October 25, 2018
By: Stephanie T. Eckerle and Stacy Walton Long
An ABC television crew was permitted to film on the premises of three Boston-area teaching hospitals, Boston Medical Center (“BMC”), Brigham and Women’s Hospital (“BWH”), and Massachusetts General Hospital (“MGH”). However, the three healthcare providers failed to first obtain patient authorizations required by HIPAA.
On September 20, 2018, the Department of Health and Human Services (“HHS”) and the Office of Civil Rights (“OCR”) reached separate settlements with BMC, BWH and MGH, which collectively totaled payments of over $999,000 to OCR to settle violations of HIPAA. According to the director of OCR, “[p]atients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments. Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.1" As part of a Corrective Action Plan that each heath care provider entered into, workforce training was included on OCR’s guidance on disclosures of PHI to film and media outlets. For their respective Resolution Agreements and Corrective Action Plans, please visit the HHS website. This is not the first HIPAA violation involving the ABC television network. OCR entered into a settlement on April 16, 2018 with New York-Presbyterian Hospital, which was involved with the filming of “NY Med.”
OCR provides guidance on disclosures to film and media, which can be found here. Generally, health care providers may not allow film crews or other members of the media into treatment areas of their facilities or any other areas where PHI will be accessible and viewable in written, electronic, oral or other visual or audio form, without prior HIPAA-compliant authorizations from the patients who are or will be in the areas or whose PHI will be accessible to the media. Further, it is not sufficient for a health care provider to request or require media personnel to hide the identities of patients (e.g. blurring) for whom an authorization was not obtained.
In addition, health care providers must implement reasonable safeguards to protect against incidental unauthorized disclosures that may be in the area of filming. There are situations where a health care provider can disclose limited PHI to the media without obtaining an authorization, but these situations are very limited. See 45 C.F.R. §§ 164.510(a) and (b)(1)(ii).
Although it might be enticing for your facility to be on television and cast in a favorable light, patient privacy rights and the HIPAA Privacy Rules are implicated when camera crews arrive.
If you have any questions regarding the disclosure guidelines of patients’ PHI to the media under HIPAA, please contact Stacy Walton Long (slong@kdlegal.com) or Stephanie T. Eckerle (seckerle@kdlegal.com), or any other member of the Krieg DeVault LLP Healthcare Practice Group.
1 See the U.S. Dept. of Health and Human Services Press Release, September 20, 2018. https://www.hhs.gov/about/news/2018/09/20/unauthorized-disclosure-patients-protected-health-information-during-abc-filming.html.
Industries
October 25, 2018
By: Stephanie T. Eckerle and Stacy Walton Long
An ABC television crew was permitted to film on the premises of three Boston-area teaching hospitals, Boston Medical Center (“BMC”), Brigham and Women’s Hospital (“BWH”), and Massachusetts General Hospital (“MGH”). However, the three healthcare providers failed to first obtain patient authorizations required by HIPAA.
On September 20, 2018, the Department of Health and Human Services (“HHS”) and the Office of Civil Rights (“OCR”) reached separate settlements with BMC, BWH and MGH, which collectively totaled payments of over $999,000 to OCR to settle violations of HIPAA. According to the director of OCR, “[p]atients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments. Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.1" As part of a Corrective Action Plan that each heath care provider entered into, workforce training was included on OCR’s guidance on disclosures of PHI to film and media outlets. For their respective Resolution Agreements and Corrective Action Plans, please visit the HHS website. This is not the first HIPAA violation involving the ABC television network. OCR entered into a settlement on April 16, 2018 with New York-Presbyterian Hospital, which was involved with the filming of “NY Med.”
OCR provides guidance on disclosures to film and media, which can be found here. Generally, health care providers may not allow film crews or other members of the media into treatment areas of their facilities or any other areas where PHI will be accessible and viewable in written, electronic, oral or other visual or audio form, without prior HIPAA-compliant authorizations from the patients who are or will be in the areas or whose PHI will be accessible to the media. Further, it is not sufficient for a health care provider to request or require media personnel to hide the identities of patients (e.g. blurring) for whom an authorization was not obtained.
In addition, health care providers must implement reasonable safeguards to protect against incidental unauthorized disclosures that may be in the area of filming. There are situations where a health care provider can disclose limited PHI to the media without obtaining an authorization, but these situations are very limited. See 45 C.F.R. §§ 164.510(a) and (b)(1)(ii).
Although it might be enticing for your facility to be on television and cast in a favorable light, patient privacy rights and the HIPAA Privacy Rules are implicated when camera crews arrive.
If you have any questions regarding the disclosure guidelines of patients’ PHI to the media under HIPAA, please contact Stacy Walton Long (slong@kdlegal.com) or Stephanie T. Eckerle (seckerle@kdlegal.com), or any other member of the Krieg DeVault LLP Healthcare Practice Group.
1 See the U.S. Dept. of Health and Human Services Press Release, September 20, 2018. https://www.hhs.gov/about/news/2018/09/20/unauthorized-disclosure-patients-protected-health-information-during-abc-filming.html.