After Harm: Governing Adverse-Event Disclosure, Candor, Apology Laws, Patient-Safety Privilege, and Hospital Accountability, a Narrative Review

Consider a family that receives an initial explanation after an unexpected complication but then waits through several weeks of unanswered questions. The hospital may be actively investigating, yet the family experiences silence. A later meeting cannot erase the uncertainty created by an absent contact or an unexplained delay. This illustrative situation shows why disclosure should be governed as an ongoing process rather than a single conversation.

A recent Making Healthcare Safer IV rapid review identified nine eligible primary studies of communication-and-resolution programs. The evidence focused largely on malpractice experience and financial outcomes, with low-strength evidence for reductions in certain liability measures. Evidence about patient and family experience, safety, and other outcomes was limited or absent. Leaders should therefore avoid presenting reduced claims as proof that the entire response has served patients well. [1]

A systematic review of patient and family experiences identified recurring concerns involving timeliness, communication quality, support, organizational arrangements, and continued conversation. A qualitative meta-ethnographic synthesis similarly found differences between patients’ needs and the barriers clinicians experienced. Information, sincere regret, and a credible commitment to improvement mattered, while fear, skills gaps, and organizational culture could obstruct disclosure. [2, 3]

The governing question is whether the hospital can provide a coordinated response that remains useful as facts develop. That requires a defined process, accountable people, and a willingness to learn from what patients and staff describe. It also requires legal distinctions precise enough to support the response without allowing uncertain assumptions about protection to determine everything the organization does.

This narrative review examines 25 peer-reviewed sources, including empirical research, reviews, and conceptual or practice perspectives. Bibliographic records and available full texts were examined through September 8, 2026, with recent evidence prioritized. Some assessments were limited to indexed primary abstracts; detailed implementation claims were restricted accordingly. The review is not systematic, does not pool outcomes, and does not establish that its proposed framework has been validated.

Five additional reference groups identify selected United States primary legal and agency authorities. They cover federal hospital participation requirements, the federal patient-safety framework, HHS guidance on external obligations, one Ohio apology statute, and AHRQ’s CANDOR implementation guidance. Ohio is an example of a particular statutory design, not a proxy for all states. International disclosure studies inform experience and implementation, not the content of United States law.

The legal discussion distinguishes statutory text, agency guidance, and management recommendations. Application depends on jurisdiction, setting, timing, the information involved, and other relevant facts. The eCFR text reviewed was displayed as current through September 3, 2026. A hospital must obtain appropriate jurisdiction-specific professional review before treating this discussion as an operating policy or making decisions about a particular event, communication, or record.

A peer-reviewed perspective on measuring organizational harm responses proposed greater attention to patient and family experience, equity, measurement burden, and confidentiality. This is a measurement agenda rather than evidence that a particular set of indicators improves outcomes. Its value lies in asking whose experience is represented when a program reports success. [4]

Another perspective argued that communication-and-resolution programs can expose difficult truths about systems and professional behavior. The argument depends on leaders’ willingness to respond to what a review reveals; it is not a controlled estimate of program effectiveness. A hospital should be prepared for findings that require resources, changes in practice, or difficult professional conversations. [5]

Define several outcome domains before implementation. Patients may need an understandable account, continuing care, practical help, an opportunity to contribute, and a response to unresolved questions. Staff may need guidance and support. The organization needs reliable learning, appropriate reporting, and a fair route to resolution. Financial and liability measures can be included without allowing them to stand in for these other responsibilities.

Do not make forgiveness or acceptance a performance target. A patient can receive a careful explanation and still disagree, remain distressed, or pursue a claim. Those responses do not by themselves prove that the communication failed. Equally, a patient who stops contacting the hospital may have lost trust or access rather than reached a satisfactory resolution. Ask directly when appropriate, and retain an honest category for unknown experience.

A pilot simulation curriculum for medical students combined disclosure teaching, deliberate practice, and feedback. It reported improvements in several educational outcomes, while not every measured skill outcome improved significantly. The study supports structured preparation as an educational approach, but its small sample does not establish the effect on real patient experiences or litigation. [6]

A cross-sectional study of nurses in South Korea associated ethical competence, organizational silence, and perceptions of disclosure. Its mediation analysis does not establish a causal sequence. It suggests that staff knowledge and the perceived ability to speak openly should be examined together rather than treating reluctance as simply a training deficit. [7]

A narrative review of error recognition discussed educational and organizational barriers to disclosure. A separate cross-sectional study in Chinese hospitals found relationships between perceived disclosure barriers and aspects of safety culture. These sources reinforce the need to address both skills and the conditions in which clinicians use them. They do not prove that a particular script removes fear or changes behavior. [8, 9]

Preparation should include explaining known facts plainly, acknowledging uncertainty, responding to emotion, avoiding speculation, and identifying the next contact. Team members should clarify their roles before a meeting and arrange qualified communication support when needed. The purpose is to make the conversation understandable and responsive, not to rehearse a statement so tightly that the patient cannot ask a question.

Qualitative research in Ireland described the importance of acknowledgment, apology, compassionate communication, and space for patients and families to share their experiences. Participants also described lasting effects of poor disclosure. The small retrospective sample explains experiences rather than measuring their prevalence, and the legal setting differs from that of United States hospitals. [10]

A simulation study of physician-nurse teams examined when and how apologies occurred during disclosure conversations. It showed that apology can serve several functions and can be connected either to the patient’s suffering or to the clinician’s own discomfort. The study did not test legal protection or demonstrate what wording produces the best long-term outcome. [11]

A scoping review of hospital strategies for communication and nonmaterial restoration identified interpersonal communication, organization of support, and desired outcomes as important to patients. A restorative perspective likewise argued that investigations should attend to human impact as well as system learning. These contributions support a broader response while remaining distinct from proof that a restorative program reliably achieves healing. [12, 13]

Ask what the patient or family most needs to understand now. Separate confirmed facts from matters still under review. Explain what the team is doing, who will follow up, and how the person can raise a new concern. When an answer is unavailable, acknowledge the gap and return to it. Do not fill uncertainty with an unsupported explanation merely to make the conversation feel complete.

The initial response should connect immediate clinical care with the next steps in communication and review. The appropriate clinical team determines urgent treatment and safety actions. An assigned response lead coordinates the organizational process so that the patient does not have to navigate several departments independently. These are proposed management responsibilities and must be implemented consistently with local requirements and roles.

Name a continuing contact who has access to the response team and can obtain answers. Clarify how the patient wishes to communicate, who may participate, and what accommodations or practical support are needed. Confirm the next expected update even if the investigation will not be complete. A reliable update can explain progress and uncertainty without pretending that the final explanation is already known.

Document the conversation through the organization’s approved process. Record the factual information shared, important questions, agreed next steps, and relevant care decisions. Preserve required records and avoid retrospective alteration that obscures the sequence of events. Decisions about where particular investigative or legal material belongs require the appropriate records and legal expertise.

A systematic review of disclosure literature identified widely varying reports of practice and many expected benefits, while calling for stronger empirical evidence from actual cases. That distinction remains important: a plausible benefit of prompt, respectful communication should not be advertised as a guaranteed reduction in claims or restoration of trust. [14]

Qualitative research with nurses after medication errors described persistent emotional responses and gaps in support. The findings concern staff experience and should not displace the patient’s needs. They do show that the organizational response has consequences for several people, including those responsible for continuing care. [15]

A framework-development study in cancer care proposed a definition and approach to preventable psychological harm. It supports treating psychological impact as a distinct area of inquiry, without establishing its frequency across settings or the effectiveness of a specific intervention. A review of patient views in ambulatory care similarly found that communication and service experiences could matter alongside traditionally recognized technical events. [16, 17]

Invite the patient to describe the consequences in their own terms. These may involve fear, disrupted work, difficulty obtaining follow-up care, uncertainty about future treatment, or strain on family relationships. Do not assume that a clinical grading system captures the full experience. At the same time, avoid promising that the hospital can resolve every consequence or making an unsupported causal attribution before the facts are assessed.

Translate what is heard into an actionable response. A concern about the next appointment needs a care-coordination owner. A question about the event needs someone who can obtain a factual answer. A request for practical assistance needs a clear review route. Recording concerns without identifying who can respond risks adding another layer of disappointment to the original event.

A local peer-support implementation reported improved perceptions of available support over a short period. It offers an example of operational feasibility, but its design does not establish durable effects on burnout, retention, or patient safety. Two systematic reviews found substantial need for support while highlighting heterogeneous interventions and limitations in effectiveness evidence. [18, 19, 20]

A European focus-group study identified proposed success factors involving resources, trained supporters, organizational culture, leadership, and adaptation to context. Qualitative research with nurses and nurse managers in China described personal and workplace conditions that could help or obstruct coping. These findings inform program design; they should not be presented as proof that peer support alone is sufficient. [21, 22]

Provide practical guidance, access to appropriate professional support, and a fair process for participating in the review. Explain the boundaries of confidentiality accurately for the actual support service. Do not promise absolute protection or anonymity when the organization cannot provide it. Ensure that people who need urgent clinical help can reach the established professional pathway.

Support and accountability can coexist. A respectful response does not require a premature conclusion that nobody was responsible. A fair investigation does not require humiliation or abandonment. Assign staff-support work separately enough that a distressed clinician is not expected to manage their own assistance while also leading every discussion with the family. Keep the patient’s needs central without treating staff distress as irrelevant.

An exploratory analysis of restorative just-culture cases proposed enabling conditions involving leadership, attention to relationships, and the wider regulatory and public environment. Its findings are hypotheses for further testing, not a validated causal model. They nevertheless highlight that the tone and decisions of senior leaders can shape what the organization is able to learn. [23]

A nested case-control study within a communication-and-resolution program examined characteristics associated with deaths identified as unexpected. The result should not be interpreted as a general population risk estimate or as proof that the program removes inequity. It illustrates why organizations should examine which events enter the response process and how selection may differ across groups. [24]

A single-group quasi-experimental study of a just-culture program reported favorable changes in head-nurse and staff measures after education. Without a concurrent control, other explanations remain possible. Improved reporting measures also do not directly demonstrate fewer patient injuries. The useful next question is whether changes in reported culture lead to reliable learning and safer work over time. [25]

Define the review question, collect relevant information through appropriate channels, and include the patient’s account when feasible and desired. Examine actions in their operational context without assuming that a familiar label explains the event. The resulting recommendations should identify the responsible owner, resources, implementation conditions, and evidence needed to judge whether the change has worked.

For hospitals subject to the relevant Medicare conditions of participation, 42 CFR 482.13 addresses patient rights, including information about health status, participation in care decisions, and a grievance process. Section 482.21 requires an ongoing hospital-wide, data-driven quality assessment and performance improvement program, with governing-body responsibilities. Its program requirements include tracking adverse events, analyzing causes, and implementing preventive actions with feedback and learning. Medical-record requirements appear in section 482.24. [26]

These provisions address related but distinct responsibilities. They should not be reduced to a claim that one federal rule supplies a universal apology script or resolves every question about disclosure after harm. A hospital’s actual obligations may also arise from other applicable laws, professional requirements, contracts, and policies. Determining that full set requires current review for the particular organization and event.

The management implication is to coordinate the processes without collapsing them. A grievance can require a response while a safety review continues. Care decisions may need immediate communication before causation is settled. A required report may follow a different definition and timeframe from an internal review. The response lead should know which specialist owns each obligation and how completion will be verified.

The federal Patient Safety and Quality Improvement Act and its implementing regulations establish privilege and confidentiality protections for qualifying patient safety work product. The definition includes specified information developed or assembled within the statutory framework and certain patient-safety evaluation-system deliberations or analyses. It also contains important exclusions, including original medical records, billing and discharge information, and information maintained separately from that system. Reporting a copy does not automatically transform separately existing information into protected work product. [27]

The regulations distinguish privilege from confidentiality and contain exceptions and conditions. That distinction matters when deciding whether information may be disclosed, must be withheld, or is subject to another legal process. The presence of a patient safety organization relationship does not mean that every document a hospital creates is protected. Equally, the exclusions do not mean that every quality-related analysis is unprotected. [27]

Before an event occurs, establish a documented information architecture with appropriate legal and records review. Identify the patient safety evaluation system, authorized activities, access arrangements, and handling of original and externally required records. Labels alone cannot settle the status of information. Its purpose, origin, handling, and applicable law may matter, and disputed applications require qualified legal analysis.

HHS’s 2016 guidance explains that the patient-safety framework does not relieve providers of external reporting and recordkeeping obligations. Records required for those purposes cannot be shielded simply by placing them in a patient safety evaluation system. The guidance distinguishes information created for protected voluntary learning from information needed to satisfy obligations that exist independently. [28]

This is an information-governance issue before it becomes a dispute about a particular document. Maintain a clear route for required clinical and external records, and a properly designed route for qualifying patient-safety work. Do not destroy an original record after placing a copy elsewhere, or assume that a label eliminates an obligation. Applicable preservation requirements must also be addressed by the responsible professionals.

The practical aim is to support both accountability and protected learning through accurate classification and handling. Neither blanket secrecy nor indiscriminate sharing is a sound substitute for that work. When uncertainty arises, escalate the specific information and purpose to qualified counsel and the relevant records or patient-safety experts. The organization needs an answer grounded in the actual circumstances, not a generic assurance about privilege.

Ohio Revised Code 2317.43 provides one concrete example. Its specified protections include certain expressions of apology, sympathy, error, or fault made by covered people to covered recipients following an unanticipated medical outcome. The statute addresses admissibility for stated purposes in specified proceedings. It also contains provisions for communications during a defined good-faith review, with conditions concerning the review process and medical-record treatment. Its terms must be read together. [29]

This example should not be generalized to other jurisdictions or described as immunity from liability. Nor should an apology statute be treated as the same protection as federal patient safety work product, attorney-client privilege, or a state peer-review provision. Those concepts concern different information, relationships, processes, and legal conditions. A disclosure policy needs accurate advice about the law that actually applies. [29]

The executive task is to obtain that advice in advance and translate it into usable guidance. Clinicians should know whom to contact and how to communicate verified facts and uncertainty under the approved process. They should not be expected to interpret an unfamiliar statute at the bedside. Legal preparation should help the organization respond coherently while preserving truthful communication and applicable rights and duties.

AHRQ’s CANDOR implementation guidance describes a coordinated approach involving event identification, response activation, communication, investigation, support, and resolution. It is implementation guidance, not a substitute for applicable law or an automatic statement of the requirements for every hospital. Its process recommendations need adaptation to the organization’s resources, services, and legal setting. [30]

Build an activation process that can recognize unexpected harm without requiring a final determination of negligence before anyone responds. The initial team should be able to arrange care, communicate appropriately, preserve relevant information, and identify necessary notifications. A later review can refine what happened and what response is warranted. Waiting for complete certainty can leave important human and operational work unattended.

Define who can make decisions about practical assistance, investigation resources, professional review, and any proposed resolution. Insurers, counsel, clinical leaders, and executives may have distinct roles that must be coordinated. Do not imply that all events warrant the same form of compensation or that compensation substitutes for explanation and learning. The process should remain responsive to the circumstances and the people affected.

Use measures that describe the pathway, with explicit denominators and limitations. Examples include whether eligible events were identified, whether a contact was assigned, whether promised updates occurred, whether questions remained unresolved, and whether patients were offered a way to describe their experience. These are proposed process measures, not validated surrogates for healing or safety.

Examine access to the process. Language, disability, distance, digital access, fear, or limited time can affect participation. Provide appropriate alternatives and interpret nonresponse cautiously. Review whether certain services or patient groups are less likely to enter the pathway, while protecting privacy and avoiding unreliable conclusions from small numbers. A difference should prompt investigation of the process rather than an assumption about a group’s preferences.

Track improvement actions beyond their administrative completion. A revised policy is an output; reliable use in practice and a reduction in the identified hazard are different questions. Define how the organization will test the change, what information will be reviewed, and who can act if the problem persists. Return appropriate learning to staff and, when feasible and desired, to patients and families who contributed.

An illustrative exercise can reveal weaknesses before the process is needed. Use a fictional event in which the patient has ongoing treatment needs, the clinical explanation remains uncertain, a family member requests a meeting, and an external reporting question arises. Do not use identifiable patient information merely for convenience. Ask the team to show what it would do, who would decide, and how the patient would receive an update.

Introduce a change in the scenario: a new fact emerges after the first conversation. The exercise should test how the team corrects or expands the explanation, records the change appropriately, and reaches the patient. It should also test whether different departments can work from a consistent understanding without sharing material beyond their authorized access. These are proposed learning activities rather than a validated assessment instrument.

Then test a resource constraint. If the usual response lead is unavailable, who takes over? If the family needs an interpreter or a different meeting format, who arranges it? If an improvement requires funding beyond the unit’s authority, who can decide? The answers should identify actual roles and services. A policy that depends on unnamed cooperation may fail precisely when the event creates competing demands.

Finish by assigning repairs to the process. Distinguish an unclear instruction from a missing resource, a skills gap from a legal question, and a delayed handoff from an unresolved decision. Record the owner and how the organization will verify the repair. The exercise is useful only if its findings change the readiness of the people and systems expected to respond.

At governing-body level, request an appropriate account of the program’s operation, unresolved systemic concerns, and improvement follow-through, with information handled under applicable requirements. Aggregate reports should retain enough context to make material problems visible. A favorable trend in closed files should not prevent leaders from examining cases in which communication stalled or necessary operational changes remained unfunded.

The research remains uneven. Liability studies are more developed than evidence on patient and family outcomes, many support evaluations lack strong comparisons, and qualitative findings require contextual interpretation. Conceptual and restorative perspectives offer useful questions without proving effectiveness. This review does not provide a national inventory of apology laws, current case-law analysis, or a determination of privilege for any particular record.

The proposed framework is therefore a management synthesis with explicit limits. It requires local legal, clinical, records, patient-safety, and patient-experience review. The hospital must also supply the people and resources needed to make its commitments credible. A process that promises regular contact or practical assistance without the capacity to deliver can create additional harm.

Leaders should ask whether the organization can explain what is known, listen to what matters, coordinate support, meet its obligations, and act on what it learns. Each part needs evidence and an accountable owner. A mature response after harm is demonstrated through that continuing work, including when the facts are difficult, the outcome remains disputed, or the most important organizational lesson is uncomfortable to hear.