Utilitarianism and risk Morten Fibieger Byskov Department of Politics and International Studies, Northern University of Warwick, Coventry, United Kingdom ABSTRACT In day-to-day life, we are continuously exposed to different kinds of risk. Unfortunately, avoiding risk can often come at societal or individual costs. Hence, an important task within risk management is deciding how much it can be justified to expose members of society to risk x in order to avoid societal and individual costs y – and vice versa. We can refer to this as the task of setting an acceptable risk threshold. Judging whether a risk threshold is justified requires normative reasoning about what levels of risk exposure that are permissible. One such prominent normative theory is utilitarianism. According to utilitarians, the preferred risk threshold is the one that yields more utility for the most people compared to alternative risk thresholds. In this paper, I investigate whether and the extent to which utilitarian theory can be used to nor- matively ground a particular risk threshold in this way. In particular, I argue that there are (at least) seven different utilitarian approaches to setting an acceptable risk threshold. I discuss each of these approaches in turn and argue that neither can satisfactorily ground an acceptable risk threshold. ARTICLE HISTORY Received 28 February 2018 Accepted 10 July 2018 KEYWORDS Philosophy of risk; ethics; utilitarianism; equality In day-to-day life, we are continuously exposed to different kinds of risk. These risks may range from the longer-term and potentially life threatening, such as climate change, to the mundane, such as catching the flu or being involved in a car accident. Unfortunately, avoiding risk can often come at societal or individual costs. We may, for example, restrict access to public areas during a disease outbreak or impose mass surveillance measures to prevent terrorist attacks. Hence, an important task within risk management is deciding how much it can be justified to expose members of society to risk x in order to avoid societal and individual costs y – and vice versa. We can refer to this as the task of setting an acceptable risk threshold. Judging whether a risk threshold is justified requires normative reasoning about what levels of risk exposure that are permissible. One such prominent normative theory is utilitarianism. Utilitarians hold that pref- erable action in a certain situation is the one that maximizes the most utility for the most peo- ple. Hence, according to utilitarians, the preferred risk threshold is the one that yields more utility for the most people compared to alternative risk thresholds. Although the cost-benefit calculus of utilitarianism has often been invoked within risk man- agement and assessment (Guehlstorf 2012, 45–47), little philosophical literature has investigated whether utilitarianism can be applied to the task of setting an acceptable risk threshold. CONTACT Morten Fibi.

1. Utilitarianism and risk
Morten Fibieger Byskov
Department of Politics and International Studies, Northern
University of Warwick, Coventry,
United Kingdom
ABSTRACT
In day-to-day life, we are continuously exposed to different
kinds of risk.
Unfortunately, avoiding risk can often come at societal or
individual
costs. Hence, an important task within risk management is
deciding
how much it can be justified to expose members of society to
risk x in
order to avoid societal and individual costs y – and vice versa.
We can
refer to this as the task of setting an acceptable risk threshold.
Judging
whether a risk threshold is justified requires normative
reasoning about
what levels of risk exposure that are permissible. One such
prominent
normative theory is utilitarianism. According to utilitarians, the
preferred
risk threshold is the one that yields more utility for the most
people
compared to alternative risk thresholds. In this paper, I
investigate
whether and the extent to which utilitarian theory can be used to

2. nor-
matively ground a particular risk threshold in this way. In
particular, I
argue that there are (at least) seven different utilitarian
approaches to
setting an acceptable risk threshold. I discuss each of these
approaches
in turn and argue that neither can satisfactorily ground an
acceptable
risk threshold.
ARTICLE HISTORY
Received 28 February 2018
Accepted 10 July 2018
KEYWORDS
Philosophy of risk; ethics;
utilitarianism; equality
In day-to-day life, we are continuously exposed to different
kinds of risk. These risks may range
from the longer-term and potentially life threatening, such as
climate change, to the mundane,
such as catching the flu or being involved in a car accident.
Unfortunately, avoiding risk can
often come at societal or individual costs. We may, for example,
restrict access to public areas
during a disease outbreak or impose mass surveillance measures
to prevent terrorist attacks.
Hence, an important task within risk management is deciding
how much it can be justified to
expose members of society to risk x in order to avoid societal
and individual costs y – and vice
versa. We can refer to this as the task of setting an acceptable
risk threshold. Judging whether a
risk threshold is justified requires normative reasoning about

3. what levels of risk exposure that
are permissible. One such prominent normative theory is
utilitarianism. Utilitarians hold that pref-
erable action in a certain situation is the one that maximizes the
most utility for the most peo-
ple. Hence, according to utilitarians, the preferred risk
threshold is the one that yields more
utility for the most people compared to alternative risk
thresholds.
Although the cost-benefit calculus of utilitarianism has often
been invoked within risk man-
agement and assessment (Guehlstorf 2012, 45–47), little
philosophical literature has investigated
whether utilitarianism can be applied to the task of setting an
acceptable risk threshold.
CONTACT Morten Fibieger Byskov [email protected]
Department of Politics and International Studies,
University of Warwick, Coventry, CV4 7AL, United Kingdom
� 2018 Informa UK Limited, trading as Taylor & Francis Group
JOURNAL OF RISK RESEARCH
2020, VOL. 23, NO. 2, 259–270
https://doi.org/10.1080/13669877.2018.1501600
http://crossmark.crossref.org/dialog/?doi=10.1080/13669877.20
18.1501600&domain=pdf
https://doi.org/10.1080/13669877.2018.1501600
http://www.tandfonline.com
Moreover, as I shall argue, the most prominent rejection of a
utilitarian approach to risk – that of
Hansson (2003, 2013, 2014) – does not address all possible
utilitarian positions. In this paper, I

4. aim to fill this lacuna by investigating whether and the extent to
which utilitarian theory can be
used to normatively ground a particular risk threshold in this
way. In particular, I argue that there
are (at least) seven different utilitarian approaches to setting an
acceptable risk threshold. I dis-
cuss each of these approaches in turn and argue that neither can
satisfactorily ground an accept-
able risk threshold.
The paper is structured as follows. In the first section, I provide
a short introduction to the
concept of risk and the task of setting an acceptable risk
threshold. In the second section, I intro-
duce the normative theory of utilitarianism and how it can be
applied to the context of risk
assessment. I discuss two general utilitarian positions – the
actualist and the expected utility
positions – and the arguments raised against them by Hansson
(2003, 2013). In the third section,
I identify five more specified utilitarian positions, discuss
whether they are suitable for the task
of setting acceptable risk thresholds, and conclude that they are
not. In the fourth section, I
address two objections to this conclusion, while I reflect on the
broader consequences of my
argument in the fifth section and how to take the research on
ethics and risk forward.
1. Acceptable risk
It is difficult to avoid exposure to risk. Consider, for example,
how you exposure yourself to the
risk of being hurt in a car accident every time you enter into
traffic, whether as a driver, passen-
ger, or pedestrian. Now, that does not mean that you will

5. necessarily be in a car accident in
your lifetime, of course, even if you expose yourself to this risk
on a daily basis and you may
even take precautions against this risk materializing, for
example, by driving within the speed
limit, looking both ways before crossing an intersection, or by
putting on your seatbelt.
Technically speaking, we can define risk (R) as the ‘expectation
value of an unwanted event
which may or may not occur’ (Hansson 2014, section 1; italics
in original). The ‘expectation value’
of an unwanted event is calculated as a function of the
probability (p) that the event will bring
about the expected consequences and the severity (s) of these
consequences (Zinn 2009, 5).1 To
illustrate, consider how, in the above example, the probability
of getting hurt in a car accident
can be lowered by driving carefully while the severity of such
an incident occurring can be miti-
gated by wearing one’s seatbelt.
In many cases, however, we have little direct control, as
individual actors, over the extent to
which we are exposed to certain risks and their consequences.
The risk of being in a car acci-
dent, for example, to a large degree depends on the actions of
other drivers who may not be as
careful behind the wheel. For this reason, it often falls upon
public officials to manage the extent
to which the public is exposed to risks, for example, through the
implementation and enforce-
ment of traffic regulations. The problem, however, is that the
safest way to minimize the risk of
people getting hurt in car accidents is to outright ban cars,
which, for obvious reasons, would

6. have enormous societal and economic consequences.
Hence, a problem with risk management is that avoiding or
minimizing risk often involves
measures that are if not unrealistic in a functioning society will
at least often involve societal or
individual costs. As a consequence, in such cases the task of
risk management is not necessarily
to avoid risk altogether but rather to minimize risk exposure
while limiting the negative societal
consequences of risk avoidance. We can refer to this task of
balancing concerns of risk exposure
with larger societal concerns as the task of setting an acceptable
risk threshold.
Setting an acceptable risk threshold involves balancing two
types of error (Hansson 2014,
section 3). The first type of error (Ei) stems from safeguarding
against some perceived outcome
to an extent that is not proportional to the actual probability or
severity of that outcome. As
such, the first type of error is associated with what we usually
call a ‘false positive’: assuming
260 M. F. BYSKOV
that a risk is more probable and/or more severe than it actually
is. The second type of error (Eii),
is what we usually call a ‘false negative’ and occurs when the
probability and/or severity of an
expected event is underestimated. The problem here is the
opposite than for a false positive,
namely that we fail to safeguard against an actual unwanted
event. An acceptable risk threshold

7. can be defined as a function of comparing and balancing the
probability and severity of these
two types of error.
There are three different ways in which we can set an
acceptable risk threshold by balancing
Ei and Eii. First, we can simply choose to minimize the error
that has the highest expectation value.
Thus, if Ei (as a function of pi x si) is larger than Eii (as a
function of pii x sii) then we should
choose to minimize Ei. However, this does not solve the issue,
as it would allow us to run a risk
with a high expectation value, for example if both types of error
have a high expectation value,
yet where Eii has an only slightly less severe outcome than Ei.
Second, the acceptable risk threshold could be set at the point at
which the combined expect-
ation value of the two types of error (i.e. pi x siþ pii x sii) is the
lowest. If we face two inevitable
risks this solution aims to minimize the overall risk. The
problem, however, is that by aggregating
expectation values for different people in this way might lead to
a widely unequal distribution of
risk among affected individuals. That is, if the lowest combined
expectation value is the result of
one high expectation value of Ei, which is cancelled out by a
very low expectation value of Eii,
then the burden of this risk threshold falls disproportionally on
those who are vulnerable to the
consequences of Ei.
Third, we can set the risk threshold at the point in which the
expectation value of the two
types of error is equal (i.e. pi x si¼ pii x sii) or, more
realistically, approximately equal (i.e. pi x si �

8. pii x sii) . This would solve the issue above as it would prohibit
the unequal distribution of risk
among affected individuals. The problem with this solution,
however, is that it could endorse a
high threshold for acceptable risk in cases where there is no
equal distribution among low-risk
versions of Ei and Eii. That is, in some cases, lowering the
threshold for one type of risk, thereby
protecting one group of individuals from risk-exposure, may
actually require a trade-off with
other types of risks, leading to an increase in risk-exposure for
a different group of individuals.
A major issue in setting an acceptable risk threshold concerns
how to make such trade-offs
between different risks. How can we weigh different kinds of
risks against each other? What
kinds of risks do we find more acceptable and which do we want
to avoid at all costs? The prob-
lem, as Zinn (2009, 13; emphasis in original) argues, is that it is
unclear what the losses are with
each risk and how much weight they should be given: ‘Central
is the sociocultural dimension of
values. Risk questions are never just a question of the rational
application of objective, value-free
problems. Even in the highest technical application, values
concerning the acceptability of a spe-
cific level of risk or uncertainty are involved’. In this sense,
risk assessment and the task of set-
ting an acceptable risk threshold is inherently normative
(Cranor 1997).
In the following sections I investigate whether, or the extent to
which, one influential norma-
tive theory – namely, utilitarianism – can resolve this issue of
how to trade-off different types of

9. risks. Utilitarianism has often been invoked in risk management
due to its cost-benefit calculus.
Do the benefits, utilitarians ask, outweigh the costs?
2. Utilitarianism and risk
Consequentialism is the ethical view that an action should be
evaluated based on the conse-
quences that it brings about (Darwall 2003; Scheffler 1988).
Now, this does not tell us much.
According to which standard(s) should we evaluate the
goodness or badness of an action’s con-
sequences? Utilitarianism is the most popular version of
consequentialism. According to utilitar-
ians, the goodness or badness of an action’s consequences
should be measured in terms of the
JOURNAL OF RISK RESEARCH 261
amount of utility they bring about. Usually, utilitarianism is
said to hold the maxim that the pref-
erable action is the one that maximizes the most utility for the
most people.2
How can we take a utilitarian approach to setting an acceptable
risk level?3 Hansson (2003,
293–97, 2013, 23–28) has influentially identified and criticized
two major utilitarian approaches
to risk, namely the actualist position and the expected utility
position. In this section, I summar-
ize Hansson’s critiques of these two positions before I turn, in
the followings section, to argue
that we can identify five additional utilitarian position that can
avoid the shortcomings of the

10. actualist and expected utility positions.
The first utilitarian position holds that we should focus on the
utility of the actual consequen-
ces that are brought about by a certain action. That is, according
to the actualist position,
whether we are justified in running a particular risk, depends on
the actual outcome. For
example, imagine that we judge that a medical procedure has
50% risk of leading to complica-
tions for the patient. If we perform the procedure and no
complications arise, the actualist pos-
ition holds that we made the right decision in performing the
procedure. We can state the
actualist position in the following way.
1. Actualist utilitarian position. We are justified in relaxing
precautionary measures if (and only if) we
thereby actually bring about an equal or increase in utility
output as compared to retaining or further
strengthening existing precautionary measures.
According to the actualist position, whether or not we ought to
relax precautionary measures
against exposure to a particular risk can only be judged
retrospectively: did our decision actually
bring about an increase in utility output, all things considered,
or did it actually make things
worse? There are two major issues with the actualist position,
however, according to Hansson.
First of all, the actualist position only tells us ex post whether
we were justified in running a
particular risk. Yet, when setting an acceptable risk level, we
want to know beforehand whether
we are justified in relaxing the precautionary measures (or not).

11. Thus, although the actualist pos-
ition might be well suited to evaluate actual actions, it is ill
suited for providing action-guidance
where it is necessary to predict the justifiability of running
certain risks.
A second major issue with the actualist position is that it may
actually justify – ex post, of
course – taking quite severe risks. Imagine, for example, that
there is a 50% risk that relaxing
precautionary measures against a disease outbreak will lead to a
(significant) increase in mortal-
ity from infections and related complications. As above, if we
relax the precautionary measures
and no such increase in mortality occurs, the actualist position
hold that we were justified in
running this risk. However, we would not usually say that we
justified in taking a risk where
someone has a 50% risk of dying, such as flipping a coin for
someone’s life. Thus, the actualist
position does not sit well with our moral intuitions.
The second version of the utilitarian approach thus holds that
we should focus on the
expected utility that an action will bring about, rather than the
actual outcome. According to
the expected utility position, we should choose the action that
has the highest probability of
yielding the highest utility outcome. Consider, for example, two
alternatives. While both alterna-
tives have an expected increase in utility outcome of two units,
the first alternative has a 50%
chance of leading to this increase in overall utility compared to
the second alternative’s 75%
chance of achieving the same increase in utility output. On the
expected utility position, we

12. should prefer the latter alternative. The expected utility position
is better suited to deal with risk
since it takes into account the aspect of probability. We can
restate the expected utility position
in the following way:
2. Expected utility position. We are justified in relaxing
precautionary measures if (and only if) there is a
greater probability that it will lead to an equal or higher
expected utility output than retaining or further
strengthening existing precautionary measures.
What the expected utility position holds is that, when managing
risk, we need to focus on
the probability that relaxing (or strengthening) precautionary
measures will bring about a better
262 M. F. BYSKOV
state of affairs (i.e. a better utility output). To exemplify, let us
imagine that we can relax,
strengthen, or retain the current precautionary measures in some
unspecified context. While the
current control measures yield a utility output of 5 units out of
ten, both strengthening and
relaxing the control measures will lead to an increase in utility
output up to, say, 7 units. (The
utility output will naturally be distributed differently between
groups, whether we decide to
relax or to strengthen the control measures.) Let us further
imagine that there is a 75% probabil-
ity that relaxing control measures will lead to this increase in
utility output, while the probability
that strengthening the measures will have the same result is a

13. mere 50%. In this case, according
to the expected utility position, we are justified in relaxing the
precautionary measures because
the chance that this decision will lead to a better state of affairs,
measured in terms of expected
utility output, is higher than the alternative options.
A major problem, however, is that a commitment to evaluating
actions and decisions in terms
of their expected utility output allows us to overrule the
interests of a few individuals in favor of
the many if this leads to an increase in overall utility. Consider,
for example, how the alternative
of strengthening control measures might have 75% probability
of yielding a two-point increase
in overall utility output from five units to seven units. However,
we can further imagine that
while the five utility units of the status quo were equally
divided among different groups of
stakeholders, strengthening the precautionary measures would
lead to an unequal distribution of
utility among different groups. We can for example imagine that
in this case the public would
derive more utility from stricter precautionary measures (say,
six units) than those who are tar-
geted – for example, car owners or carriers of an infectious
disease – by these measures and
who will only derive one utility unit from this new control
strategy. Thus, while a strengthening
of the precautionary measures might lead to an overall increase
in utility output, it would argu-
ably put an unreasonable burden on those targeted by the
measures. Hence, one of the prob-
lems with the expected utility position is that allows for the
aggregation of utility output at the
expense of a few suffering individuals.4

14. Based on these arguments, Hansson concludes that
utilitarianism is poorly suited to deal with
risk and the task of setting an acceptable risk threshold.
However, as I will argue in more detail
in the following, by only focusing on the actualist and expected
utility versions of utilitarianism,
Hansson risks arguing against a straw man. That is, as I show in
the section, there are at least
five alternative utilitarian positions that might be better at
dealing with risk.
3. Five alternative utilitarian approaches to risk
One of the main objections to utilitarianism, as Hansson’s
highlights in his criticism, is the prob-
lem of aggregation. The problem of aggregation arises from the
utilitarian maxim that overall
utility output should be maximized for as many people as
possible. Consequently, utilitarians
who advocate this maxim would endorse sacrificing the well-
being or safety of a few people as
long as it is outweighed by an increase in well-being or safety
to the majority of society.
To illustrate, consider the case of a potential nuclear meltdown
(Hansson 2003). We can avoid
this meltdown by sending in one engineer to repair the nuclear
power plant. The engineer, how-
ever, will most likely die in the process due to radiation
poisoning. Is it justified to sacrifice the
life of one engineer in order to protect many more members of
society from radiation poison-
ing? Utilitarians who endorse the utility maximization maxim
would answer yes to this question
as the overall utility is clearly increased by sacrificing the lone

15. engineer. Yet, to most people,
including many moral philosophers of deontological or
contractualist persuasions, it is not per-
mitted to simply sacrifice the life one human being like that.
Is it possible to construct a utilitarian position that does not
suffer from the problem of aggre-
gation? It might be argued that we can avoid the problem of
aggregation, which persists with
the two utilitarian positions discussed in the previous section,
by demanding that the
JOURNAL OF RISK RESEARCH 263
distribution of the expected utility should also be the most
equal. We can call this the equal dis-
tribution of expected utility position. This position holds that
we should choose the option that
has the highest probability of delivering the most equal
distribution of utility among different
(groups of) individuals. Let us restate this equality-weighted
version of the expected utility pos-
ition as follows:
3. Equality-weighted expected utility position. We are justified
in relaxing precautionary measures if (and
only if) there is a greater probability that it will lead to a more
equal distribution of utility among affected
stakeholders.
The problem with strict egalitarian approaches like this is that
they are vulnerable to what
has been called the leveling down objection (Gosepath 2011,
section 5.1; Nozick 1974, 229; Raz

16. 1986, chapter 9; Temkin 1993, 247–48). According to the
leveling down objection, distributive
principles that favor a perfectly equal distribution would
endorse lower overall utility output as
long as it is distributed equally among stakeholders. Recall the
example in the previous section:
we can choose to strengthen precautionary measures, which
would increase the overall utility
output from five to seven measures. Yet, whereas retaining the
status quo would distribute the
five utility units equally, the benefits of implementing stricter
precautionary measures would be
distributed unequally. We can, for example, imagine sacrificing
one group, so that they only
receive one utility unit, in order to protect another group who
will receive six utility units.
According to the equality-weighted expected utility position, we
should decide to retain the
existing precautionary measures, but that would lead to a worse
overall outcome in terms of util-
ity (i.e. five utility units rather than seven).
Proponents of the equality-weighted expected utility position
could of course argue that their
approach protects some people from being much worse off by
implementing certain precaution-
ary measures or by exposing certain people to very high risks in
order to protect other people a
smaller risk, such as in the case of the engineer sent in to
prevent the nuclear meltdown. Yet,
even in cases where all affected stakeholders would be (much)
better off than the status quo,
the equality-weighted position would still endorse a lower
overall utility output as long as the
output is distributed equally among the affected stakeholders.

17. Consider, for example, how we can protect against some risk by
implementing either of two
precautionary measures. The first precautionary has a good
probability of leading to an increase
in utility output from five to eight utility units. Let us further
assume that all affected stakehold-
ers would benefit equally from this increase, such that if there
are two groups of stakeholders
each would receive four measures of utility from the
implementation of the first precautionary
measure. The second precautionary measure would lead to an
even larger increase in overall util-
ity output, namely from five to nine utility units. However,
while the second precautionary meas-
ure protects one group equally to the first precautionary
measure, the other group receives even
better protection from the second precautionary measure than its
alternative. Consequently,
while the first group receives four utility units from the second
precautionary measure, the
second group receives five utility units. According to the
equality-weighted expected utility pos-
ition we should prefer the first precautionary measure as it
yields the most equal distribution of
utility. However, this conclusion seems odd since the worst off
in this scenario – the first group
– does not experience any loss between the two alternative
precautionary measures. In fact, the
second precautionary measure could provide even better
protection for some people without
sacrificing others.
In order to avoid the leveling down objection, we might further
choose to add a clause to
the equality-weighted expected utility position that prohibits
such leveling down:

18. 4. Equality-weighted expected utility position, with leveling
down-prohibition. We are justified in
relaxing precautionary measures if (and only if) there is a
greater probability that it will lead to a more equal
distribution of utility among affected stakeholders – as long as
this does not also lead to a decrease in overall
utility output.
264 M. F. BYSKOV
Even this amended expected utility position does not get us very
far in answering whether
we are justified in relaxing precautionary measures, however, as
it is also subject to the second
problem that we can identify with the expected utility position.
The second problem states that
the expected utility position (and, by extension, the equality-
weighted expected utility position)
prohibits cautious decision-making that avoids low-probability
risks that have high-stakes out-
comes (Hansson 2003). For example, we would usually avoid
taking any actions that would increase
the risk of a serious outbreak of Ebola, even if the probability
of such an outbreak were quite low. This
is contradictory to the expected utility approach’s position that
we should choose the alternative
with the highest probability of yielding the highest utility
output. This is so in two ways.
First of all, it is contradictory to the idea that we should always
choose the alternative with
the highest probability of an increase in utility output. That is,
if this alternative also carries a

19. higher probability of some serious consequence, such as an
Ebola outbreak, we would usually
be justified in choosing an alternative with a lower probability
of an increase in utility output if
this alternative does not also increase the probability of this
serious consequence happening.
Second, it is contrary to the idea that we should choose the
alternative with the highest expected
utility. That is, if the alternative with the highest utility output
also involves an increase –
whether negligible or not – in the probability that some serious
consequence, such as an Ebola
outbreak, will happen, then we are usually justified in choosing
for an alternative with a lower
overall utility output.
Thus, taking into account the need to be risk-averse in terms of
certain serious consequences,
we cannot make use of the expected utility positions. The fifth
version of the utilitarian approach
demands that for each alternative we set a ‘security-threshold’
for the probability that the worst-
case scenario will happen. This position is usually referred to as
the maximin utilitarian position
as it aims to ‘maximize the minimal outcome’ (Hansson 2003,
295–96). The maximin position can
be stated as follows:
5. Maximin utilitarian position. We are justified in relaxing
precautionary measures if (and only if) it does not
lead to an increase in the probability of the worst-case scenario
happening.
The problem with this position, though, is that it remains
indeterminate between cases that
do not lead to an increase in the probability of a worst-case

20. scenario. Consider, for example,
how both retaining and strengthening current precautionary
measures against an Ebola outbreak
might not lead to an increase in probability of an outbreak
happening. The maximin position
does not provide us with any way of deciding between these two
alternatives since it is only
concerned with the worst-case scenario, even if it would be
reasonable to retain the measures
so as to avoid incurring further societal and individual costs.
Moreover, the maximin position seems to biased against taking
a slightly greater risk with
higher benefits. Consider, for example, how getting to work in
the morning – whether by private
or public transportation – increases the risk of the worst-case
scenario happening, namely get-
ting killed in a traffic accident. On the maximin position, as it
is stated above, going to work
would be prohibited due to the increase in the probability of the
worst-case scenario occurring.
But surely the benefits outweigh the risk in this example: on a
household level, being able to
work provides an income that can pay for accommodation, food,
and leisure activities; on a soci-
etal level, employees contribute to the overall economy and
productivity. If we are only con-
cerned with not increasing the probability of the worst-case
scenario happening, we ignore that
running some smaller risks can be justified by being traded off
against some larger societal and/
or individual benefits.
Hence, for these two reasons, we need to add a comparative
element to the maxi-
min position:

21. 6. Comparative maximin utilitarian position. We are justified in
relaxing precautionary measures if (and
only if) it has a lower probability of the worst-case scenario
happening than the alternative options.
JOURNAL OF RISK RESEARCH 265
The comparative maximin position allows us to choose between
alternatives that have differ-
ent, yet insignificant, probabilities of the worst-case scenario
happening. On this position, we
should choose the alternative that has the lowest probability of
leading to the worst-case scen-
ario. A major problem with this position, however, is that it will
remain indeterminate between
alternatives that have an equally low probability of leading to a
worst-case scenario, yet might
differ in terms of overall output or equality of distribution. In
the first case, as in the example
above, both relaxing and strengthening precautionary measures
might carry the same risk of the
worst-case scenario happening, such as an Ebola outbreak, yet
be expected to lead to an
increase in overall utility output. (Recall, retaining the current
measures had a utility output of
five units, while relaxing and strengthening the precautionary
measures both had an expected
utility output of seven units.) In the second case, as in the
example above, we can imagine that
both retaining and strengthening the current precautionary
measures carry the same risk of an
outbreak happening while yielding the same expected utility
output (say, five units), yet distrib-

22. ute this utility output in different ways. For example, while
retaining the precautionary measures
would distribute the utility output equally between stakeholders,
the option of strengthening
the measures would lead to an unequal distribution between
stakeholders.
In neither case, does the comparative maximin position provide
any guidance on how to
choose between these different alternatives. Hence, as with the
expected utility position, we
need to insert a couple of clauses, namely a leveling-down
prohibition (in order to decide in the
first case between alternatives with different overall utility
output) and an equality-weighting (in
order to decide in the second case between alternatives with
different distributions of util-
ity output).
7. Equality-weighted comparative maximin utilitarian position,
with levelling-down prohibition. We
are justified in relaxing precautionary measures if (and only if)
it (a) does not lead to an increase in the
probability of the worst-case scenario happening, (b) has a
lower probability of the worst-case scenario
happening than the alternative options, (c) has a greater
probability of an equal distribution between affected
stakeholders, and (d) does not lead to a decrease in overall
utility output.
Although this seems like a sensitive approach, in practice there
will often be contention
between clause (a), on the one hand, and clauses (c) or (d), on
the other. That is, taking worst-
case scenarios into consideration will often involve violating a
commitment to equality (c) or

23. overall utility (d). In the first case, current precautionary
measures within infectious disease con-
trol illustrate how we might prefer an unequal distribution of
utility by imposing quarantines,
isolation, mandatory tests, and mandatory eradication
treatments on potentially infected individ-
uals for the benefit of the greater public health. In the second
case, imposing strict hygiene
requirements for both healthcare personnel and patients might
lower the overall utility output,
yet be justified out of a concern with preventing an outbreak.
While we might prioritize the different clauses, this only leads
us into the same issues as the
other versions of the utilitarian approach. Giving priority to
clauses (c) or (d) leads us into the
same issues as versions 3 (i.e. the leveling-down objection) and
4 (i.e. prohibition of cautious
decision-making). If, however, we give priority to clause (a), it
requires us to be extremely cau-
tious to an almost indefensible degree. As the two cases above
show, a concern for avoiding the
worst-case scenario will often lead to choosing an alternative
with a much lower overall utility
output and/or a more unequal utility distribution. To wit, the
maximin utility position will sacri-
fice any other concern at the altar of protecting against the
worst-case even if the risk of it hap-
pening will be vanishingly small.
Thus, in conclusion, although it is possible to identify five
additional utilitarian positions than
the two rejected by Hansson (2003), neither of these alternative
positions are better suited to
deal with the important task of setting an acceptable risk
threshold.

24. 266 M. F. BYSKOV
4. Addressing two objections
It is possible to raise at least two objections to the arguments
that I have presented in the previ-
ous sections. In the following I address both in turn.
First, it could be argued that the five utilitarian positions that I
identify (and reject) in section
3 are not actually utilitarian positions because they do not
merely evaluate actions based on
their consequences but also according to additional normative
concerns, especially equality and
priority for the worst-off. The commitment to take these
additional normative concerns, this
objection holds, is at odds with the utilitarian commitment to
maximize utility for as many peo-
ple as possible. However, it is important to distinguish between,
on the one hand, the measure
by which we determine the goodness or badness of an action
and, on the other hand, the princi-
ples for the distribution of the units of measurement. In the first
case, we can identify different
measures for the evaluation of actions. An action can be
evaluated in terms of not only the
amount of utility that it produces, but also in term of subjective
well-being (i.e. the pleasure that
individuals derive), the amount of choices that it enables
individuals to choose from, or some
other objective measure of well-being, such as economic
growth. The five approaches discussed
in section 3 are utilitarian because they hold that utility should

25. be used as the ultimate unit of
measurement of whether a risk threshold is acceptable.
That does not mean, however, that additional normative
concerns, such as equality and prior-
ity, cannot or should not be invoked in order to determine how
an acceptable risk threshold
should best distribute these units of measurement among
affected individuals and groups. Mill
(1863), for example, argues that maximization of utility should
work for the greater social good,
while Rawls (2001) holds a position in which the maximization
of utility, measured as happiness
or pleasure, should be weighed against other normative
concerns, such as the protection of cer-
tain rights and freedoms. In this perspective it is perfectly
consistent to hold, for example, the
position that utility should be maximized as long as it is equally
distributed among stakeholders
or as long as the distribution prioritizes the worst-off as long as
this leads to a greater social
good or protection of individual rights and freedoms.
Second, it could be argued that, while none of the utilitarian
positions are ideally suited to
deal with the issue of risk, it may be that one or more are better
suited for this purpose than
others. If this is true, it does not necessarily invalidate
utilitarian approaches to setting accept-
able risk thresholds. As indicated, adding additional clauses,
such as equality-weighing and level-
ing-down prohibition, can ameliorate some of the more
egregious problems with simple utility
maximization positions. We should thus expect these to arrive
at a more justifiable risk threshold
than the more ‘traditional’ utilitarian approaches that were

26. rejected in section 2 (i.e. the actualist
and the expected utility positions).
The main issue with the alternative utilitarian positions
discussed in section 3, however, is not
whether or not they are better suited to deal with risk than the
‘traditional’ utilitarian positions,
but whether they are suitable to make any decisions on risk at
all when faced with competing
normative concerns without abandoning the commitment to
evaluate risk decisions in terms of
utility. That is, although utilitarians might theoretically hold
that an acceptable risk threshold
should lead to a (roughly) equal distribution of utility, not make
the worst-off worse off, or not
be overly risky/cautious, as argued in response to the first
objection, in practice taking such con-
cerns into consideration will often lead to a much lower utility
outcome. This leads utilitarians
into a dilemma: on the one hand, they can reassert the priority
of utility, which leads to the
problem of aggregation or, on the other hand, they can trade
utility off with one or more of the
other concerns, which leads to a problem of incommensurability
and incomparability (Chang
1997) because utilitarians have no way of assigning priority to
non-utility concerns without aban-
doning a commitment to evaluating decisions on risk in terms of
utility.
JOURNAL OF RISK RESEARCH 267
5. Taking the agenda on ethics and risk forward

27. What are the broader consequences of the arguments that I have
presented in this paper? How
should we proceed if utilitarian approaches are unsuitable to
normatively ground acceptable risk
thresholds? In this section I briefly reflect on the consequences
for risk decision-making and the
questions that ethicists of risk should investigate.
Decision-making on risk has often followed cost-benefit
analyses of benefits and disadvan-
tages of running certain risks. As MacIntyre (1992, 180–181)
argues, however, the ethical frame-
work for cost-benefit analysis is provided by utilitarianism and,
accordingly, the main
consequence of my rejection of utilitarianism as an ethical
framework for setting acceptable risk
thresholds thus seems to be that cost-benefit analysis is
undermined as a decision-making tool
for risk. That does not mean, though, that we cannot and should
not weigh and trade off differ-
ent kinds of considerations against each other. In this paper, I
have repeatedly alluded to at least
four such normatively relevant considerations, namely equality,
the priority for the worst-off, and
the need to avoid both extremely cautious and extremely risky
decisions.
This raises at least three questions that ethicists working on risk
could address in future
research. First, what other ethical frameworks for risk are there
and are they better suited to deal
with the complex issues posed by risk than utilitarianism? The
problem is that Hansson (2003,
2013) has similar objections to the two other prominent ethical
approaches, namely deontology
and contractualism. While deontology is the idea that human

28. beings have some rights that can
never be violated by imposing certain risks on them,
contractualism is the ethical position that
an action is acceptable or justified if it can be subject to a
consensus among all affected parties
or, somewhat weaker, if none of the affected parties can
reasonably object to it (Scanlon 1998).
Several authors have argued that contractualism may be the
more suitable ethical position when
dealing with risk (Frick 2015; John 2014; Lenman 2008; Millar
2013). I do not here have space to
discuss the merits of these frameworks nor of Hansson’s
objections. There is relatively little litera-
ture that engages with alternative ethical approaches to risk and
it should thus be subject to fur-
ther research – including, as I have done in the case of
utilitarianism in this paper, the question
of whether and the extent to which there are alternative versions
of deontology and contractual-
ism that can avoid Hansson’s objections.
Another question that risk ethicists need to ask is how these
normative concerns that are rele-
vant for risk evaluations, how they should be assigned value,
and how they should be weighed
and traded off against each other. As argued in section 1, a
major challenge to setting accept-
able risk thresholds concerns how to make trade-offs between
different societal and individual
losses. While this task has often been solved through cost-
benefit analysis, the main problem
with this approach is that it is often unclear what the losses are
and how much weight they
should be given. Consider, for example, how the construction of
floodgates might pull funding
and resources away from the protection of other important

29. societal values, such as education,
healthcare, and security. Risk ethicists ought to set out clear-cut
principles for assigning weight
and value to these different options and for how to trade them
off against each other, for
example by investigating the ethical potential and challenges of
the psychometric approach to
risk assessment (Slovic 1987, 2000). The psychometric
approach aims to capture people’s percep-
tions about risk by tracking people’s expressed preferences to
‘reveal patterns of “acceptable”
risk trade-offs’ (Slovic 2000, xxii) and to identify other aspects
of risk, such as benefits of running
certain kinds of risk and other characteristics that plays into
one’s perception of risk, including
‘dread, familiarity, control, catastrophic potential, equity, and
level of knowledge’ (Slovic
2000, xxiv).
The third research question that risk ethicists could ask is what
ideal and non-ideal commit-
ments can play in risk research. Risk research is inevitably a
non-ideal endeavor: risks arise from
non-ideal circumstances, such as the presence of natural hazards
or a lack resources to build
resilience, and thus often lack the possibility of ideal outcomes
– there will almost always be
268 M. F. BYSKOV
some kind of loss involved when addressing risk. Risk ethicists
should ask what role ideal and
non-ideal theory play in risk research: To what extent to should
decision-making take into

30. account non-ideal circumstances? Should theories of risk aim to
set out ideal normative princi-
ples for dealing with risk, even if they are not feasible in
practice? To what extent can it be justi-
fied to set out less-than-optimal risk thresholds? These are all
questions that are important for
how ethical analysis can shape decision-making on risk and
which might circumvent the need
for ideal normative theory.5
In sum, the shortcomings of traditional ethical theories when
dealing with risk presents a
challenge for risk researchers to find normative grounding for
risk theories and practices. I have
here sketched out a few lines of inquiry that researchers on
ethics and risk may follow in order
to address these issues and challenges.
6. Concluding remarks
In this paper I have discussed utilitarianism as a normative
theory for setting acceptable risk
thresholds. Minimizing exposure to risk often involves
incurring some societal and individual
costs. Utilitarians hold that incurring these costs are justified if
(and only if) it increases the prob-
ability of an increase in the utility output. While Hansson has
argued that this makes utilitarian-
ism poor at dealing with risk because it would endorse
sacrificing some individuals for the
benefit of society at large, in this paper I have argued that
Hansson’s conclusion is premature
and that it is possible to identify five additional utilitarian
positions that avoid this problem of
aggregation. I concluded that none of these alternatives,
however, are better at dealing with the

31. task of setting an acceptable risk threshold. I finally considered
three questions that should be
addressed in future research on ethics and risk.
Notes
1. For this paper, I assume that all relevant risks can be
identified and that their expectation values – that is,
how probable they are to occur and how severe their outcome
will be – can be known. This is of course not
the case the case in practice where individuals and policy-
makers will often have to make decisions under
uncertain circumstances. For a discussion of decision-making
under uncertainty, see Baron (2017), Fischoff
et al. (2006), Hansson (2013, 2014, 2017), Loriaux (2017),
Shrader-Frechette (2017), Welch (2017), Zinn (2009),
and _Zuradzki (2017).
2. Classical utilitarians include especially Bentham (1972), J. S.
Mill (1863), Sidgwick (1907), and G. E. Moore
(2004). Within contemporary philosophy, utilitarianism has
especially been defended by Goodin (1995), Hare
(1981), Harsanyi (1977), and Singer (2000, 2011). For a broader
discussion of the benefits and disadvantages
of utilitarianism, see especially Smart and Williams (1973), and
Sen and Williams (1982). For an excellent
introduction to utilitarianism, see Mulgan (2014).
3. For a discussion of the utilitarian basis of risk assessment,
see Guehlstorf (2012, chapter 3) and
Thompson (1990).
4. See additionally Moore (1966, chapter 5, 18–21) who
provides a more general rejection of the expected utility
position. Moore (1966, 21; emphases in original) argues that
“there is no conclusive reason against the view

32. that [… ] the question whether an action is right or wrong
always depends on its actual consequences” since
moral blame can only be assigned when the actual consequences
are known, even if we have to make
decisions based on probable or expected consequences.
5. For a discussion of ideal and non-ideal theories, see Lawford-
Smith (2010), Robeyns (2008), Simmons (2010),
Stemplowska (2008), and Valentini (2011, 2012).
Acknowledgments
I am grateful to Marcel Verweij and two anonymous reviewers
for their comments and suggestions on previous
versions of this paper. Work on this paper was partially made
possible by a Caroline Miles Visiting Fellowship to
the Ethox Centre of the University of Oxford in October 2017.
JOURNAL OF RISK RESEARCH 269
References
Baron, Jonathan. 2017. “Uncertainty and Probability within
Utilitarian Theory.” Diametros 53: 6–25.
Bentham, Jeremy. 1972. An Introduction to the Principles of
Morals and Legislation. Oxford: Oxford University Press.
Chang, Ruth. 1997. Incommensurability, Incomparability, and
Practical Reason. Cambridge, MA: Harvard University Press.
Cranor, Carl F. 1997. “The Normative Nature of Risk
Assessment: Features and Possibilities.” Risk 8: 123.
Darwall, Stephen L. 2003. Consequentialism. Oxford: Blackwell
Publishing.
Fischhoff, Baruch, W€andi Bruine de Bruin, €Umit G€uvenç,
Denise Caruso, and Larry Brilliant. 2006. “Analyzing Disaster

33. Risks and Plans: An Avian Flu Example.” Journal of Risk and
Uncertainty 33 (1–2): 131.
Frick, Johann. 2015. “Contractualism and Social Risk.”
Philosophy & Public Affairs 43 (3): 175–223.
Goodin, Robert E. 1995. Utilitarianism as a Public Philosophy.
Cambridge, UK: Cambridge University Press.
Gosepath, Stefan. 2011. “Equality.” In The Stanford
Encyclopedia of Philosophy, edited by Edward N. Zalta, Spring
2011.
Metaphysics Research Lab, Stanford University.
https://plato.stanford.edu/archives/spr2011/entries/equality/.
Guehlstorf, Nicholas P. 2012. The Political Theories of Risk
Analysis. Dordrecht: Springer Science & Business Media.
Hansson, Sven Ove. 2003. “Ethical Criteria of Risk
Acceptance.” Erkenntnis 59 (3): 291–309.
Hansson, Sven Ove. 2013. The Ethics of Risk: Ethical Analysis
in an Uncertain World. Springer.
Hansson, Sven Ove. 2014. “Risk.” In The Stanford
Encyclopedia of Philosophy, edited by Edward N. Zalta, Spring
2014.
Metaphysics Research Lab, Stanford University.
https://plato.stanford.edu/archives/spr2014/entries/risk/.
Hansson, Sven Ove. 2017. “Uncertainty and Control.”
Diametros 53: 50–59.
Hare, Richard M. 1981. Moral Thinking: Its Method, Levels,
and Point. Oxford: Clarendon Press.
Harsanyi, John C. 1977. “Morality and the Theory of Rational
Behavior.” Social Research, 623–656.
John, S. D. 2014. “Risk, Contractualism, and Rose’s
‘Prevention Paradox.’” Social Theory and Practice 40 (1): 28–
50.
Lawford-Smith, Holly. 2010. “Ideal Theory—A Reply to
Valentini.” Journal of Political Philosophy 18 (3): 357–368.

34. Lenman, James. 2008. “Contractualism and Risk Imposition.”
Politics, Philosophy & Economics 7: 99–122.
Loriaux, Sylvie. 2017. “Global Duties in the Face of
Uncertainty.” Diametros 53: 75–95.
MacIntyre, Alasdair. 1992. “Utilitarianism and Cost-Benefit
Analysis: An Essay on the Relevance of Moral Philosophy
to Bureaucratic Theory.” In The Moral Dimensions of Public
Policy Choice: Beyond the Market Paradigm, edited
by John Martin Gilroy and Maurice Wade, 179–194. Pittsburgh,
PA: University of Pittsburgh Press.
Mill, John Stuart. 1863. Utilitarianism. London: Parker, Son and
Bourn.
Millar, Michael. 2013. “‘Zero Tolerance’ of Avoidable Infection
in the English National Health Service: Avoiding the
Redistribution of Burdens.” Public Health Ethics 6 (1): 50–59.
Moore, G. E. 1966. Ethics. Oxford: Oxford University Press.
Moore, G. E. 2004. Principa Ethica. Mineola, NY: Dover
Publications.
Mulgan, Tim. 2014. Understanding Utilitarianism. London and
New York: Routledge.
Nozick, Robert. 1974. Anarchy, State, and Utopia. Oxford:
Blackwell Publishing.
Rawls, John. 2001. Justice as Fairness. A Restatement.
Cambridge, MA: The Belknap Press.
Raz, Joseph. 1986. The Morality of Freedom. Oxford:
Clarendon Press.
Robeyns, Ingrid. 2008. “Ideal Theory in Theory and Practice.”
Social Theory and Practice 34 (3): 341–62.
Scanlon, T. M. 1998. What We Owe To Each Other. Cambridge,
MA: The Belknapp Press.
Scheffler, Samuel, ed. 1988. Consequentialism and Its Critics.
Oxford: Oxford University Press.
Sen, Amartya, and Bernard Williams. 1982. Utilitarianism and

35. Beyond. Cambridge, UK: Cambridge University Press.
Shrader-Frechette, Kristin. 2017. “Mischaracterizing
Uncertainty in Environmental-Health Sciences.” Diametros 53:
96–124.
Sidgwick, Henry. 1907. The Methods of Ethics. Hackett
Publishing.
Simmons, A. John. 2010. “Ideal and Nonideal Theory.”
Philosophy & Public Affairs 38 (1): 5–36.
Singer, Peter. 2000. Writings on an Ethical Life. Harper
Collins.
Singer, Peter. 2011. Practical Ethics. Cambridge University
Press.
Slovic, Paul. 1987. “Perception of Risk.” Science 236 (4799):
280–85.
Slovic, Paul., ed. 2000. The Perception of Risk. Earthscan.
Smart, John Jamieson Carswell, and Bernard Williams. 1973.
Utilitarianism: For and Against. Cambridge University Press.
Stemplowska, Zofia. 2008. “What’s Ideal About Ideal Theory?”
Social Theory and Practice 34 (3): 319–40.
Temkin, Larry S. 1993. Inequality. Oxford University Press.
Thompson, Paul B. 1990. “Biotechnology, Risk and Political
Values: Philosophical Rhetoric and the Structure of
Political Debate.” Biotechnology: Assessing Social Impacts and
Policy Implications 260: 3.
Valentini, Laura. 2011. “A Paradigm Shift in Theorizing about
Justice? A Critique of Sen.” Economics and Philosophy
27 (3): 297–315.
Valentini, Laura. 2012. “Ideal vs. Non-Ideal Theory: A
Conceptual Map.” Philosophy Compass 7 (9): 654–64.
Welch, John R. 2017. “Coping with Ethical Uncertainty.”
Diametros 53: 150–66.
Zinn, Jens O. 2009. Social Theories of Risk and Uncertainty:
An Introduction. John Wiley & Sons.

36. _Zuradzki, Tomasz. 2017. “Ethics and Uncertainty: The Guest
Editor’s Introduction.” Diametros 53: 1–5.
270 M. F. BYSKOV
https://plato.stanford.edu/archives/spr2011/entries/equality/
https://plato.stanford.edu/archives/spr2014/entries/risk/
Copyright of Journal of Risk Research is the property of
Routledge and its content may not be
copied or emailed to multiple sites or posted to a listserv
without the copyright holder's
express written permission. However, users may print,
download, or email articles for
individual use.
AbstractAcceptable riskUtilitarianism and riskFive alternative
utilitarian approaches to riskAddressing two objectionsTaking
the agenda on ethics and risk forwardConcluding
remarksAcknowledgmentsReferences
Assignment : answer real world case 8.1 and 8.2 questions; at
least one
Page per case ; cite textbook
Please see chapter readings from textbook below
Real-World Case 8.1
In October 2018, Cook County (Illinois) commissioners voted to
approve a nearly $4 million settlement of a medical malpractice
lawsuit at Stroger Hospital, a healthcare organization that is
part of the Cook County Health and Hospital Systems (CCHHS).
The lawsuit stemmed from a 2013 bedside pericardiocentesis
that, plaintiff’s attorneys argued, should have been performed in
a cardiac catheterization lab. Despite the large settlement,
CCHHS CEO noted that the settlement was -neither an
admission of malpractice or of wrongdoing by the providers or

37. the health system. -Although it is not known how much a jury
would have awarded the plaintiff, a jury verdict would have
been a declaration of malpractice, which was avoided through
the settlement (Pratt 2018).
1. This case highlights the fact that healthcare
professionals, in addition to physicians, are subject to
professional malpractice liability. Why do you think physicians
are most frequently linked with the term “medical malpractice?”
2. Of the three types of negligence, which type do you
think most closely describes a healthcare professional who
acted too aggressively?
3. Why it is likely that a much larger award would have
been rendered at trial than through settlement?
Real-World Case 8.2
Healthcare organizations develop record retention guidelines in
accordance with applicable laws (for example, a state’s statute
of limitations for medical malpractice and Medicare Conditions
of Participation retention requirements) and operation needs
(for example, research, education, and strategic planning). If a
healthcare organization follows its guidelines, and those

38. guidelines conform to applicable laws, the healthcare
organization is legally compliant. There is generally not a
requirement that patients be notified of a healthcare
organization’s health record retention periods. This, however,
has not been the case in California, which has had a notification
requirement in place for several years. Additionally, Senate Bill
1238 was presented in the California Senate in 2018 to amend
Section 123106(e) and 123107 of the California Health and
Safety Code, to require healthcare providers, by the date that
service is first delivered or as soon possible after emergency
care, to inform the patient or patient’s representative of the
intended retention period for the patient’s health records
(California Senate Bill 1238 2018). Providers are also required
to notify the patient at least 60 days before the record is to be
destroyed.
1. What is your opinion of California’s requirement that
patients be notified of an organization’s record retention
periods? Do you think patients should be notified, although this
has not been industry practice? Why or why not?
2. What is your opinion of Senate Bill 1238, presented to
the California Senate in 2018, which requires this notification
(of the intended record retention period) to occur by the date of
first service delivery?
3. A patient requested a copy of their health record and
learned that it had been destroyed. The patient complains to the
state health department because they were not notified that their
record would be destroyed. What response would you expect
from the state health department?
4. Do you believe healthcare organizations should destroy
health records? Justify your choice.

39. HITT 1301 CHAPTER 8
Health Information Management Technology,
An Applied Approach
Nanette Sayles, Leslie Gordon
Copyright ©2020 by the American Health Information
Management Association. All rights reserved.
Except as permitted under the Copyright Act of 1976, no part of
this publication may be reproduced,
stored in a retrieval system, or transmitted, in any form or by
any means, electronic, photocopying,
recording, or otherwise, without the prior written permission of
AHIMA, 233 North Michigan Avenue,
21st Floor, Chicago, Illinois 60601-5809
(http://www.ahima.org/reprint).
ISBN: 978-1-58426-720-1
AHIMA Product No.: AB103118
The most important purpose of the health -record is to document
patient treatment and provide a means for a patient’s healthcare
providers to communicate among each other. However, the
health record also plays an important role as a legal document.
It provides critical evidence in the legal process, including
medical malpractice and other personal injury lawsuits, criminal
cases, healthcare fraud and abuse investigations and actions,
and quasi-judicial proceedings such as workers’ compensation
determinations.
This chapter discusses legal issues associated with health
information and includes an overview of basic legal concepts
such as types and sources of law and the court system; legal

40. process and causes of -action that form the basis of professional
liability; patient healthcare decision making; health record
creation and maintenance; ownership and control of the health
record; content and retention of the legal health record
including content, retention, and destruction; medical staff
credentialing; licensure and certification of healthcare
professionals; and licensure, certification, and accreditation of
healthcare organizations.
Basic Legal Concepts
There are many federal and state statutes and regulations that
provide a protective framework around the health record and
form its content. The most well-known laws are the federal
Privacy Rule of the Health Insurance Portability and
Accountability Act (HIPAA) and the American Recovery and
Reinvestment Act (ARRA), which are discussed in chapter 9,
Data Privacy and Confidentiality. However, those are only two
of the laws with which the health information management
(HIM) professional must be familiar.
In addition to federal and state laws, healthcare organizations
may be subject to the standards of accrediting bodies such as
the Joint Commission or the Healthcare Facilities Accreditation
Program (HFAP), which also contain requirements related to the
protection and content of health records.
Types and Sources of Laws
Laws are classified as public or private. Public law involves the
government at any level and its relationship with individuals
and organizations. Its purpose is to define, regulate, and enforce
rights where any part of a government agency is a party
(Showalter 2017). The most familiar type of public law is
criminal law, where the government is a party against an
accused who has been charged with violating a criminal statute.
In healthcare, the Medicare Conditions of Participation (COP)—
the requirements set forth for healthcare providers who accept
Medicare patients—are public law. Public law includes both

41. criminal and civil law (non-criminal law).
Private law involves rights and duties among private entities or
individuals. For example, private law applies when a contract
for the purchase of a house is written between two parties.
Normally, private law encompasses issues related to contracts,
property, and torts (injuries). In the medical arena, it often
applies when there is a breach of contract or when a tort occurs
in malpractice. Private law is also civil law. Table 8.1 depicts
the relationship of public and private law to civil and criminal
law.
Table 8.1 Relationship of public and private law to civil and
criminal law
Civil Law Criminal Law
Public Law X X
Private Law X
Source: Rinehart-Thompson 2017a.
There are four sources of public and private law: constitutions,
statutes, administrative law, and judicial decisions, also known
as common law or case law.
Constitutions
Constitutional law defines the amount and types of power and
authority governments are given. The US Constitution defines
and sets forth the powers of the three branches of the federal
government. The legislative branch, which is the US Congress
and is comprised of the House of Representatives and the
Senate, creates statutory law (statutes). Examples of statutory
law include Medicare and HIPAA. The executive branch (the
president and staff, namely cabinet-level agencies) enforces the
law. For example, the Centers for Medicare and Medicaid
Services (CMS), an agency within the cabinet-level Department

42. of Health and Human Services (HHS), enforces the Medicare
laws. The judicial branch (the court system) interprets laws
passed by the legislative branch. This three-branch government
structure is also found in state governments. Each state’s
constitution is the supreme law of that state, but it is
subordinate to the US Constitution, the supreme law of the
-nation (Rinehart-Thompson 2017a). Figure 8.1 -illustrates each
branch of the US government.
Figure 8.1. Branches of the US government
Source: ©AHIMA
Statutes
Statutes (which form statutory law) are enacted by legislative
bodies. The US Congress and state legislatures are legislative
bodies. Local bodies, such as municipalities, can also enact
statutes, sometimes referred to as ordinances (Rinehart-
Thompson 2017a).
Administrative Law
Administrative law is a type of public law. As previously noted,
the executive branch of government is responsible for enforcing
laws enacted by the legislative branch. Administrative agencies,
which are part of the executive branch, develop and enforce
rules and regulations that carry out the intent of statutes. For
example, HHS developed rules and regulations to carry out the
intent of the HIPAA statute, and it has the power to enforce
them. These rules and regulations are administrative law.
Another example is the federal Food and Drug Administration
(FDA), an agency within HHS, which has the power to develop
rules that control the manufacture of drugs. The legislative
branch of the federal government has given a number of
administrative agencies the power to establish regulations
(Rinehart-Thompson 2017a).
Judicial Decisions
The fourth major source of law is judicial law (that is, common

43. law or case law), which is law created from court (judicial)
decisions. Courts interpret statutes, regulations, and
constitutions, and resolve individual conflicts. Judicial
decisions are the primary source of private law (Showalter
2017).
The traditional method of resolving legal disputes is through the
court systems. In the US, one court system exists at the federal
level. The 50 states, the US territories, and the District of
-Columbia have their own court systems. Although the court
system is the most familiar method for resolving legal disputes,
there is growing reliance on alternative dispute resolution to
lighten court dockets and provide less costly and time-
consuming alternatives for parties to settle their differences.
Alternative dispute resolution includes arbitration (parties agree
to submit a dispute to a third party to decide) and mediation
(parties agree to submit a dispute to a third-party facilitator,
who assists the parties in reaching an agreed-upon -resolution).
The US court system consists of state and federal courts. Both
federal and state court systems have a three-tier structure: trial
courts (called district courts in the federal system); courts of
appeal or appellate courts (called circuit courts in the federal
system) that hear appeals on final judgments of the trial courts;
and supreme courts, the highest courts in a court system that
hear final appeals from intermediate courts of appeal. Appeals
are designed nearly exclusively to address legal errors or
problems alleged to have occurred at the lower court, but they
are not meant to address the facts of the case again. Table 8.2
compares the nomenclatures of state and federal court systems.
In many states, trial courts are divided into courts of limited
jurisdiction which hear cases pertaining to a particular subject
(for example, landlord and tenant or juvenile) or involve crimes
of lesser severity or civil matters of lower dollar amounts.
Courts of general jurisdiction hear more serious -criminal cases
or civil cases involving larger sums of money. Cases presented
to courts of appeal or supreme courts are not trial reenactments.
Legal documents are prepared by each party’s attorney(s), who

44. -argue the merits of the case -before a panel of -appellate
judges.
Table 8.2 Comparison of state and federal court systems
State* Federal
State Supreme Court US Supreme Court
Court of Appeals Circuit Court
Trial Court (for example, Common Pleas Court) District
Court
*Terminology may vary from state to state.
Source: Rinehart-Thompson 2017a.
Legal Process
This section describes a legal action from the time a lawsuit is
filed, through the phase in which information is collected by
those involved in the lawsuit, to trial and resolution.
Initiation of Lawsuit
In order to prepare for a judicial decision as the ultimate
outcome of a legal proceeding (litigation), a plaintiff initiates a
lawsuit against a defendant by filing a complaint in court, which
outlines the defendant’s alleged wrongdoing. After it is filed, a
copy of the complaint is served to the defendant along with a
summons. The summons and complaint give the defendant
notice of the lawsuit and to what it pertains and informs the
defendant that the complaint must be answered or some other
action taken. If the defendant fails to answer the complaint or
take other action, the court grants the plaintiff a judgment by
default.
Usually, the defendant answers the complaint in one of four
ways: denying, admitting, pleading ignorance to the allegations,
or bringing a countersuit (counterclaim) against the plaintiff by
filing a complaint. A defendant may file a complaint (joinder)
against a third party or against another defendant (cross-claim).
The defendant can ask the court to dismiss the plaintiff’s
complaint, but not without substantial reason such as lack of

45. -evidence.
Discovery
The next stage of litigation is discovery, a pretrial process and a
time period in which parties to a lawsuit use various strategies
to discover or -obtain information about a case, held by other
parties, prior to trial. Discovery is encouraged in order to
determine the strengths and weaknesses of the other parties’
cases. This knowledge helps avoid surprises at trial and perhaps
encourages pretrial settlement (Rinehart-Thompson 2017b).
Thus, evidentiary rules and court decisions addressing
discovery are broad, favoring discovery when it is in doubt.
There are several types of discovery methods, but most likely to
be encountered are the deposition, which obtains the parties’
and other witnesses’ out-of-court testimony under oath;
interrogatories, which are written questions to the parties in
order to obtain information; and requests for production of
documents or other pertinent items (Rinehart-Thompson 2017b).
Although it is not a discovery method, an important discovery
tool is the subpoena. Initiated on behalf of one of the parties
and issued through the court, it is a legal document that
facilitates discovery by instructing someone to do something
(such as compelling attendance at a deposition or court
proceeding) or bring something, such as a document. There are
two types of subpoenas: the subpoena ad testificandum seeks
one’s testimony and the subpoena duces tecum seeks documents
and other records one can bring with him or her (Rinehart-
Thompson 2017b). Subpoenas may direct that originals or
copies of health records, laboratory reports, x-rays, or other
records be brought to a deposition or to court. In most
instances, a subpoena for the disclosure of an individual’s
health information must be accompanied by an authorization, or
permission from that individual for the information to be
disclosed. HIM professionals can be subpoenaed to testify as to
the authenticity of the health records by confirming the records
were compiled in the usual course of business and have not been
altered in any way. Because the attorney who subpoenas a HIM

46. professional is most interested in the health record, the
information is likely to be compelled via subpoena duces tecum.
Another type of discovery tool is the court order. A court order
is a document issued by a judge. At times, a court order will be
issued to compel the production of health records. If the
recipient does not comply with the court order, he or she risks
contempt-of-court (namely, failure to comply) sanctions,
possibly including jail time. Although both are issued through
the court, any legal document that requests a patient’s health
information must be reviewed carefully to determine whether it
is a court order or subpoena. This is because, as noted
previously, a subpoena often requires an individual’s
authorization if health information is being sought (Rinehart-
Thompson 2017b).
If health records are relevant to a criminal case, they may be
obtained via a warrant. A specialized type of court order, a
warrant, is a judge’s order that authorizes law enforcement to
seize evidence and, often, to conduct a search as well. Criminal
cases in which health records are most likely to be obtained via
warrant involve healthcare fraud and abuse investigations
(Rinehart-Thompson 2017b).
E-Discovery
The concept of discovery as defined earlier seems relatively
straightforward with paper health records. However, it is vastly
different with -electronic health records. E-discovery maintains
the same pretrial process as discovery, but parties now obtain
and review electronically stored data. The Federal Rules of
Civil Procedure (FRCP) incorporated electronic information
through the creation of e-discovery rules. The FRCP applies
only to cases in federal district courts, but many states have
adopted similar e-discovery rules that apply to both civil and
criminal cases. While the role of the HIM professional in paper-
based discovery was often limited to responding to a subpoena
for health records or testifying as to a health record’s
authenticity, involvement begins much earlier with e-discovery.
For example, attorneys for the parties in a lawsuit must agree on

47. matters such as document discovery. Early interaction among a
healthcare organization’s health information professionals,
information technology (IT) professionals, and legal counsel is
very important. Electronic health records (EHRs) allow massive
volumes of information to be created and stored, subjecting
much greater amounts of information to discovery than paper
health records. Not all information is discoverable. For
example, an incident report is generally not discoverable. An
incident report is a quality or performance management tool
used to collect data and information about potentially
compensable events (events that may result in death or serious
injury). Whether it is discoverable or not depends on legal
protections (such as a state statute that specifically protects
quality assurance records) or the lack thereof. Any
electronically stored evidence may potentially be compelled as
evidence. Discoverable data includes not only the EHR, but also
emails, texts, voicemails that may exist on smartphones, drafts
of documents, and information on flash drives. Other
information that must be considered as potentially discoverable
includes information housed on ancillary systems and other
databases throughout a healthcare organization because they
may be relevant to a particular case. Discoverable data also
include metadata, which are data about data, a concept that was
unheard of in paper documents. Metadata includes information
that tracks actions such as who accessed or attempted to access
a document or an information system, when this -occurred,
which parts of the document or information system were
affected, and what operations or changes (for example, creating,
viewing, printing, editing) took place (Rinehart-Thompson
2018). Because the e-discovery rule affects retention and
destruction of health information, HIM professionals must be
involved in those ongoing processes. To protect discoverable
data, they must also ensure records involved in litigation or
potential litigation are safeguarded through a legal hold, which
is generally a court order to preserve a health record if there is
concern about destruction. A legal hold supersedes routine

48. destruction procedures. It also prevents spoliation—the act of
destroy-ing, changing, or hiding evidence intentionally (Klaver
2017a).
Trial
After discovery is complete, the trial begins. A jury is selected
through a process called voir dire or, if a jury is waived, a judge
hears the case (bench trial). Evidence is then presented. The
plaintiff’s attorney is the first to call witnesses and present
evidence. In turn, the defendant’s attorney calls witnesses and
presents evidence. Typically, in both health-related and non–
health-related cases that involve health records as evidence, the
record custodian is called as a witness by one party or the other
to testify as to the authenticity of a health record sought as
evidence. Testifying as to a health record’s authenticity means
the records custodian is verifying that it contains information
about the individual in question, was compiled in the usual
course of business, and is reliable and truthful as evidence.
Because individuals who document in a health record do not
typically falsify their entries, the truthfulness of a health record
is generally not questioned. Parties to litigation often agree
(stipulate) as to a health record’s authenticity and allow it to be
entered into evidence without requiring the records custodian to
appear in court and testify. The parties may also agree to allow
a photocopy of the health record or a printed version of the
EHR to be introduced into evidence rather than the original.
This generally requires the records custodian to certify in
writing that the copy is an exact duplicate of the original. State
laws vary on the degree to which courts will consider EHR
printouts as evidence.
Many times, a case is settled before it reaches trial. This saves
time, money, and emotional hardship on the parties. A
settlement may be reached between or among parties and their
attorneys with or without intervention from a third party.
After the court (either a jury or the judge) has rendered a
verdict, the next stage in litigation is the appeal. If at least one
of the parties disagrees with the verdict and has a legal

49. argument on which to base its disagreement (for example,
evidence was wrongfully considered at trial), a case may be
appealed to the next court for review. The final stage of
noncriminal litigation is collection of the judgment, which is a
monetary award or in equity (that is, the defendant is required
to do, or refrain from doing, something). Examples of collection
of monetary judgments include single payments, garnishment of
wages (by court order), seizure of property, or a lien on
property. Examples of judgments in equity include ordering the
completion of a construction project (requiring the defendant to
do something) or requiring that a construction project be
stopped (requiring the defendant to -refrain from doing
something). The final stage of criminal proceedings is
sentencing, which may -include confinement and monetary
penalties.
Evidence
An individual may be compelled to testify in court. This may
occur after an individual has provided testimony at a deposition,
or it may be the first time an individual testifies in a particular
case. Rules regarding admissibility, or the court allowing
consideration of evidence, are much more stringent than
discovery rules (Rinehart-Thompson 2017b). Thus, much
information can be shared during pretrial discovery that is not
permitted to be admitted as evidence at trial. The Federal Rules
of Evidence (FRE) govern admissibility in the federal court
system. Separate rules of evidence that often mirror the federal
rules govern admissibility in each state.
Generally, only relevant evidence—that which makes a
supposed fact either more or less probable—may be admitted at
trial. However, even -relevant evidence with probative value
(that is, -significant in providing information) may be deemed
nonadmissible if it is outweighed as unfairly prejudicial or if
presenting the evidence would cause undue delay. Evidence may
also be excluded if it is misleading (for example, providing
statistics that do not accurately depict death rates associated
with a particular disease) or redundant (for example, an answer

50. from a witness that an attorney attempts more than once to
belabor a point, such as a patient’s death) (Klaver 2017a).
Hearsay is also often excluded. Hearsay is an out-of-court
statement used to prove the truth of a matter, and it is
inherently deemed untrustworthy because the maker of the
statement was not cross-examined at the time the statement was
made. Hearsay can be admitted into evidence if it meets one of
the hearsay exceptions. The exception most common to the
health record is the business records exception. This exception
exists because business records are deemed inherently
trustworthy and are admissible as long as they are made at or
near the time of the event being recorded, are kept in the regular
courses of business, and the record was created through the
regular practice of business (Klaver 2017a).
Testimony by HIM professionals is often focused on the
authenticity of the health record and refers to the document’s
baseline trustworthiness (Klaver 2017a). HIM professionals
must take care to present a professional decorum when
testifying by dressing professionally, answering questions
honestly and without becoming defensive, and responding to the
questions asked rather than unnecessarily elaborating. If the
questioning attorney poses a question that is outside the scope
of the individual’s expertise as a HIM professional (for
example, eliciting information about a patient’s condition or
reason that medical treatment was provided), the HIM
professional should respectfully decline to answer the question
by stating that it is beyond his or her area of professional
expertise.
Causes of Action in Professional Liability
Professionals in many fields, including healthcare, face
potential liability for allegedly failing to meet the standards
established in their fields of -practice. Medical malpractice is
the professional liability of healthcare providers—physicians,
nurses, therapists, or others involved in the delivery of patient
care. Breach of contract, intentional tort, and negligence are all

51. causes of action, or elements under which lawsuits are brought
that are related to professional liability. To understand how
these causes of action apply, examine the elements of the
physician-patient relationship.
A physician-patient relationship is established by either an
implied contract, also referred to as consent, or an express
contract. Implied contracts are created by the parties’ behaviors
(for example, a patient’s arrival at a physician’s office).
Express contracts are articulated, either in writing or verbally (a
patient’s written or verbal agreement to treatment). A contract
is usually created by the mutual agreement of the parties
involved—in this case, the patient and the physician or another
healthcare provider. Termination of the contract usually occurs
when the patient either gets well or dies, the patient and
physician mutually agree to contract termination, the patient
dismisses the physician, or the physician withdraws from
providing care for the patient.
No medical liability for breach of contract can exist without a
physician-patient relationship. However, when this relationship
does exist, the physician’s failure to diagnose and treat the
patient with reasonable skill and care may cause the patient to
sue the physician for breach of contract.
Healthcare providers also can be held responsible for
professional tort liability when they harm another person. A tort
is a wrongful civil act that results in injury to another. Tort law
is broad and includes non–healthcare-related acts (for example,
a driver runs a red light and strikes another vehicle) and
healthcare-related acts (a nurse administers the wrong
medication). An intentional tort is where an individual
purposely commits a wrongful act that results in injury.
Usually, however, professional liability actions are brought
against healthcare providers because of the tort of negligence,
or unintentional wrongdoing.
Negligence occurs when a healthcare provider does not do what
a prudent person would normally do in similar circumstances.

52. The three types of negligence are the following:
1. Nonfeasance is the failure to act as a prudent person would,
such as not ordering a standard diagnostic test
2. Malfeasance is a wrong or improper act that may be unlawful,
such as removal of the wrong body part or use of a joint
replacement that is known to be problematic (Rinehart-
Thompson 2017c)
3. Misfeasance is the improper performance during an otherwise
correct act, such as nicking the bladder during an otherwise
appropriately performed gallbladder surgery
For a negligence lawsuit to be successful, the plaintiff must
prove the following four elements:
1. The existence of a duty (an obligation established by a
relationship) to meet a standard of care (degree of caution
expected of an ordinary and reasonable person under given
circumstances)
2. Breach or deviation from that duty
3. Causation, the relationship between the defendant’s conduct
and the harm that was suffered
4. Injury (harm) that may be economic (medical expenses and
loss of wages) or noneconomic (pain and suffering)
The causes of actions mentioned are not the only ones that can
be brought against an individual healthcare provider or a
healthcare organization. Other tort actions applicable to
healthcare include battery (intentional and nonconsensual
contact), assault (intentional contact that causes apprehension
of harmful or offensive contact), false imprisonment
(intentional confinement against that person’s will), infliction
of emotional distress (intentional conduct resulting in extreme

53. emotional suffering such as anxiety, sleeplessness, and inability
to perform activities), defamation (false communication that
injures a person’s reputation), invasion of privacy (violation of
a person’s right for his or her person and information to be left
alone), and wrongful disclosure of confidential information by a
person with which an individual has a relationship protected by
law (for example, physician-patient) (Brodnik et al. 2017).
Patient Rights Regarding Healthcare Decisions
It is an established right in the US that individuals generally
have autonomy over their own bodies. Included in this right is
the right of individuals to make their own healthcare decisions
provided they are not legally incompetent (namely, incompetent
by virtue of a mental disability or status as a minor). Consents
play an important role in documenting individuals’ wishes
regarding the healthcare they will receive. Similarly, advance
directives are important in documenting individuals’ end-of-life
decisions.
Consent is one’s agreement to receive medical treatment. It can
be written (preferable because it offers greater proof) or spoken;
further, it can be express (communicated through words) or
implied (communicated through conduct or a mechanism other
than words, such as an unconscious person who is brought to the
emergency department). As a matter of practice, healthcare
organizations obtain a general consent from a patient for routine
treatment and failure to do so can result in a legal action;
generally, for battery, or harmful or offensive contact. When a
treatment or procedure becomes progressively more risky or
invasive, it is important that -informed consent be completed to
ensure the patient has a basic understanding of the diagnosis
and the nature of the treatment or procedure, along with the
risks, benefits, alternatives (including opting out of treatment),
and individuals who will perform the treatment or procedure.
Informed consent is a process and it is the responsibility of the
provider who will be rendering the treatment or performing the
procedure to obtain the patient’s informed consent and answer

54. the patient’s questions such as risks associated with the
treatment or procedure, alternatives, and likely consequences if
the treatment or procedure is not chosen. Failure to obtain
informed consent can result in legal action generally based on
negligence (Klaver 2017b). This informed consent must be
documented in the health record.
Advance Directives
An advance directive is a special type of consent that
communicates an individual’s wishes to be treated—or not—
should the individual become -unable to communicate on his or
her own behalf. Once created, it is important that advance
directives become a part of an individual’s health record.
By creating a durable power of attorney for healthcare decisions
(DPOA-HCD) an individual, while still competent, designates
another person (proxy) to make healthcare decisions consistent
with the individual’s wishes on his or her behalf. Durable means
that the document is in effect when the individual is no longer
competent.
A living will is executed by a competent adult, expressing the
individual’s wishes regarding treatment should the individual
become afflicted with certain conditions (for example, a
persistent vegetative state or a terminal condition) and no
longer be able to communicate on his or her own behalf. Living
wills often address extraordinary lifesaving measures such as
ventilator support and either the continuation or removal of
nutrition and hydration.
A third type of document that always specifies an individual’s
wish not to receive treatment (specifically, cardiopulmonary
resuscitation [CPR]) is the do-not-resuscitate (DNR) order.
Most often used by individuals who are elderly or in chronically
ill health, it directs healthcare providers to refrain from
performing the otherwise standing order of CPR should the
individual experience cardiac or respiratory arrest. Prior to
executing a DNR, the patient and physician should have a
discussion and the patient should sign a consent form for DNR.

55. The physician then writes an order in the patient’s health
record. State law provides the framework for completing DNR
orders and forms. Joint Commission-accredited organizations
are required to implement policies regarding advance directives
and DNR orders (Klaver 2017b).
The lack of advance directives can result in legal battles
regarding the undocumented wishes of individuals who become
legally incompetent. Highly publicized end-of-life cases
regarding individuals and whether they would have wanted
continued life-sustaining measures in light of their vegetative
state include Karen Ann Quinlan (-dispute between family and
custodial facility -regarding respirator support), Nancy Cruzan
(dispute between family and custodial facility regarding
continuation of artificially administered nutrition and
hydration), and Terri Schiavo (dispute between husband and
parents and siblings regarding continuation of artificially
administered nutrition and hydration) (Klaver 2017b). In each
of these cases, the courts eventually determined that lifesaving
measures could be removed. These cases have had significant
legal and ethical implications on how healthcare providers
handle right-to-die situations, prompting more providers to
discuss a patient’s end-of-life decisions and encourage the
creation of advance directives that will state a patient’s wishes
or name a decision-maker for the patient.
Overview of Legal Issues in Health Information Management
For the HIM professional, legal aspects of health records and
health information include the topics addressed in the following
sections:
· Creation and maintenance of health records
· Ownership and control of health records, including use and
disclosure
· The legal health record including content, retention, and
destruction

56. Additionally, the HIM professional may be involved in the
medical staff credentialing process as well as healthcare
organization licensure, certification, and accreditation.
Creation and Maintenance of Health Records
Requirements for creating and maintaining health records are
usually found in state rules and regulations, typically developed
by state administrative agencies responsible for licensing
healthcare organizations. Requirements often specify only that
health records be complete and accurate. However, other
requirements specify categories of information to be kept or
outline the detailed contents of the health record.
In some circumstances, the federal -government stipulates
specific requirements for maintaining health records. For
example, the Medicare Conditions of Participation contain
specific -requirements that must be satisfied by healthcare
organizations that seek reimbursement to treat Medicare or
Medicaid patients.
In addition to state and federal requirements, accrediting bodies
have established standards for maintaining health records.
Specifically, the Joint Commission’s relevant standards are set
forth in the Information Management (IM) and Record of Care,
Treatment, and Services (RC) chapters. Acute care, long-term
care, home health, and behavioral health providers, among
others, must follow these standards if they are to be accredited
by the Joint Commission. Private third-party payers play an
important role in the maintenance and content of health records.
In addition to regulations that specify -requirements for
Medicare and Medicaid providers, private payers often have
specific requirements about content that must be present in the
health record for them to reimburse for treatment. Depending on
the nature of the external entity that imposes requirements on
the healthcare provider, failure to comply with requirements
will likely result in some type of penalty such as loss of
licensure or accreditation, nonpayment of claims, or fines

57. imposed on the healthcare organization. Thus, health
information must be created and maintained appropriately and
in compliance with all applicable requirements.
Finally, in addition to governmental, accrediting body, and
private payer requirements, professional organizations such as
the American Health Information Management Association
(AHIMA) publish best practice information. Best practice states
that health record entries and health records in their entirety
must be complete, accurate, and timely. These characteristics
contribute to high-quality patient care and contribute toward a
legally defensible health record that can protect a healthcare
organization in malpractice litigation. Because health records
are frequently admitted into evidence in medical malpractice
lawsuits, the absence of complete, accurate, and timely
documentation can result in a -verdict against the healthcare
organization.
Healthcare organizations take all previously mentioned external
factors, as well as their unique internal factors, into
consideration when establishing their own requirements
regarding health record format and content. This is done by
incorporating them in organizational policies and -procedures
and medical staff bylaws.
In general, health record form and content should conform to
the guidelines outlined in table 8.3.
Table 8.3 Documentation guidelines
• Policies should be based on applicable standards, including
accreditation, state and local licensure, federal and state
regulations, -reimbursement requirements, and professional
practice standards.
• Content and format of health records should be uniform.
• Entries must be legible, complete, and authenticated by the
-person responsible for providing or evaluating the service
provided.
• Only authorized individuals, as defined by organizational

58. policies and procedures, shall document in the health record.
Further, -authorship of entries should be clearly defined in the
documentation.
• The definition of a legally authenticated entry should be
established, with rules for prompt authentication of every entry
by the author responsible for ordering, providing, or evaluating
the service. Health records must be accurately written, promptly
completed, properly filed and retained, and accessible. The
system must consist of author identification and record
-maintenance that ensures the integrity of the authentication and
protects the security of the entries.
• Entries should be made as soon as possible after the event or
observation is made at the point of care. Entries shall never be
made in advance.
• Entries should include the complete date and time. Narrative
documentation should reflect the actual time the entry was
created.
• The record should reflect facts, using specific language. Avoid
using vague or generalized language.
• For patient safety, policies must address standardized
terminology, definitions, abbreviations, acronyms, symbols, and
dose -designations. Prohibited abbreviations, acronyms,
symbols, and dose designations should be published.
• Policies should specify who is authorized and responsible to
receive and transcribe physician verbal and telephone orders.
• Health record entries must be permanent. Because they are
evidence in a legal action, policies and procedures must be
established to prevent alteration, tampering, and loss.
• Documentation errors should not be obliterated or changed and
should be corrected per procedure. There should be an option
for “­corrected final” in addition to “preliminary” and “final.”
• Policy should address how the patient or patient representative
requests corrections and amendments to the record. The
amendment should -refer to the information questioned and
include date and time. Documentation in question should never
be removed from the record or -obliterated. Per HIPAA, the

59. patient has the right to request an amendment; however, the
organization has discretion whether to grant the request.
• Quantitative and qualitative analyses of documents should be
conducted according to procedure.
• Policies should differentiate whether research records are part
of the legal health record or maintained separately, with the
decision verified with the organization’s institutional review
board.
Source: Fahrenholz 2017.
Ownership and Control of Health Records, Including Use and
Disclosure
HIM professionals must understand the concepts of health
record ownership and control. The health record and its contents
are owned by the healthcare organization that created and
maintains it. As the legal custodian, the healthcare organization
is responsible to ensure its integrity and security. This is true
regardless of whether the health record is paper, imaged, or
electronic. Although patients do own the information in the
health record, ultimate responsibility for the physical health
record still rests with the healthcare organization.
Control of the health record encompasses its use (how health
information is used internally) and disclosure (how health
information is disseminated externally). Related to disclosure is
patient access to one’s own health records. Although health
records and other documents (for example, radiologic images)
that relate to the delivery of patient care are owned by the
healthcare organization, patients and other legitimately
interested third parties have the right to access them. The
federal HIPAA Privacy Rule grants individuals the right to
access their protected health information, with some exceptions
that will be discussed in more detail in chapter 9, Data Privacy
and Confidentiality. As patient portals become more available
and encouraged by providers, this right is becoming a patient
expectation as well.

60. Use and Disclosure Under State and Federal Law
Most states have laws that protect patient confidentiality
(Brodnik 2017). Known as privileged communication statutes,
the laws generally prohibit medical practitioners from
disclosing information during litigation if that information
arises from the parties’ professional relationship and relates to
the patient’s care and treatment. An example is the protection of
information shared by a patient with his or her physician during
an office visit (Showalter 2017). If patients waive their
privilege, the medical provider is no longer prohibited from
making -disclosures.
State law may specifically provide a patient with the right to
access his or her health information. Even if it does not, as
previously noted, HIPAA grants an individual the right to
access his or her health information for as long as it is
maintained, with limited situations where access may be
-denied. The HIM professional should always follow the stricter
law (HIPAA or state). HIPAA also establishes standards by
which others may access an individual’s health information.
Disclosure of health information without -patient authorization
may be required under -specific state statutes. Examples include
reporting vital statistics (for example, births and deaths) and
other public health, safety, or welfare situations. For example,
healthcare providers may be required to provide information to
the appropriate state agency about patients diagnosed with
sexually transmitted and other communicable diseases, injured
by knives or firearms, or exhibiting wounds that suggest some
type of violent criminal activity. The treatment of suspected
victims of child abuse or neglect must also be reported. Because
requirements vary by state, HIM professionals must know the
reporting requirements for the states in which they practice.
Health information has a variety of purposes—from the
provision of direct patient care to use by outside entities such as
insurance and pharmaceutical companies—and those uses and
disclosures must be appropriate. Compliance with legal