US clients have rights that come from the Constitution, federal statutes, state law, court decisions, and accreditation and CMS standards. Hospitals that participate in Medicare must meet the CMS Conditions of Participation for patient rights, which include the right to participate in care planning, to make informed decisions, to formulate advance directives, to personal privacy, to receive care in a safe setting, to be free from abuse and harassment, to be free from restraint or seclusion not clinically required, to have records kept confidential and to access them, and to file a grievance.

Four areas are tested most often:

1. Informed consent — the right to decide about one's own body
2. Advance directives and the Patient Self-Determination Act (PSDA)
3. Privacy and confidentiality — HIPAA
4. Access to emergency care — EMTALA

Informed consent — elements

• Capacity — the person can understand, appreciate, reason, and communicate a choice
• Disclosure — the nature of the procedure, purpose, expected benefits, material risks, alternatives (including no treatment), and who will perform it
• Understanding — in plain language and the client's preferred language; use a qualified medical interpreter, not family members
• Voluntariness — free from coercion or undue influence
• Authorization — agreement, usually a signed form for invasive or high-risk procedures

Who does what

• The provider performing the procedure is responsible for disclosing information and obtaining consent
• The nurse often witnesses the signature — confirming the identity of the signer, that the signature is voluntary, and that the person appears competent — and assesses understanding. If the client has questions or does not understand, the nurse notifies the provider before the procedure and does not attempt to explain the risks of the procedure herself
• Do not obtain consent after sedating medication has been given

Types and exceptions

• Express consent (spoken or written) vs. implied consent (actions, such as holding out an arm for a blood draw)
• Emergency exception — when delay would threaten life or cause serious harm and no one authorized to consent is available, consent is implied; document the emergency and why consent could not be obtained
• Waiver — a capable client may choose not to be informed
• Refusal — a capable adult may refuse any treatment; document the information given and the refusal (an "informed refusal" form per policy)
• Minors — parents or guardians usually consent; exceptions by state law include emancipated minors, and minors seeking specific services such as contraception, sexually transmitted infection care, prenatal care, or substance use treatment. The mature minor doctrine is recognized in some states.
• Clients without capacity — a health care agent (named in an advance directive), a court-appointed guardian, or a surrogate according to the state's default hierarchy

Advance directives

Patient Self-Determination Act (1990; effective December 1, 1991) — applies to hospitals, skilled nursing facilities, home health agencies, hospices, and managed care plans that receive Medicare or Medicaid funds. They must:

• Give adult clients written information on their rights under state law to accept or refuse treatment and to make advance directives — at inpatient admission, nursing facility admission, before home health or hospice care begins, or on enrollment
• Ask whether the client has an advance directive and document it in the record
• Not condition care or discriminate based on whether a client has an advance directive
• Maintain written policies and provide staff and community education

The PSDA does not require clients to complete an advance directive.

HIPAA (Health Insurance Portability and Accountability Act, 1996) — Privacy, Security, and Breach Notification Rules

• Protects protected health information (PHI) — individually identifiable health information held by covered entities (providers, health plans, clearinghouses) and their business associates
• Disclosure without authorization is permitted for treatment, payment, and health care operations and for certain public interest purposes required by law (e.g., reportable diseases, child abuse reporting, some law enforcement requests)
• Minimum necessary standard — use or disclose only what is needed (does not apply to disclosures to providers for treatment)
• Client rights: receive a Notice of Privacy Practices; access and obtain copies of records (the covered entity generally has 30 days to act, with one 30-day extension); request amendment; receive an accounting of disclosures; request restrictions and confidential communications
• Breach notification — affected individuals must be notified without unreasonable delay and no later than 60 days after discovery; a breach affecting 500 or more residents of a state also requires notice to prominent media and to HHS within 60 days, while smaller breaches are logged and reported to HHS annually
• The Security Rule requires administrative, physical, and technical safeguards for electronic PHI
• The 21st Century Cures Act information-blocking rules also support prompt electronic access for clients to their own records
• Violations carry civil penalties and, for knowing misuse, criminal penalties; employers also discipline staff for "snooping"

EMTALA (Emergency Medical Treatment and Labor Act, 1986) — applies to Medicare-participating hospitals that offer emergency services. For anyone who comes to the emergency department requesting examination or treatment, regardless of ability to pay, insurance, or immigration status, the hospital must:

1. Provide an appropriate medical screening examination (MSE) to determine whether an emergency medical condition exists (including active labor)
2. If one exists, provide stabilizing treatment within its capability, or
3. Arrange an appropriate transfer: the receiving hospital agrees and has capacity, the sending hospital provides treatment to minimize risk, sends records, and uses qualified personnel and equipment; the benefits of transfer must outweigh the risks (or the client requests transfer in writing after being informed)
4. Hospitals with specialized capabilities must accept appropriate transfers if they have capacity
5. Registration or insurance questions must not delay screening or stabilization
6. The law was enacted to stop "patient dumping"; violations bring civil penalties and loss of Medicare participation

Confidentiality at work

• Access only the records of clients you are caring for; audit trails record every access
• Do not discuss clients in elevators, cafeterias, or outside work, including with their family, unless the client has authorized it
• Verify identity before releasing information by phone; use client-chosen passwords where policy allows
• Never post client information or images on social media, even without names
• Position screens and records away from public view; log off workstations

Mandatory disclosures (state law) — reportable communicable diseases, suspected child abuse or neglect, elder or dependent adult abuse, certain injuries (e.g., gunshot wounds in many states), and a duty to warn or protect identifiable third parties threatened by a client (from the Tarasoff decision; rules vary by state).

• Confirm valid consent, correct procedure, and correct client before any procedure; stop the process if the client expresses doubt
• Assess understanding; arrange interpreters and accessible formats
• Ask about advance directives at admission; place copies in the record; tell the provider and team; ensure code status is clear
• Honor a refusal after ensuring it is informed; notify the provider; document
• Protect privacy in every setting; report privacy breaches to the privacy officer
• Know EMTALA duties in emergency and labor and delivery areas — never tell a client to leave or go elsewhere before screening
• Advocate when a client's rights are at risk, using the chain of command

• Treating without consent can be battery; inadequate disclosure can support a negligence claim (lack of informed consent)
• Consent may be withdrawn at any time, even after signing
• An advance directive can be changed or revoked by a capable client at any time; the current wishes of a capable client override a prior document
• HIPAA allows sharing necessary information with family involved in care if the client agrees or does not object, or when the client is incapacitated and sharing is in the client's best interest
• EMTALA preempts state or local laws only where they directly conflict with its requirements. How this applies to pregnancy-related emergencies remains contested in the courts; CMS withdrew its 2022 guidance on this issue in June 2025 — follow current facility legal guidance
• Ethically, these rights express respect for autonomy, confidentiality, and justice

Case 1. Before surgery, a client who has signed consent asks the nurse, "What are they actually going to remove?" Correct action: stop the preparation for the procedure and notify the surgeon to re-explain; document. Why: the client does not have adequate understanding; disclosure is the provider's duty.

Case 2. An uninsured man with chest pain arrives at a private hospital's emergency department. A clerk suggests sending him to the county hospital. Correct action: perform the medical screening examination and stabilize; transfer only if appropriate criteria are met. Why: EMTALA forbids refusal or transfer based on ability to pay.

Case 3. On admission, a client states she has a living will at home. Correct action: document it, ask for a copy to be brought, inform the provider, and review her wishes. Why: PSDA requires asking and documenting.

Case 4. A nurse looks up a neighbor's lab results out of concern. Problem: unauthorized access — a HIPAA violation and grounds for discipline, even if nothing is disclosed.

• Thinking the nurse obtains informed consent for surgery — the provider does; the nurse witnesses and verifies understanding
• Believing the PSDA requires clients to have an advance directive — it requires facilities to inform, ask, and document
• Confusing a living will (wishes) with a durable power of attorney for health care (decision-maker)
• Assuming a DNR order means no other treatment
• Assuming HIPAA forbids all sharing without written permission — treatment, payment, operations, and legally required reports are permitted
• Letting registration or insurance verification delay emergency screening
• Using family members, especially children, as interpreters

• Informed consent: capacity, disclosure, understanding, voluntariness; provider discloses, nurse witnesses and checks understanding
• Emergency exception = implied consent; a capable adult may refuse any treatment
• PSDA (1990): Medicare/Medicaid facilities must inform about rights, ask about advance directives, document, not discriminate
• Living will = wishes; health care power of attorney = agent; POLST = portable medical orders
• HIPAA: PHI; minimum necessary; access within 30 days (one 30-day extension); breach notice within 60 days
• EMTALA (1986): screening exam, stabilization, appropriate transfer — regardless of ability to pay
• Mandatory reporting and duty to warn are lawful exceptions to confidentiality
• Accessing records without a care need is a privacy violation