While the COVID-19 public health emergency (PHE) has prompted the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) to relax certain HIPAA requirements, one restriction that has not been relaxed relates to disclosures of patients’ protected health information (PHI) to the media.
On May 5, 2020, the OCR issued a reminder in the form of new guidance that under HIPAA Privacy Rule, covered healthcare providers may not grant media and film crews access to areas of facilities where patients’ protected health information (PHI) is accessible, without first obtaining patients’ authorization. OCR further clarified that masking patients’ identities or blurring or otherwise obscuring patients’ faces or identifying information before broadcast is insufficient and that a valid and express HIPAA authorization is still required—from each patient whose PHI would be accessible to the media—before giving the media such access.
The OCR noted patients receiving treatment are typically surrounded by PHI such as their names written on hospital doors or identification bracelets, notes about care and conditions or medications written on bulletin boards, real-time displays of vital functions, and oral communications about their care—not to mention the fact that a patient’s mere presence in a particular area of a healthcare facility may reveal a diagnosis.
This latest guidance from the OCR was an addendum to earlier guidance clarifying that healthcare providers cannot make PHI accessible to the media, including by inviting or allowing media personnel (including film crews) into areas where PHI would be accessible in any format, without prior written authorization from each individual whose PHI would be accessible. As a follow-up concern, providers are reminded that they cannot require a patient to sign a HIPAA authorization as a condition of receiving treatment.
Indeed, the OCR has previously resolved investigations involving unauthorized disclosures of PHI to television crews, including separate settlements in 2018 totaling $999,000 relating to facilities that had invited film crews on-premises to film an ABC television network documentary series without first obtaining authorization from patients.
OCR Director Roger Severino explained in the May 5th press release: “The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll.” He added: “Hospitals and healthcare providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”
This latest guidance, in the form of FAQs, can be found here: https://www.hhs.gov/sites/default/files/guidance-on-media-and-film-crews-access-to-phi.pdf
If you have questions or other healthcare law concerns, contact Leech Tishman Nelson Hardiman’s Healthcare Practice Group.