What is a candour policy?

A candour policy is an organizational protocol that prescribes when and how to communicate with patients and families after adverse events. It clarifies roles, timing, disclosure content, and documentation practices to promote transparency and consistent handling.

Does HIPAA allow disclosure to patients?

Yes. Disclosing information to a patient about their care is permitted under HIPAA when consistent with treatment and care operations. Protect patient privacy by sharing only the minimum necessary information and documenting disclosures in the medical record.

Can disclosures be e-signed?

Electronic signatures are legally valid under ESIGN (15 U.S.C. ch. 96) and UETA in most states; ensure the chosen platform supports audit trails, retention, and any required consumer disclosures for validity.

When should legal be involved?

Involve legal when the incident meets predefined escalation criteria, when admissions of fault are possible, or when external reporting or potential litigation is anticipated.

Are apologies admissions of liability?

Apology laws vary by state; many statutes limit the admissibility of certain apologies in court, but legal counsel should advise on wording to avoid unintended admissions.

How should records be stored?

Store disclosure records in the EHR and a secure incident repository with role-based access, encrypted storage, and retention schedules aligned with HIPAA and state requirements.

Electronic Signature
Templates
Healthcare
Healthcare Candour Policy

Healthcare Candour Policy

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Healthcare Candour Policy — Patient Acknowledgement

Purpose and Scope

This document explains the organisation's candour policy and confirms that the patient has been informed of the open disclosure process following an unexpected clinical outcome, incident, or adverse event. Candour requires that healthcare staff act transparently, provide an explanation of events, express regret where appropriate, and offer reasonable steps to address the patient's needs. This policy applies to all staff involved in the patient's care and to contracted clinicians providing services within this facility.

Definitions

Adverse event: an event which results in unintended harm to a patient. Near miss: an event that could have caused harm but did not. Open disclosure: a process of communication with a patient about an adverse event that includes explanation, apology where appropriate, and information on steps taken to investigate and prevent recurrence. Apology: an expression of regret or sorrow and not, in itself, an admission of legal liability.

Patient Information

Full legal name

Date of birth:

Gender:

Address

Phone:

Medical record number:

Emergency contact (name, relation, phone)

Insurance Information

Insurer / Provider

Policy number:

Group number:

Subscriber name (if different)

Medical History (Relevant to Candour)

Current medications Known allergies Prior surgeries / significant conditions

Principles of Candour and Staff Responsibilities

Healthcare staff must notify the patient or the patient's authorised representative promptly when an adverse event occurs that has affected, or could reasonably be expected to affect, the patient's health. Notification will include a timely explanation of what is known, expressed regret where appropriate, an outline of immediate steps taken, and planned further actions including investigation and follow-up. Staff will document all disclosures and interactions in the patient's clinical record and complete any internal incident reporting required by policy.

Managers must ensure investigations are conducted in a manner that is fair, timely, and preserves relevant evidence. Where legal or regulatory considerations require, staff may seek advice from the organisation's legal advisor; however, candour obligations remain a priority unless restricted by law or a court order.

Open Disclosure Procedure

1. Immediate clinical care and safety: ensure the patient's immediate clinical needs are addressed and stabilised as required. 2. Initial communication: provide an initial explanation as soon as practicable. 3. Formal meeting: offer a formal discussion to explain known facts, potential causes, and proposed corrective actions. 4. Investigation and follow-up: investigate the event, share outcomes with the patient, and provide a written summary on request. 5. Documentation: record all communications in the clinical record and maintain incident reports in accordance with recordkeeping protocols.

Patient Rights and Preferences

Patients have the right to receive timely, honest information about events affecting their care, to be involved in decisions about follow-up, and to nominate a representative to receive communications. Patients may indicate communication preferences below.

Preferred method of disclosure (select all that apply)

In person Telephone Written summary Via authorised representative

If via representative, provide name and relationship Interpreter required?

Yes No

Confidentiality, Legal Considerations and Limitations

Communications made pursuant to this policy will be documented in the clinical record. While candour supports transparent communication, disclosures may be limited where required by law, a court order, or where disclosure would be reasonably likely to cause serious harm to the patient. An apology or expression of regret provided in accordance with this policy is intended as an expression of sympathy and is not, by itself, an admission of negligence or legal liability.

Training, Monitoring and Review

The organisation will provide staff training on open disclosure principles and monitor compliance with this policy through incident reviews and regular audits. Findings that indicate systemic issues will be reported to senior management for remedial action.

Acknowledgement and Consent

By signing below, I acknowledge that I have received an explanation of the Healthcare Candour Policy, understand the principles of open disclosure, and have been given the opportunity to ask questions. I understand that I may withdraw my preferences for communication at any time by notifying the facility in writing, except where legal or safety considerations require otherwise.

Acknowledgement (select all that apply)

I have received a copy of the candour policy
I understand how open disclosure will be undertaken
I understand I may ask questions and receive follow-up information

Authorization for staff to discuss my care with my representative (if completed) Authorization expiration date

Privacy Acknowledgement

I acknowledge that personal health information will be used and disclosed as necessary to carry out open disclosure, internal incident review, and quality improvement activities consistent with privacy laws. Where required for investigation or reporting, relevant information may be disclosed to authorised external bodies in accordance with legal obligations.

I acknowledge the privacy statement above

Comments or Concerns

Additional comments, concerns or instructions

Patient Name:

Signature:

Date:

If signed by guardian/representative, indicate relationship:

What the Healthcare Candour Policy Is and When It Applies

A Healthcare Candour Policy sets out an organization’s process for timely, transparent communication with patients and families after an adverse event or unanticipated outcome. It describes notification, disclosure content, roles, timelines, and documentation standards used to explain what happened, express empathy, and outline next steps. The policy aligns with applicable patient-safety, privacy, and regulatory obligations while preserving records needed for internal review, quality improvement, and any required external reporting.

Why a Candour Policy Matters for Providers and Patients

A clear Healthcare Candour Policy promotes timely disclosure, helps meet regulatory and privacy obligations, supports patient trust, and standardizes internal reviews after incidents. It reduces confusion about responsibilities and creates consistent documentation that supports quality improvement and legal risk management.

Who Should Prepare and Follow the Candour Policy

Organizations that routinely handle patient care, including hospitals, clinics, long-term care facilities, and outpatient practices, should adopt a candour policy and train staff on its use.

Hospital risk and quality teams responsible for incident response and reporting.
Clinicians and nursing leadership who communicate directly with patients and families.
Compliance and legal staff who align disclosure with HIPAA and regulatory obligations.

The policy should be implemented by clinical leaders, risk management, legal counsel, and patient relations teams to ensure consistent application and compliance.

Core Elements to Include in a Professional Healthcare Candour Policy

A complete policy defines scope, roles, timelines, disclosure content, documentation standards, and interactions with external reporting and legal processes to ensure consistent, compliant disclosure after incidents.

Scope

Define which events require disclosure, including adverse events, near misses, and patient safety incidents, and state whether the policy applies to contractors and affiliated providers.

Roles

List responsible parties (clinician, care manager, risk manager, legal) and escalation steps to ensure timely decision-making and consistent messaging to patients and families.

Timing

Specify timeframes for initial contact, follow-up communication, and internal review milestones to balance prompt transparency with fact-gathering needs.

Disclosure Content

Provide a template for what to say and document: a factual description, known impact, steps taken, planned follow-up, and an offer of support without admissions of liability.

Documentation

Require contemporaneous documentation of conversations, decision rationales, witness names, and any offers made; preserve records following retention rules.

Legal Coordination

Describe when to involve legal counsel, reporting obligations to regulators or payers, and how disclosure interacts with incident investigations and quality improvement.

Step-by-Step: How to Complete an Incident Disclosure Record

Follow these sequential steps to ensure the event is captured, disclosed, and escalated correctly while preserving required documentation and privacy protections.

01

Identify Event: Confirm facts and classify event severity before disclosure decisions.
02

Notify Lead: Notify the designated risk manager or clinical lead within the timeframe set by policy.
03

Contact Patient: Make initial patient contact promptly and document the communication.
04

Document: Record conversation, actions taken, and next steps in the patient record and incident log.

Configuring an Online Candour Policy Workflow

When implementing the policy in an e-form or eSignature platform, configure fields and routing to match your organizational approval and documentation requirements.

Field Mapping and Validation	Require key fields and use date, dropdown, and MRN validation to prevent incomplete records.
Sequential Routing	Route the completed form to risk management, clinical lead, and legal in that order for review.
Attachments and Evidence	Allow secure upload of relevant notes, imaging, or reports tied to the incident record.
Audit Trail Settings	Enable full audit trail capture including timestamps, IP, and signer attribution for compliance.
Retention and Export	Configure long-term storage exports and access controls to meet HIPAA and internal retention policies.

Where to Send Completed Candour Records and Disclosures

Define where completed records are stored and who receives copies to ensure traceability, confidentiality, and timely follow-up.

Patient Record: Attach disclosure notes to the patient’s electronic health record (EHR).
Risk Management: Send a redacted incident file to the risk management team for analysis.
Legal Counsel: Forward to legal when the incident meets escalation criteria.
Quality Improvement: Provide anonymized data to QI teams for trending and prevention work.

Digital Signing and Secure eSubmission Requirements

Use a platform that supports secure eSignatures, audit trails, and HIPAA-compliant handling when accepting signed disclosures or policy acknowledgements.

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest.
Access Controls: Role-based permissions and SSO support.
Audit Trail: Timestamped logs, IP, and signer attribution.

Required Information and Minimum Data Elements

Patient ID: MRN and DOB

Incident Date: MM/DD/YYYY

Staff Involved: Full names

Disclosure Notes: Summary text

Documentation Link: EHR reference

Retention Tag: Record retention

Timelines and Deadlines to Build Into Your Policy

Include concrete deadlines for initial contact, documentation, internal review, and external reporting to ensure timely response and compliance.

Initial Contact Window:

Contact patient/family within 24–72 hours when possible.

Documentation Deadline:

Complete initial incident notes within 48 hours.

Internal Review:

Finish preliminary review within 7–14 days.

Regulatory Reporting:

Meet state or accreditor reporting windows as required.

Follow-up Communication:

Provide updates within the policy’s specified timeframe.

Key Processing Milestones After an Incident

A sequential milestone view clarifies responsibilities and keeps disclosure and review on track.

01

Event Recognition

Staff identify and classify the incident for initial escalation.

02

Immediate Safety Actions

Stabilize patient and implement corrective clinical measures promptly.

03

Disclosure to Patient

Conduct a planned conversation and document the content and participants.

04

Root-Cause Review

Complete investigation and derive system-level mitigation actions.

Common Mistakes When Preparing Disclosure Records

Delaying patient contact while gathering every detail, which can erode trust and complicate communication.
Using vague language or legal conclusions in the patient-facing disclosure rather than factual, compassionate explanations.
Failing to document who spoke to the patient, when, and what was said in a contemporaneous record.
Not coordinating with legal or risk teams when policy criteria require escalation, risking inconsistent messages.

Risks and Consequences of Poor Disclosure Practices

HIPAA Risk: Potential privacy violations

Regulatory Fines: State or federal penalties

Malpractice Claims: Increased litigation risk

Reputational Harm: Loss of public trust

Quality Impact: Missed safety improvements

Operational Disruption: Resource-intensive investigations

Practical Tips for Accurate and Efficient Disclosure

Adopt consistent practices that protect privacy, ensure timeliness, and support learning from incidents.

Prepare a disclosure script

Use a short, factual script to ensure clarity and empathy while avoiding speculation or admissions of liability during initial conversations.

Train clinical staff regularly

Provide role-specific training on communication, documentation, and escalation expectations so responses are consistent and compliant.

Use templated e-forms

Prebuilt fields reduce data entry errors, ensure required elements are captured, and speed routing to appropriate reviewers.

Coordinate with legal and risk

Define clear escalation triggers and include legal review when threshold conditions in the policy are met.

Examples: How Organizations Use a Candour Policy

These examples illustrate practical ways facilities apply a formal candour policy to improve communication and documentation after incidents.

Fertility Centers of Illinois

A midsize clinic adopted a standardized disclosure form tied to the EHR to reduce delays in patient contact.

The form required immediate notification and a single documented narrative.
The change improved documentation consistency and supported follow-up care while preserving secure records and reducing variability in staff responses, as noted by leadership.

Community Hospital Implementation

A community hospital implemented scripted disclosures and a rapid escalation list to risk management.

Scripts guided clinician statements while legal reviewed thresholds.
Over 12 months, the hospital reported more timely patient communications, clearer records for internal review, and more organized coordination among clinical, legal, and quality teams.

eSignature Pricing and Feature Comparison for Healthcare Disclosure Workflows

This vendor comparison highlights starting prices and key capabilities relevant to secure, compliant disclosure processes. Confirm vendor plans and features with each provider for final procurement decisions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Who Typically Signs and Approves the Policy

Chief Medical Officer

Senior clinical leader who approves clinical content, ensures alignment with patient safety goals, and signs off on escalation and disclosure protocols used across the system.

Risk Manager

Operational owner who maintains the policy, coordinates incident response, routes disclosures, and ensures documentation and reporting obligations are met.

Frequently Asked Questions About the Healthcare Candour Policy

Answers to common questions about drafting, implementing, and using a candour policy, focused on practical compliance and documentation concerns.

Need help? Contact support

What is a candour policy?
A candour policy is an organizational protocol that prescribes when and how to communicate with patients and families after adverse events. It clarifies roles, timing, disclosure content, and documentation practices to promote transparency and consistent handling.
Does HIPAA allow disclosure to patients?
Yes. Disclosing information to a patient about their care is permitted under HIPAA when consistent with treatment and care operations. Protect patient privacy by sharing only the minimum necessary information and documenting disclosures in the medical record.
Can disclosures be e-signed?
Electronic signatures are legally valid under ESIGN (15 U.S.C. ch. 96) and UETA in most states; ensure the chosen platform supports audit trails, retention, and any required consumer disclosures for validity.
When should legal be involved?
Involve legal when the incident meets predefined escalation criteria, when admissions of fault are possible, or when external reporting or potential litigation is anticipated.
Are apologies admissions of liability?
Apology laws vary by state; many statutes limit the admissibility of certain apologies in court, but legal counsel should advise on wording to avoid unintended admissions.
How should records be stored?
Store disclosure records in the EHR and a secure incident repository with role-based access, encrypted storage, and retention schedules aligned with HIPAA and state requirements.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now