The HHS’ Office for Civil Rights (OCR) has released guidance to healthcare providers to reinforce the point that the HIPAA Privacy Rule forbids media and film crews entering healthcare facilities where patients’ protected health information is accessible unless prior written authorization has been obtained from the patients who may be involved.
A public health emergency does not made any difference to the requirements of the HIPAA Privacy Rule, which remains active during emergency situations.
OCR has stated this outright previously with enforcement actions against Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital in 2018 after it was discovered they had allowed film crews access to their facilities without first obtaining permission from patients. They were fined a total of $999,000 for the HIPAA breaches.
OCR has released Notices of Enforcement Discretion during the coronavirus pandemic and will not be imposing sanctions and fines on HIPAA-covered entities for certain breaches of HIPAA Rules. Penalties can and will be imposed on covered entities for violations of HIPAA Rules not included in the Notices of Enforcement Discretion, such as unauthorized sharing to the media.
In the most recent guidance, OCR explains that protected health information includes written, electronic, oral, and other visual and audio forms of health information which must be safeguarded against unauthorized access and disclosure. In all instances, HIPAA authorizations must be obtained from patients previously, before the film crews are allowed to access to the facilities. It is not permissible for film crews to simply hide the identities of patients in video footage, such as blurring faces before broadcast.
The HIPAA Privacy Rule does not forbid film crews from entering healthcare facilities. Once HIPAA authorizations have been obtained in advance from all patients who are in or will be in the areas accessed by the film crews, filming is allowed to go ahead. However, in such situations, reasonable safeguards must still be implemented to protect against unauthorized disclosures of PHI, including measures such as privacy screens on computer monitors to stop electronic PHI from being seen. Screens must also be used to ensure patients who have not completed HIPAA authorizations are not filmed.
Roger Severino, OCR Director. said: “The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll’. Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”