Recently, the Office for Civil Rights (OCR) issued additional guidance reminding covered health care providers that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities where patients’ protected health information (PHI) will be accessible without the patients’ prior authorization. The release is in response to media coverage of the ongoing COVID-19 pandemic, where video of hospitals and patients are shown on news broadcasts. Additionally, news reporting and special features have been produced to get an inside look into the pandemic from health care providers’ perspectives. Often, this captured video and audio footage is in violation of HIPAA privacy guidelines.
The COVID-19 pandemic does not lessen the restrictions on disclosures protecting public health information from the media. Previous guidance directed that HIPAA does not permit covered health care providers to give the media (including film crews) access to any areas of their facilities where patients’ PHI will be accessible in any form (video, audio, written, electronic, or any other visual or audio form) without first obtaining a written authorization from each patient whose PHI would be accessible to the media.
Healthcare providers granting media access are not allowed to work around the requirements by allowing media to use footage where the patient’s identities are masked in lieu of prior expressed authorization by each person in the footage. This restriction protects patients because footage will have PHI in the surroundings (patient charts, id bracelets, heart and blood pressure monitor, etc.) and is often visible.
Furthermore, a patient’s presence in a certain area of a health care facility dedicated to the treatment of a specific disease, such as cancer, reveals the patient’s diagnosis which is PHI. Most importantly, a patient cannot have treatment conditioned on the signing of an authorization allowing for media access.
The HIPAA Privacy Rule does not prohibit film crews from entering healthcare facilities. Healthcare providers can allow the media to film in areas that patients’ PHI will be accessible only if every patient who is or will be in that area, or whose PHI will be accessible, has first signed a valid HIPAA authorization. However, in such situations, reasonable safeguards must still be put in place to protect against unauthorized disclosures of PHI, including measures such as privacy screens on computer monitors to prevent electronic PHI from being viewed. Screens must also be used to ensure patients who have not signed HIPAA authorizations are not filmed. The key for healthcare providers is to ensure that the safeguards are in place at all times as protection of their patients’ information is critical regardless of whether media is present or not.
If you have any questions about this Legal Briefing, please contact any member of the firm at (585) 730-4773. Please note that any embedded links to other documents may expire in the future.
For more COVID-19 Legal Updates, please visit our resource page.
This Legal Briefing is intended for general informational and educational purposes only and should not be considered legal advice or counsel. The substance of this Legal Briefing is not intended to cover all legal issues or developments regarding the matter discussed. Please consult an attorney to ascertain how the applicable law may relate to you or your business. © 2020 Law Offices of Pullano & Farrow PLLC