It’s now a familiar scene. News coverage regularly includes video footage capturing exhausted healthcare workers, lifeless bodies in hospital beds and COVID-19 treatment areas.
Late on May 5, 2020 the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) released guidance in the form of three questions and answers on media and film crew access to patient care areas. OCR’s guidance reminds healthcare providers that granting media and film crews access to areas where patient information will be accessible requires patient authorization. The COVID-19 public health emergency does not change that rule.
OCR emphasizes that blurring patient faces or masking their identities in videos is not sufficient to meet HIPAA Privacy Rule requirements and that a patient’s prior authorization is always required. OCR points out that treatment areas contain a plethora of information about patients, such as names on patient doors, notes about care on bulletin boards, real-time displays of health or lung functions and necessary hallway discussions about patient care among staff. All this information, in addition to an audio or visual recording of a patient, is protected health information (PHI) under HIPAA.
In response to the question of whether a provider can ever grant media access to film patients in areas where patients’ information will be accessible, OCR said “[y]es. If every patient who is or will be in the area, or whose PHI otherwise will be accessible to the media, has first signed a valid HIPAA authorization, then a covered health care provider may permit the media to film in areas of their facilities where patients’ PHI will be accessible.” OCR then reminds providers that even after receiving authorization, providers must implement reasonable safeguards to protect against unauthorized disclosures, such as shielding computer screens from view and ensuring no access to the information of patients who did not provide an authorization.
In 2018, three Boston-area hospitals paid hefty settlements just shy of $1 million in total for violating the above rules. Two Boston Globe articles and a website posting about ABC News filming “Boston Med,” a medical documentary, prompted OCR to conduct “a compliance review.” In all three separate investigations, OCR found deficiencies. It concluded that while the hospitals took measures to protect patient information, OCR found their efforts to be inadequate. While it appears that the hospitals obtained at least some written authorizations from patients, OCR concluded that the hospitals disclosed information to the film crews before obtaining those authorizations.
Two years earlier, OCR reached a $2.2 million settlement with a New York hospital related to ABC News’ filming of “NY Med.” In response to this incident, OCR posted an FAQ on its site explaining that news crew access to treatment areas without patient authorization was prohibited.
Hospitals and other healthcare providers featured in news stories during this COVID-19 pandemic may find themselves subject to an OCR compliance review. So, it’s important to learn from the mistakes of Boston and New York hospitals described above.
There are several important considerations before permitting media access to patient care areas. First, providers must involve the entity’s privacy officer in any discussion about any media access before granting access. If patient care areas will be involved, patient authorizations are a must. This includes waiting areas.
In addition to obtaining patient authorizations, ensure that there is an agreement with the filming crew in advance that: (1) details permissible and impermissible conduct; (2) requires that the crew remain with a provider employee and follow that employee’s instructions at all times (preferably the privacy officer or employee with a privacy background); (3) allows the provider to cease filming at any time and for any reason; and (4) requires provider approval of the final product. Maintain the agreement and copies of all related patient authorizations in a file to ensure that there is easy access to all relevant information in the event that there is a compliance review.