Informed Consent and the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Informed Consent

The common law doctrine of informed consent provides that physicians and dentists have a duty to inform patients of the known material risks of a proposed treatment or procedure and to inform patients of available treatment alternatives. The informed consent doctrine is premised on patient autonomy. In Roberts v. Connell, 312 Ga. App. 515 (2011), the Court of Appeals said:

“Consent” in a medical context involves two distinct legal principles. One is “basic” consent, or that consent to a touching which avoids a battery. A medical touching without consent constitutes the intentional tort of battery for which an action will lie. The other consent is “informed” consent, which addresses the autonomy of a competent patient to determine what medical treatment he will allow or refuse. Informed consent essentially involves a medical professional fully informing a patient of the risks of and alternatives to the proposed treatment so that the patient’s right to decide is not diminished by a lack of relevant information.

While express consent is best, it may be waived, implied or, in emergency cases, unnecessary. See O.C.G.A. § 31-9-6.1(e). In cases where the patient lacks capacity, consent (or refusal to consent) is given by a health agent. O.C.G.A. § 31-9-2. See also Decision-making Supports for Special Needs Individuals and Others Needing Assistance.

In an early informed consent case, Schloendorff v. Society of the New York Hospital, 211 N.Y. 125, 105 N.E. 92 (1914), the plaintiff had a stomach disorder. A physician examined her and discovered a lump, found to be a fibroid tumor. The plaintiff consented to an examination, but not to an operation. Nonetheless, the medical staff gave her ether and, while plaintiff unconscious, performed an operation to remove the tumor. Later, plaintiff developed gangrene in her left arm and several fingers were amputated, after which she sued the hospital. Justice Cardozo wrote in Schloendorff that:

Every human being of adult years and sound mind has a right to determine what shall be done with his own body; and a surgeon who performs an operation without his patient’s consent, commits an assault, for which he is liable in damages. j (Pratt v. Davis, 224 Ill. 300; Mohr v. Williams, 95 Minn. 261.) This is true except in cases of emergency where the patient is unconscious and where it is necessary to operate before consent can be obtained.

Significantly more egregious facts were in the 1906 Illinois case cited by Justice Cardozo. There, paternalism reared its ugly head when a physician operated on an epileptic woman, removing her uterus and ovaries without consent. The physician testified:

that he told Mrs. Davis just enough about her condition and what he proposed to do, to get her consent to the first operation, and says, quoting his own language: “I worked her deliberately and systematically, taking chances which she did not realize the full aspect of,—deliberately and calmly deceiving the woman; that is, I did not tell her the whole truth.” And referring to the first operation he says: “She knew that the womb was to be operated upon and she was willing that should be done. Consent for further work was not obtained.”

In Mohr, where a physician operated on a patient’s ear without consent, the Court referred to Pratt v. Davis, stating:

It was said in the case of Pratt v. Davis, 37 Chicago Leg. News, 213, referred to and commented on in 60 Cent. Daw J. 452: “Under a free government, at least, the free citizen’s first and greatest right, which underlies all others — the right to the inviolability of his person; in other words the right’ to himself — is the subject of universal acquiescence, and this right necessarily forbids a physician or surgeon, however skillful or eminent, who has been asked to examine; diagnose, advise, and prescribe (which are at least necessary first steps in treatment and care), to violate, without permission, the bodily integrity of his patient by a major or capital operation, placing him under an anesthetic for that purpose, and operating upon him without his consent or knowledge.”

As noted above, there is a difference between consent and informed consent. “Informed consent is the process by which the treating health care provider discloses appropriate information to a competent patient so that the patient may make a voluntary choice to accept or refuse treatment. (Appelbaum, 2007). It originates from the legal and ethical right the patient has to direct what happens to her body and from the ethical duty of the physician to involve the patient in her health care.” One could fairly argue that any consent without being sufficiently “informed” is no consent at all. Nonetheless, Georgia is the only state that does not recognize a common law duty to inform patients of the material risks of a proposed treatment or procedure. See Blotner v. Doreika, 285 Ga. 481 (2009), citing Albany Urology Clinic v. Cleveland, 272 Ga. 296 (2000); Blotner also expressly overruled Ketchup v. Howard, 247 Ga. App. 54 (2000), where the Georgia Court of Appeals stated “[h]enceforth the law of this state, like that of the other 49 states, will recognize the common law doctrine of informed consent.”

In Blotner, the Court stated:

[p]rior to 1988, Georgia physicians were not required to disclose to their patients any of the risks associated with a particular medical treatment or procedure. Hence, before 1988, a physician’s “silence as to risk” was not actionable and could not be the basis of a patient’s claim of fraud. Although a physician did then and does now have a common law duty to answer truthfully a patient’s questions regarding medical or procedural risks, absent such inquiry the common law of this state does not designate the failure to disclose such risks a fraud that may vitiate a patient’s consent to medical procedures. As established by pre-1988 precedent, under the common law, evidence of a failure to reveal the risks associated with medical treatment is not even admissible in support of a claim for professional negligence.

Because there is no common law duty in Georgia to inform patients of material risks, any procedure not addressed in the statute requires consent, but not informed consent. For example, in Roberts v. Connell, a dentist’s admission during deposition that “a nerve block was major regional anesthesia in that area of the mouth being worked on was not an admission in judicio causing the case to fall within O.C.G.A. § 31-9-6.1 since prior case law specifically held that the mouth and jaw are not a major region within the meaning of the statute.” [Note 1] Thus, informed consent was not required. What is required, though, is honesty. See Blotner (“a physician did then and does now have a common law duty to answer truthfully a patient’s questions”). So if a health care provider does not volunteer the information necessary to make decisions, patients or health agents should ask for the information.

Note 1: Georgia R&R. 360-14-.02(7) defines a “major region” as an entire arm, leg, torso, or any combination thereof. Georgia R&R. 360-14-.02(8) defines “major regional anesthesia” as a state of insensitivity to pain affecting a major region of the body which is produced by the temporary interruption of the sensory nerve conductivity of such a region through the administration of a spinal, epidural, intravenous regional, or brachial plexus anesthetic.

To demonstrate the paternalistic gamesmanship possible under Georgia’s statute, one need only look to Robinson v. Parrish, 251 Ga. 496 (1983). There, the Eleventh Circuit certified a question to the Georgia Supreme Court in the context of a malpractice case involving voluntary sterilization. The question involved what informed consent is required under the Georgia Voluntary Sterilization Act, OCGA § 31-20-2. The Georgia Supreme Court held that the act requires “that the physician must fully inform the patient of the intended results of sterilization, which is the permanent inability to have children. Specifically, the statute does not require a physician to disclose the possible risks and complications of the sterilization procedure.” So a physician who fails to tell patients they could die is immune from suit for failing to provide informed consent as long as he or she tells the patient they can’t have children.

Georgia’s informed consent rule is statutory and is found at O.C.G.A. § 31-9-6.1, which provides:

(a) Except as otherwise provided in this Code section, any person who undergoes any surgical procedure under general anesthesia, spinal anesthesia, or major regional anesthesia or any person who undergoes an amniocentesis diagnostic procedure or a diagnostic procedure which involves the intravenous or intraductal injection of a contrast material must consent to such procedure and shall be informed in general terms of the following:

(1) A diagnosis of the patient’s condition requiring such proposed surgical or diagnostic procedure;

(2) The nature and purpose of such proposed surgical or diagnostic procedure;

(3) The material risks generally recognized and accepted by reasonably prudent physicians of infection, allergic reaction, severe loss of blood, loss or loss of function of any limb or organ, paralysis or partial paralysis, paraplegia or quadriplegia, disfiguring scar, brain damage, cardiac arrest, or death involved in such proposed surgical or diagnostic procedure which, if disclosed to a reasonably prudent person in the patient’s position, could reasonably be expected to cause such prudent person to decline such proposed surgical or diagnostic procedure on the basis of the material risk of injury that could result from such proposed surgical or diagnostic procedure;

(4) The likelihood of success of such proposed surgical or diagnostic procedure;

(5) The practical alternatives to such proposed surgical or diagnostic procedure which are generally recognized and accepted by reasonably prudent physicians; and

(6) The prognosis of the patient’s condition if such proposed surgical or diagnostic procedure is rejected.


(1) If a consent to a surgical or diagnostic procedure is required to be obtained under this Code section and such consent is not obtained in writing in accordance with the requirements of this Code section, then no presumption shall arise as to the validity of such consent.

(2) If a consent to a diagnostic or surgical procedure is required to be obtained under this Code section and such consent discloses in general terms the information required in subsection (a) of this Code section, is duly evidenced in writing, and is signed by the patient or other person or persons authorized to consent pursuant to the terms of this chapter, then such consent shall be rebuttably presumed to be a valid consent.

(c) In situations where a consent to a surgical or diagnostic procedure is required under this Code section, it shall be the responsibility of the responsible physician to ensure that the information required by subsection (a) of this Code section is disclosed and that the consent provided for in this Code section is obtained. The information provided for in this Code section may be disclosed through the use of video tapes, audio tapes, pamphlets, booklets, or other means of communication or through conversations with nurses, physician assistants, trained counselors, patient educators, or other similar persons known by the responsible physician to be knowledgeable and capable of communicating such information; provided, however, that for the purposes of this Code section only, if any employee of a hospital or ambulatory surgical treatment center participates in any such conversations at the request of the responsible physician, such employee shall be considered for such purposes to be solely the agent of the responsible physician.

(d) A failure to comply with the requirements of this Code section shall not constitute a separate cause of action but may give rise to an action for medical malpractice as defined in Code Section 9-3-70 and as governed by other provisions of this Code relating to such actions; and any such action shall be brought against the responsible physician or any hospital, ambulatory surgical treatment center, professional corporation, or partnership of which the responsible physician is an employee or partner and which is responsible for such physician’s acts, or both, upon a showing:

(1) That the patient suffered an injury which was proximately caused by the surgical or diagnostic procedure;

(2) That information concerning the injury suffered was not disclosed as required by this Code section; and

(3) That a reasonably prudent patient would have refused the surgical or diagnostic procedure or would have chosen a practical alternative to such proposed surgical or diagnostic procedure if such information had been disclosed;

provided, however, that, as to an allegation of negligence for failure to comply with the requirements of this Code section, the expert’s affidavit required by Code Section 9-11-9.1 shall set forth that the patient suffered an injury which was proximately caused by the surgical or diagnostic procedure and that such injury was a material risk required to be disclosed under this Code section.

(e) The disclosure of information and the consent provided for in this Code section shall not be required if:

(1) An emergency exists as defined in Code Section 31-9-3;

(2) The surgical or diagnostic procedure is generally recognized by reasonably prudent physicians to be a procedure which does not involve a material risk to the patient involved;

(3) A patient or other person or persons authorized to give consent pursuant to this chapter make a request in writing that the information provided for in this Code section not be disclosed;

(4) A prior consent, within 30 days of the surgical or diagnostic procedure, complying with the requirements of this Code section to the surgical or diagnostic procedure has been obtained as a part of a course of treatment for the patient’s condition; provided, however, that if such consent is obtained in conjunction with the admission of the patient to a hospital for the performance of such procedure, the consent shall be valid for a period of 30 days from the date of admission or for the period of time the person is confined in the hospital for that purpose, whichever is greater; or

(5) The surgical or diagnostic procedure was unforeseen or was not known to be needed at the time consent was obtained, and the patient has consented to allow the responsible physician to make the decision concerning such procedure.

(f) A prior consent to surgical or diagnostic procedures obtained pursuant to the provisions of this Code section shall be deemed to be valid consent for the responsible physician and all medical personnel under the direct supervision and control of the responsible physician in the performance of such surgical or diagnostic procedure and for all other medical personnel otherwise involved in the course of treatment of the patient’s condition.

(g) The Georgia Composite Medical Board shall be required to adopt and have the authority to promulgate rules and regulations governing and establishing the standards necessary to implement this chapter specifically including but not limited to the disciplining of a physician who fails to comply with this Code section.

(h) As used in this Code section, the term “responsible physician” means the physician who performs the procedure or the physician under whose direct orders the procedure is performed by a non-physician.

Decisions made by a Health Agent

In Doctors Hosp. of Augusta, LLC v. Alicea, 332 Ga. App. 529 (2015), the Court stated “[w]hen the designated agent notifies a health care provider of a decision regarding the declarant’s medical care or treatment, the provider must abide by the agent’s decision, “subject to the health care provider’s right to administer treatment for the declarant’s comfort or alleviation of pain.” OCGA § 31-32-8(2).” The problem, of course, is that neither patients nor health agents can make informed decisions until they are given sufficient information.

As a practical matter, Courts rarely get involved unless (1) the decision is being made by a surrogate and (2) someone disagrees with the surrogate’s decision. Most notably, these cases frequently involve a decision to terminate life sustaining treatment (e.g., Quinlan and Cruzan)

Getting Information: Informed Consent and HIPAA

“Informed” consent implies that information was shared; since the implementation of the HIPAA privacy rule, securing health care information is sometimes problematic.

HIPAA was adopted to ensure health insurance coverage after leaving an employer and to provide for standards for facilitating healthcare related electronic transactions. While enacting these changes, Congress recognized that advances in electronic technology could erode the privacy of health information. Consequently, Congress mandated adoption of federal privacy protections for certain individually identifiable health information.

The federal statute is enabling legislation; it is not the privacy rule. See 42 U.S.C. § 1320d et seq. The HIPAA regulations are found in Title 45 of the Code of Federal Regulations, Parts 160, 162 and 164. Specifically, the privacy rule (also called the security rule) is found at 45 C.F.R. Part 164, Subpart E (§ 164.500 through 164.534). Security standards are at 164.302 through 164.318. Requirements relating to a covered entity’s duty following improper use or disclosure of protected health information are at 45 C.F.R. 164.400 through 164.414.

Generally speaking, covered entities and business associates may not use or disclose protected health information, except as permitted or required under the rule. See 45 C.F.R. § 164.502(a). The Privacy Rule:

  • gives patients more control over their health information;
  • sets boundaries on the use and release of health records;
  • establishes appropriate safeguards that the majority of health-care providers and
    others must achieve to protect the privacy of health information;
  • holds violators accountable with civil and criminal penalties that can be imposed
    if they violate patients’ privacy rights;
  • strikes a balance when public health responsibilities support disclosure of certain
    forms of data;
  • enables patients to make informed choices based on how individual health
    information may be used;
  • enables patients to find out how their information may be used and what
    disclosures of their information have been made;
  • generally limits release of information to the minimum reasonably needed for the
    purpose of the disclosure;
  • generally gives patients the right to obtain a copy of their own health records and
    request corrections; and
  • empowers individuals to control certain uses and disclosures of their health

The privacy rule applies uniformly to most protected health information. Psychotherapy notes are the primary exception. If information relates to an individual’s past, present or future physical or mental health condition or payment for treatment of the condition, and if it contains information that identifies or provides a reasonable basis for believing the individual could be identified, then the privacy rule probably applies.

A covered entity is required to disclose protected health information to the patient when the patient requests information. See 45 C.F.R. § 164.522(a)(1); § 164.524 or § 164.528. A covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of 164.502, treat a personal representative as the individual for purposes of this subchapter. This means a person with power to make health care decisions has a right to the information necessary to make those decisions. The key is decision-making authority. “If under applicable [State] law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this [Rule] with respect to PHI relevant to such personal representative.” 45 C.F.R. § 164.502(g)(2). Personal representatives include persons holding valid health care powers of attorney, guardians, and others who have the power to make health care decisions. In abuse situations, a health care provider may refuse to treat a personal representative as such, 45 C.F.R. § 164.502(g)(5); however, a denial of access premised on that ground is subject to review. 45 C.F.R. § 164.524(a)(3)(iii).

A covered entity may disclose limited information to a person involved in the individual’s care. The information disclosed must be directly related to that person’s involvement with the patient’s care or payment for care. A covered entity may also disclose information necessary to identify or notify a personal representative or other person responsible for the individual’s care. If the patient is present and has capacity, the covered entity must obtain consent, provide the patient with an opportunity to object, or reasonably infer under the circumstances that the patient does not object. Section 164.510(b). In situations where the patient is not present, lacks capacity, or if there is an emergency, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the patient and, if so, disclose only the protected health information that is directly relevant to the person’s involvement with the patient’s health care. 45 C.F.R. § 164.510(b)(3).

Except as otherwise permitted or required (such as a disclosure to the health decision-maker), a covered entity may not use or disclose protected health information without an authorization that is valid under section 164.508(c). When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, its use or disclosure of protected health information must be consistent with the terms of the authorization. For families, this means family members who are not involved with the health care decision-making process may still obtain information regarding the patient’s care if the requesting individual has a properly structured HIPAA release. See Also HIPAA Permitted Disclosures.

Georgia Law Regarding Access to Medical Records

O.C.G.A. § 31-33-2(a)(2) provides “Upon written request from the patient or a person authorized to have access to the patient’s record under a health care power of attorney for such patient, the provider having custody and control of the patient’s record shall furnish a complete and current copy of that record, in accordance with the provisions of this Code section. If the patient is deceased, such request may be made by a person authorized immediately prior to the decedent’s death to have access to the patient’s record under a health care power of attorney for such patient; the executor, temporary executor, administrator, or temporary administrator for the decedent’s estate; or any survivor, as defined by Code Sections 51-4-2, 51-4-4, and 51-4-5.” The provider may refuse a request to deliver records to the patient if the provider reasonably determines that disclosure of the record to the patient will be detrimental to the physical or mental health of the patient. O.C.G.A. § 31-33-2(c). However, in that instance, the patient’s record shall, upon written request by the patient, be furnished to any other provider designated by the patient. Id. A provider may refuse to disclose records until a proper authorization is received with evidence of authority to sign said release. O.C.G.A. § 31-33-2(d). A fee may be charged for records. O.C.G.A. § 31-33-3.

Residents in long term care facilities have a right to access all medical records relating to their treatment. O.C.G.A. § 31-8-108(b)(6) provides: “To obtain from the resident’s physician or the physician attached to the facility a complete and current explanation concerning the resident’s medical diagnosis, treatment, and prognosis in language the resident can understand. Each resident shall have access to all information in the medical records of the resident and shall be permitted to inspect and receive a copy of such records unless medically contraindicated. The facility may charge a reasonable fee for duplication, which fee shall not exceed actual cost.”

Under Georgia law, a financial power of attorney granting general authority over personal decisions grants an agent authority under HIPAA to make payments for the provision of health care. O.C.G.A. § 10-6B-52(a)(5). Further, if a springing power of attorney is triggered by a medical condition, O.C.G.A. § 10-6B-9(d) grants the person authorized to make a capacity determination authority to obtain access to the principal’s health care information and communicate with the principal’s heath care provider.

Start Here

Enter your name and email address to keep up with what’s new at EZ Elder Law!

  • This field is for validation purposes and should be left unchanged.