The HHS’ Office for Civil Rights (OCR) issued guidance to remind healthcare providers that under the HIPAA Privacy Rule, the media and film crews are not allowed to access healthcare facilities where patients’ protected health information (PHI) is accessible unless the concerned patients have provided written authorization in advance. A public health emergency does not alter the terms of the HIPAA Privacy Rule, which continues to be in effect in emergency cases.
In 2018, Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital were issued enforcement actions by OCR after discovering they had allowed film crews access to their facilities without obtaining patient authorization first. They paid a fine of $999,000 for the HIPAA violations.
OCR has released Notices of Enforcement Discretion at this time of the coronavirus pandemic and is not going to impose sanctions and fines on HIPAA-covered entities for specific HIPAA Rules violations. Penalties can and will be charged on covered entities for breaking HIPAA Rules not covered by the Notices of Enforcement Discretion, like unauthorized disclosures to the mass media.
In the most recent guidance, OCR clarifies that PHI includes written, spoken, electronic, and other graphic and audio forms of health data that should be protected against unauthorized access and disclosure. In all instances, including the accessibility of film crews to the healthcare facilities, HIPAA authorizations should be obtained from patients ahead of time. It isn’t permissible for film crews to just mask the identities of patients in the video, like blurring faces before broadcast.
The HIPAA Privacy Rule does not forbid film crews from going into medical facilities. Provided there are HIPAA authorizations obtained first from all patients who are in or are going to be in the places accessed by the film crews, filming is allowed. Nevertheless, in such situations, reasonable precautions must still be implemented to safeguard against unauthorized disclosures of PHI, such as measures such as privacy screens on computer monitors to avoid viewing of electronic PHI. Screens should also be employed to make sure patients who didn’t sign HIPAA authorizations are not filmed.