A San Diego hospital is being sued for secretly video recording 1,800 patients while they received procedures in three labor and delivery operating rooms. Women were also recorded while undressing, and with their genitals exposed. The lawsuit alleges that the recorded women have suffered anxiety, humiliation, depression, and other harm.
The hospital installed motion-activated cameras on drug carts in the operating rooms, in order to investigate potential employee diversion of propofol from operating room drug carts. The cameras continued to record after the motion stopped. The lawsuit alleges that multiple users – including strangers and non-medical employees – could access the recordings on computers, and the hospital did not track who accessed the recordings.
While we don’t know exactly what procedures were followed in this example, some good HIPAA questions are raised for other providers considering using filming in similar circumstances.
From a HIPAA standpoint, a HIPAA authorization would be required for any such recording to be legally obtained. This story also raises concerns about how the recordings were stored and accessed, and whether access to the recordings was properly limited. And of course, before any new technology is used that will record and store ePHI, it should first be addressed in your HIPAA security risk analysis.