HIPAA In Front of the Camera

camera-3633075_640HIPAA and the media can be a risky combination for healthcare organizations. Prior HIPAA settlements imposed by the Office for Civil Rights have dinged hospitals for allowing reality television shows to be filmed in the hospital and speaking with a reporter to refute a patient complaint. The focus always comes back to maintaining privacy and respecting personal information about patients.

The complications that can arise with interacting with the media are coming to the fore again during the COVID-19 pandemic. The public is worried and wants as much information as possible, which in turn relies upon reports presented through the media. To obtain information, the media may reach out to a hospital or other healthcare organization or seek to bring crews to a location. All such actions and other alternatives just mean the possibility of exposing information about one or more patients.

Given the attention, OCR issued another round of pandemic driven guidance. The new guidance focuses on media interactions and, contrary to many other pandemic driven announcements, does not reveal a new relaxation of HIPAA requirements or enforcement discretion. Instead, OCR clearly reminds that all normal privacy protections remain in place for interactions with the media. Paraphrasing OCR, just because a public health emergency exists, does not mean that patient authorization can be skipped before sharing information with the media. The statement is a strong one in terms of respecting privacy, though very much focused on one particular scenario.

If the normal status quo remains for interactions with the media, what does that mean? In the simplest terms (without nuance), patient authorization is required before information can be shared with the media. If individual patient information will be disclosed, then the individual must be afforded the opportunity to permit the disclosure. The opportunity to authorize also means before any disclosure occurs, not after the fact (the issue that landed more than a few hospitals in hot water a few years ago in connection with a reality show). Additionally, an individual’s treatment cannot be conditioned upon granting the authorization (hopefully no organization would seek such an impediment at any time).

The simplistic description though carefully and intentionally does not state that patient authorization is always required. Provisions of the HIPAA Privacy Rule are why an absolute statement cannot be made. The Privacy Rule allows facility directory information to be provided without authorization unless the individual objects to being included in the directory. Additionally, an organization may disclose limited amounts of protected health information to obtain help in determining the identity of an unknown patient. The instances where disclosure is permitted are not wholesale permissions though, but only allow a small amount to be revealed.

Going through the details of interactions between healthcare organizations and HIPAA so far has not addressed when or how video can be done. HIPAA does not wholesale prevent the media from coming to a hospital, for example, and filming. The film crew could be placed in an area of the hospital where no patient information is visible or could be overheard, such as an interview room or other non-patient care area. In that instance, the healthcare organization could have an in-depth media interaction, provided that statements do not go into a danger zone.

The first scenario is a controlled environment though. What happens if a media crew shows up and sets up outside the facility or another spot near the facility? If the media crew is not seeking permission and just setting up camp, then the facility should do what it would in any instance. Specifically, use reasonable efforts to protect patient privacy and not make it easy for information to be obtained inadvertently. Such protections apply in any instances when unapproved filming or photography occurs and may be covered by a general policy that an applicable organization has adopted.

The OCR guidance goes to show that not all privacy expectations are relaxed during the pandemic. Even where there has been some relaxation, taking all reasonable steps and measures to respect and honor privacy is the recommended course of action. Respecting privacy engenders trust and loyalty.

About Matt Fisher

Matt is the chair of Mirick O'Connell's Health Law Group and a partner in the firm's Business Group. Matt focuses his practice on health law and all areas of corporate transactions. Matt's health law practice includes advising clients with regulatory, fraud, abuse, and compliance issues. With regard to regulatory matters, Matt advises clients to ensure that contracts, agreements and other business arrangements meet both federal and state statutory and regulatory requirements. Matt's regulatory advice focuses on complying with requirements of the Stark Law, Anti-Kickback Statute, fraud and abuse regulations, licensing requirements and HIPAA. Matt also advises clients on compliance policies to develop appropriate monitoring and oversight of operations.
This entry was posted in Business, Compliance, Healthcare, HIPAA, HITECH, Regulations and tagged , , , , . Bookmark the permalink.

2 Responses to HIPAA In Front of the Camera

  1. Ashok Puri says:

    Nice discussion. What about filming politicians making rounds of hospital wards, where patients are seen and identifiable, and showing on the news channel? Can it be considered as a violation of their privacy?

    • Matt Fisher says:

      Any filming should respect patient privacy. If a policitican is making rounds with a camera, then authorization from each person would be necessary.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s