On May 5, the OCR issued guidance addressing media access to PHI during the pandemic: OCR Issues Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities. The OCR’s purpose in issuing this guidance is: “reminding covered health care providers that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities where patients’ protected health information (PHI) will be accessible without the patients’ prior authorization.”
During COVID-19, providers are still required to obtain HIPAA authorizations from patients BEFORE the media is given access to patient PHI. This includes film crew access, and access to parts of the facility where patient PHI is accessible to the media in written, electronic, oral, or other visual/audio form. The OCR makes clear that every patient who will be in an area accessed by the media must sign a HIPAA authorization BEFORE the media has access.
Providers CANNOT require a patient to sign a HIPAA authorization as a condition of receiving treatment.
Masking or blurring patient faces or voices (which occurs AFTER the media has access to patients) is NOT enough to comply with HIPAA, unless a HIPAA authorization is obtained BEFORE the media has patient access.
If HIPAA authorizations are obtained in advance, and the media is given access to your facility, the OCR recommends safeguards to protect PHI:
- Use computer monitor privacy screens
- Install opaque barriers to block film crew access to PHI of patients who did not sign an authorization
This new guidance elaborates on prior OCR guidance about communicating with the media, including film crews.
Prior to the pandemic, the OCR entered two settlements with providers who allowed film crews access to patients without a proper HIPAA authorization:
- In 2016, New York Presbyterian Hospital entered a $2.2 million settlement for what the OCR called an “egregious disclosure.” The hospital allowed the ABC TV show NY Med to film two of its patients in the emergency room, without obtaining their authorization. One of the filmed patients was dying; the other was in distress. Filming continued after a medical professional objected. One of the patients filmed was Mark Chanko, a gentleman who was taken to the hospital after he was hit by a garbage truck. When NY Med aired, Mr. Chanko’s voice was muffled and his face was blurred – but he was still recognized by his widow.
- In 2018, the OCR entered a $999,000 settlement with three Boston hospitals who allowed film crews from ABC to film on the premises without obtaining HIPAA authorizations.
HIPAA media breaches are not limited to film crews:
- In 2017, a Texas health system entered a $2.4 million settlement with the OCR. A patient presented a fake ID at the system’s OB/GYN clinic. The clinic called the police, which complied with the Privacy Rule’s provisions for reporting a crime on the premises. But, then the health system issued a press release about the arrest – and the press release title included the patient’s name.
- In 2013, a medical center entered a $275,000 with the OCR after senior leaders of the medical center “met with media to discuss medical services provided to a patient” and “impermissibly shared details about the patient’s medical condition, diagnosis and treatment in an email to the entire workforce.”
MPA’s HIPAA & COVID-19 Tool Kit has been updated to include a HIPAA & the Media Policy in response to this guidance.
Read more HIPAA & COVID-19 updates on the blog.