Module 9 · Administrative and Ancillary Duties
Lesson 9.2 — Ethical, Legal, and Professional Practice
Everything covered so far in this course — counts, sterile technique, documentation — exists inside a legal and ethical framework. This lesson makes that framework explicit: HIPAA, patient rights, the four elements of negligence, and the legal doctrine that makes a retained sponge (Lesson 4.1) one of the clearest examples of presumed negligence in all of medical law.
📋 NBSTSA Blueprint: Domain II-A · Administrative and Personnel — “Apply ethical and legal practices related to surgical patient care”
🎯 High-Yield Topics — What Gets Tested
HIPAA — the minimum necessary standard · Confidentiality as both an ethical duty and legal requirement · Negligence vs. malpractice — the distinction · The four elements of negligence: duty, breach, causation, damages · Res ipsa loquitur — “the thing speaks for itself” · Why a retained sponge is a textbook example of presumed negligence · Battery — unauthorized touching, even without harm · Incident reports — purpose and documentation principles · Mandatory reporting obligations
1. HIPAA and Patient Confidentiality
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 sets the national legal standard for protecting patient health information. Every member of the surgical team — including the CST — is bound by it.
The Minimum Necessary Standard
HIPAA does not prohibit all disclosure of patient information — it requires that any disclosure be limited to the minimum necessary to accomplish the specific purpose. A CST discussing a patient’s positioning needs with the circulator is appropriate and necessary; discussing that same patient’s case in the cafeteria, where it can be overheard, is not, regardless of whether names are used.
Confidentiality Is Both Ethical and Legal
Patient confidentiality exists as both a professional ethical duty (patients trust the surgical team with extremely private information) and a legal requirement enforceable through HIPAA. A breach can trigger consequences on both tracks simultaneously: professional discipline for the ethical violation, and separate legal penalties — ranging from fines to civil liability to, in severe cases, criminal charges — for the HIPAA violation.
Vicarious Liability
Under this legal principle, an employer can be held responsible for a confidentiality breach committed by an employee acting within the scope of their job — meaning a facility can face liability for a CST’s HIPAA violation even though the CST personally committed the breach. This is part of why facility-wide confidentiality training and policy enforcement matter so much operationally.
📝 Knowledge Check 1: While in the break room, a CST overhears a colleague describing an unusual finding during a patient’s surgery in sufficient detail that nearby staff could identify the patient, even though no name was stated. Has a HIPAA violation occurred?
A. No — HIPAA only applies to written or electronic records, not spoken conversation
B. No — since the patient’s name was never spoken, there is no violation
C. Yes — sharing identifying case details in a non-clinical setting where they can be overheard exceeds the minimum necessary standard, regardless of whether a name was used
D. Yes, but only if the colleague intended to cause harm to the patient
Reveal Answer
✅ Correct Answer: C
HIPAA applies to spoken conversation just as much as written records — the format of disclosure doesn’t matter, what matters is whether identifiable patient information was shared beyond what was necessary and appropriate for the setting. If enough identifying detail is shared that the patient could reasonably be recognized by others in an uncontrolled setting like a break room, this exceeds the minimum necessary standard even without a name being used. Option D is incorrect — intent to harm is not required for a confidentiality breach to occur; careless disclosure is sufficient. This scenario, discussing patient details where they can be overheard by uninvolved staff, is one of the most common real-world HIPAA violations precisely because it feels casual rather than clinical.
2. Negligence and Malpractice — The Distinction
These terms are often used interchangeably in casual conversation, but they have a specific legal relationship the exam tests.
Negligence vs. Malpractice
Negligence is the general legal concept: failing to act as a reasonably careful person would act under similar circumstances, resulting in harm.
Malpractice is negligence committed specifically by a professional (a physician, nurse, or other licensed/credentialed healthcare provider) that falls below the accepted standard of care for that profession. Malpractice is essentially professional negligence — a more specific legal category applied to healthcare (and other professional) contexts.
3. The Four Elements of Negligence
For a negligence claim to succeed, a plaintiff must generally prove all four of the following elements. This framework is the backbone of virtually every medical malpractice case, and understanding it clarifies why documentation, counts, and protocol adherence matter so much legally — not just clinically.
4. Res Ipsa Loquitur — “The Thing Speaks for Itself”
This legal doctrine is directly relevant to the surgical setting and connects explicitly to material already covered in this course. In most negligence cases, the plaintiff must affirmatively prove breach and causation. Res ipsa loquitur is an exception: certain injuries are so obviously the result of negligence that the burden shifts to the defendant to prove they were not negligent.
🚫 The Three Elements of Res Ipsa Loquitur
① The injury is of a type that does not ordinarily occur without negligence
② The instrumentality causing the injury was under the defendant’s (or surgical team’s) exclusive control
③ The injury was not caused by any action of the patient
💡 The Retained Sponge — The Classic Surgical Example: Courts have repeatedly held that a surgical sponge or instrument left inside a patient satisfies all three res ipsa loquitur elements — the injury (a retained foreign body) simply does not occur absent a breach of the standard of care, the sponge was under the surgical team’s exclusive control, and the patient obviously played no role in causing it. One court described sponge cases memorably: they “rarely occur, they never occur absent negligence, and when they do occur, laypeople are hard-pressed to discover the wrong.” Wrong-site surgery and wrong-patient surgery are treated the same way. This is the direct legal weight behind everything taught in Lesson 4.1 about counts — a retained item isn’t just a clinical failure, it is treated by courts as presumed negligence that the surgical team must affirmatively disprove.
📝 Knowledge Check 2: A patient discovers, months after a routine hysterectomy, that a surgical sponge was left inside the abdominal cavity during the original procedure. In the resulting legal claim, why does res ipsa loquitur make this case different from a typical negligence claim?
A. The patient must still independently prove exactly which team member was responsible before any claim can proceed
B. The burden shifts to the surgical team to prove they were not negligent, since a retained sponge does not ordinarily occur absent a breach of the standard of care and the sponge was under the team’s exclusive control
C. Res ipsa loquitur eliminates the need for the patient to show any damages occurred
D. Res ipsa loquitur only applies if the patient can prove the team acted with intent to harm
Reveal Answer
✅ Correct Answer: B
Res ipsa loquitur shifts the burden of proof. Normally the patient (plaintiff) must affirmatively prove breach of duty and causation — but because a retained sponge satisfies all three res ipsa loquitur elements (injury doesn’t happen without negligence, exclusive team control, no patient contribution), the surgical team instead bears the burden of proving they were not negligent. Option A is wrong — the doctrine specifically exists because pinpointing the exact responsible individual is often impossible for a layperson, which is precisely why the doctrine applies. Option C is wrong — damages (the retained sponge and any resulting harm) must still be shown; res ipsa loquitur addresses the breach/causation elements, not damages. Option D is wrong — negligence, including this doctrine, never requires proof of intent to harm; ordinary carelessness is sufficient.
5. Battery — Touching Without Consent
Battery is an unauthorized, unpermitted touching of a person — and critically, intent to cause harm is not required for battery to have legally occurred; unpermitted touching alone is sufficient, even if the outcome was medically beneficial. This is the direct legal foundation behind the informed consent principles covered in Lesson 3.2 — performing a procedure beyond the scope of what a patient consented to, or proceeding after a patient has withdrawn consent, can constitute battery regardless of surgical skill or good intentions. A signed, valid, procedure-specific informed consent is what legally authorizes the surgical team’s contact with the patient in the first place.
6. Incident Reports and Mandatory Reporting
Incident Reports
A formal, factual, objective document completed whenever an unusual event, error, or patient safety concern occurs — an incorrect count that required an X-ray (Lesson 4.1), a needlestick injury, equipment malfunction, or any deviation from expected care. Incident reports record only what happened, when, and who was involved — factual observation, not speculation, blame, or opinion about cause. They support quality improvement tracking and are a component of a facility’s broader risk-management and patient-safety program.
Mandatory Reporting Obligations
Certain findings must be reported to appropriate authorities regardless of patient or family preference — examples include specific communicable diseases, gunshot wounds, and signs of suspected abuse or neglect. These reporting laws exist because the public health or safety interest outweighs the normal expectation of confidentiality in these specific, legally defined circumstances.
⚡ Rapid Review — Ethical, Legal, and Professional Practice High-Yield Facts
Lesson 9.2 Complete
This lesson exists to show you the legal “why” underneath the clinical “how” taught throughout this course. Res ipsa loquitur, in particular, is the direct legal weight behind every count protocol in Lesson 4.1 — understanding it should make that lesson’s rules feel less like arbitrary procedure and more like genuine legal necessity.
Next: Lesson 9.3 — Preference Cards, Cost Containment, and OR Management