When can you ignore medical codes of conduct?
Codes of conduct are not law — but are often treated as such in healthcare. Dr. Vlieger explains when soft law is legally binding and when you can disregard it.
Unworkable rules
Doctors and medical researchers frequently complain on LinkedIn about unworkable rules. For instance, the requirement that a radiologist must obtain patient consent to use an MRI scan produced by someone else—and that such consent is valid for only 72 hours. My response is that if the requirement is not actually in the law itself, you might well be able to ignore it. This triggers a flood of reactions. Dentists and pathologists explain to me (a legal scholar with a doctorate and years of experience as a university lecturer) that these are codes of conduct also applied by the Health and Youth Care Inspectorate (IGJ) and therefore cannot be ignored. Here, then, is an explanation for them regarding why and when certain (though not all) codes of conduct can indeed be disregarded based on the principle of legality.
Soft law is not law
Codes of conduct are often referred to as "soft law," but—contrary to what the name suggests—they do not constitute law, any more than ethics does. They are rules derived from ethics, mutually agreed-upon behaviors, or contractual arrangements that parties adhere to, but they are not law. Soft law is employed in situations where enacting or enforcing legislation is not feasible, such as in international law. It is also used when there is no desire to enact formal legislation—often because soft law offers greater flexibility or allows for observing how a new societal phenomenon evolves (as seen with franchising). Furthermore, soft law is chosen when the sector itself possesses significant expertise and good intentions; in such cases, the sector is asked to draft the rules. Soft law is excellent for all these purposes. However, soft law cannot circumvent the foundation of our European legal system: the principle of legality—or what the Romans called the lex certa principle. For instance, Article 5:4 of the General Administrative Law Act stipulates that a fine may only be imposed if both the violation and the sanction are defined in a pre-existing statutory provision. The situation differs in the United States—where the term "soft law" originated—as it plays a completely different role there.
Soft law via open norms
Yet, within the healthcare sector, soft law is treated as part of the law itself. Sometimes this is appropriate, but at other times it is not. Soft law can only become law if the statute contains an open norm. An example of such an open norm is: “The healthcare provider shall deliver good care.” But what constitutes good care? That means something different for a child psychiatrist than for a cardiac surgeon, and the definition differs between 1995 and 2025. Consequently, there are various codes of conduct and protocols that (disciplinary) courts use to give substance to the concept of good care. However, the Coreon Code of Conduct, for instance, requires the involvement of a medical ethics committee whenever there is a suspicion that a study might raise privacy concerns—such as when personal data are used without consent. Nowhere in the statute is there an open norm from which this requirement could be derived; therefore, this rule does not form part of the law. This is because, in our Continental European legal system, primacy lies with the statute, whereas in the Anglo-American legal system, primacy lies with the courts.
A judge who turns soft law into binding law
The second requirement (in our system) for transforming soft law into binding law is a judge—or a disciplinary tribunal—who actually applies those codes of conduct to give substance to a broad legal standard. Consider the separation of powers (Trias Politica): the legislature drafts laws, while the judiciary determines exactly how they play out in practice. The executive branch implements the law but cannot draft rules itself (unless the legislature has delegated specific powers—something that does happen for the sake of fleshing out details). For instance, the police cannot simply decide on their own to start fining children riding fatbikes. Similarly, while the Dutch Data Protection Authority may have a view on how the GDPR should be interpreted, that view does not carry the force of law. The European courts stated exactly this regarding the European Data Protection Board: an "opinion" is merely an opinion. The Health and Youth Care Inspectorate (IGJ), too, frequently expresses views that do not constitute law. Again, the situation differs in the United States; under the Chevron doctrine—which prevailed for decades until 2024—regulators were presumed correct regarding technical statutes unless a judge ruled that a position was demonstrably wrong. In other words, the regulator’s stance effectively became law until a judge struck it down. That is not at all how the system works in Europe.
Policies of regulators or healthcare providers
In addition to issuing opinions, regulators may also establish policies or guidelines. A clear distinction must be made between these and the policies adopted by healthcare providers themselves. A regulator’s policy is formulated because the regulator is bound by certain principles of administrative law—specifically, that like cases must be treated alike. Furthermore, to ensure legal certainty, the regulator’s conduct must be reasonably predictable. Consequently, regulators are required to develop policies regarding the discretionary scope afforded by the law. If they go beyond what the law permits, such policies are simply non-binding due to the principle of legality; a court would overturn any resulting fine—as happened, for instance, with a fine imposed for processing data that the Dutch Data Protection Authority (AP) classified as personal data, but which did not qualify as such under the GDPR. However, the reverse situation—where a regulator decides not to impose a fine even though it had the authority to do so—may well bind the regulator to that decision. This stems from the principle of legitimate expectations. Thus, regulators can limit their own powers relative to the law, but they cannot expand them.
Hospitals also formulate policies, of course, but that is an entirely different matter; it has nothing to do with administrative law or the principle of legality, but rather with sound management. Precisely because the goal there is "good" management, no one would argue that such a policy must be adhered to if it actually harms the patient. If such a situation does arise, the administrator in question might need to be reminded that they are in a position to amend unworkable rules—and indeed have an obligation to patients to do so.
Strict conditions for applicability
In short: while certain codes of conduct or protocols are indeed part of the law, this does not apply to all such rules. When must a physician or medical researcher follow a code of conduct that is not explicitly stated in the law itself?
- When soft law, ethical standards, or policy rules exist; and
- there is an open legal norm that can be given substance by this soft law, ethics, or policy rule; and
- a court has actually proceeded to use these codes of conduct to give substance to that open norm; and
- all of this meets the requirements of lawfulness and predictability; and
- there are no grounds for excluding culpability (such as an emergency situation).
If all these conditions are met, a fine can indeed be imposed for violating a soft law, ethical standard, or policy rule that is not explicitly stated in the law. Otherwise, however, this is not the case, and the decision what to do must simply be based on what is best for the patient.