory exceptions to this rule for specific sensitive healthcare services, recognizing that requiring parental consent creates barriers to care for vulnerable populations. Sexually transmitted infection (STI) testing and treatment is one of the most universal exceptions — virtually all states allow minors to consent to STI care without parental notification. Other common exceptions include: contraceptive services, pregnancy-related care (varies by state), mental health outpatient counseling, and substance abuse treatment. Emancipated minors (those who are married, in the military, financially self-supporting, or judicially emancipated) have full adult decision-making rights for all medical care. The mature minor doctrine (recognized by some states) allows healthcare providers to treat minors who demonstrate sufficient maturity to understand the nature and consequences of treatment, even without a specific statutory exception. Medical assistants should know their state's laws regarding minor consent and never delay necessary care while determining consent status.

Question 4: Which type of advance directive specifically designates a person to make healthcare decisions on behalf of a patient who becomes incapacitated?

Living will
Do-not-resuscitate (DNR) order
Healthcare proxy / durable power of attorney for healthcare (Correct answer)
POLST (Physician Orders for Life-Sustaining Treatment)

Correct answer: Healthcare proxy / durable power of attorney for healthcare

A healthcare proxy or durable power of attorney for healthcare designates a specific individual (the healthcare agent or surrogate) to make medical decisions for the patient if they become unable to do so.

Advance directives are legal documents that allow patients to express their healthcare preferences in advance and designate decision-makers in case of incapacity. There are two main types: 1. Instructional directives (living wills) — specify the patient's wishes about specific treatments (e.g., 'I do not wish to be placed on mechanical ventilation if I am in a persistent vegetative state'). These guide decision-making but cannot anticipate every situation. 2. Proxy directives (healthcare proxy, healthcare power of attorney, or durable power of attorney for healthcare) — designate a specific individual (the agent or surrogate) to make all healthcare decisions on the patient's behalf. The named agent's authority typically activates only when the patient loses decision-making capacity. A POLST (also called MOLST, MOST, or DNAR in some states) is a medical order — not just an advance directive — signed by the physician to guide emergency care. A DNR is a specific medical order directing resuscitation not be attempted. Medical assistants should be familiar with these documents to assist with filing, patient education, and ensuring they are accessible in the medical record.

Question 5: Which of the following best defines the term 'respondeat superior' in the context of medical practice?

The physician is protected from liability for a medical assistant's actions
An employer is legally responsible for the negligent acts of employees performed within the scope of employment (Correct answer)
A patient must prove negligence to win a malpractice case
Medical records are the property of the healthcare facility, not the patient

Correct answer: An employer is legally responsible for the negligent acts of employees performed within the scope of employment

Respondeat superior ('let the master answer') holds employers vicariously liable for negligent acts committed by their employees while acting within the scope of their employment.

Respondeat superior is a foundational legal doctrine in healthcare employment law. It establishes vicarious liability — meaning the employer (physician, practice, or hospital) can be held legally responsible for the torts (negligent acts) of employees committed during the course of their employment. For this doctrine to apply, three conditions must generally be met: an employer-employee relationship must exist (not independent contractor); the employee was acting within the scope of their employment (performing duties they were authorized or expected to perform); and the negligent act occurred while the employee was 'on the job.' This doctrine is why physicians can be held liable when medical assistants make errors — if the medical assistant draws blood incorrectly and causes patient injury while carrying out their normal job duties, the physician/employer can be sued alongside the employee. It also reinforces why medical assistants must practice only within their defined scope of practice and follow all protocols — their actions carry legal implications for their employer. Medical assistants can also be individually named in negligence suits.

Question 6: A patient's family member calls and asks for information about the patient's test results. The patient is an adult and has not signed a release. What should the medical assistant do?

Provide a general summary since the caller is family
Verify the caller's identity and provide the results since they are family
Decline to confirm or deny any patient information and advise them to have the patient contact the office (Correct answer)
Transfer the call to the physician to make the decision

Correct answer: Decline to confirm or deny any patient information and advise them to have the patient contact the office

HIPAA prohibits disclosing any PHI to individuals not authorized by the patient; the medical assistant must decline to provide information and direct the family member to have the patient authorize the release.

Under HIPAA's Privacy Rule, protected health information (PHI) may only be disclosed to individuals specifically authorized by the patient. Family members, regardless of their relationship, do not automatically have a right to access a competent adult patient's medical information. The only exceptions are: (1) when the patient has expressly authorized disclosure to specific family members (verbally in the presence of the patient, or in writing); (2) in an emergency where the patient is incapacitated and it is in their best interest; or (3) in specific legally mandated reporting situations. The correct response is to politely decline to confirm or provide any information, explain that privacy laws prevent disclosure without the patient's authorization, and suggest that the family member speak directly with the patient to arrange any necessary release of information. Medical assistants should never verify even that a person is a patient of the practice to an unauthorized caller (this itself would be a PHI disclosure). This can be difficult in emotionally charged situations with concerned family members, but protecting patient privacy is a non-negotiable legal and ethical obligation.

RMA Medical Law and Ethics 2

A physician examines a patient and determines that the diagnosis is terminal cancer.
The patient's family asks the physician not to tell the patient.
What ethical principle supports the physician's obligation to inform the patient?