Healthcare Law Alert: OCR Issues Guidance About Media Access to Health Care Facilities During COVID-19 Crisis

May 7, 2020 – On May 5, 2020, the Department of Health & Human Services, Office for Civil Rights (OCR) issued guidance relating to restrictions on media access to protected health information (PHI) about individuals in health care facilities. In essence, the guidance is a reminder of HIPAA’s restrictions against disclosures of PHI to the media, including film crews, without first obtaining individual authorizations from the affected individuals/patients. The guidance is in the form of a Q&A on the following:

Does the COVID-19 Public Health Emergency alter the HIPAA Privacy Rule’s restrictions on disclosures of protected health information to the media?

As to this question, the OCR answered “No.” “HIPAA does not permit covered health care providers to give the media, including film crews, access to any areas of their facilities where patients’ PHI will be accessible in any form (e.g., written, electronic, oral, or other visual or audio form), without first obtaining a written HIPAA authorization from each patient whose PHI would be accessible to the media.” Health care providers also are prohibited from conditioning treatment on the signing of an authorization form for this purpose. This is consistent with the HIPAA Privacy Rule and prior OCR guidance on this topic, so nothing new here.

May HIPAA-covered health care providers allow media or film crews to film patients in their facilities where patients’ protected health information will be accessible without the patients’ authorization if the patients’ faces are blurred or their identities are otherwise masked in the video?

The OCR again responded “No” to this question, and blurring or masking identities when the recording is aired is not sufficient.

When a patient is receiving treatment, they are typically surrounded by PHI, such as their name or medical record number on a hospital room door or identification bracelet, notes about their care including conditions or medications written on bulletin boards, real-time displays of heart or lung function, and oral communications about their health and health care. In addition, a patient’s presence in an area of a health care facility that is dedicated to the treatment of a specific disease or condition, such as COVID-19, reveals the patient’s diagnosis. The HIPAA Privacy Rule does not permit a covered entity to give the media access to such patient PHI unless it obtains a valid HIPAA authorization from the patient before giving such access.

The OCR reminded providers that the OCR resolved investigations concerning media access to health care facilities in 2016 and 2018, which resulted in penalties and corrective action plans. In one instance, New York Presbyterian Hospital settled OCR allegations concerning media access for a $2.2 million monetary penalty and a corrective action plan that included two years of monitoring. In another instance, OCR settled allegations with three Boston area hospitals relating to filming by the ABC television network on hospital premises. In that matter, the hospitals each entered into resolution agreements with the OCR requiring corrective action plans and collectively paid $999,000 in monetary penalties.

In short, health care providers and facilities must ensure they obtain patient authorizations from all individuals whose PHI may be disclosed to or through the media and must employ reasonable safeguards against impermissible access to or disclosures of PHI.

Can a covered health care provider ever allow the media to film patients in areas of their facilities where patients’ PHI will be accessible?

In this instance, the OCR answered “Yes,” with certain conditions attached. Every patient who is or will be in the area of filming or whose PHI will be accessible to the media must sign a valid HIPAA authorization form prior to permitting the media to enter into patient areas or in any way access PHI. “Even then,” OCR warns, “covered health care providers must ensure that reasonable safeguards are in place to protect against unauthorized disclosures of PHI. Reasonable safeguards can include installing computer monitor privacy screens to prevent the film crew from viewing PHI on computers, and setting up opaque barriers to block the film crew’s access to the PHI of patients who did not sign an authorization.”

If you have any questions or need assistance with your HIPAA compliance program or management of a data breach, please contact:

Lani M. Dornfeld, Member, Healthcare Law at 973-403-3136 or ldornfeld@pagconcepts.com