On May 5, 2020, the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) issued guidance for covered health care providers regarding media access to patients’ protected health information (PHI) in compliance with the HIPAA Privacy Rule. The COVID-19 public health emergency has increased the presence of the media and film crews in hospitals and other covered health care facilities. The OCR guidance reminds covered health care providers that they are prohibited from giving the media access to any area of their facilities where patients’ PHI may be accessible without first obtaining written authorization from the patient.
Expanding upon its earlier guidance, this recent OCR guidance highlights that the COVID-19 pandemic does not relax the HIPAA Privacy Rule’s restrictions on media access to patients’ PHI. The HIPAA Privacy Rule protects patients’ PHI in all forms, including written, electronic, oral, and other visual or audio forms. The OCR guidance reminds covered entities that the HIPAA Privacy Rule continues to require covered entities to obtain all applicable patients’ written authorization to disclose their PHI before allowing the media access to a health care facility unless an exception applies. Patients’ PHI, such as the patients’ name, medical record number, diagnosis, heart or lung function data, medications, and other communications with the patients’ doctor, is often present in a patient’s treatment room.
As previously articulated in OCR enforcement actions against hospitals that allowed film crews on site prior to securing patient authorization, a patient’s presence in a hospital, skilled nursing facility, or other covered entity, including in an area designated to treat a specific disease or condition, like COVID-19, reveals the fact that the patient is receiving treatment by the facility, which is protected under the HIPAA Privacy Rule. Therefore, it is insufficient for a health care provider to require the media to disguise a patient’s identity by blurring, pixelating, or altering the patient’s voice or appearance after recording the patient in a covered health care facility. Rather, as the recent guidance emphasizes, a covered entity must obtain a valid HIPAA authorization prior to giving the media access to areas where either patients or their PHI may be accessible.
The media can record in areas of covered health care facilities when patients’ PHI may be accessible only when every patient who is in the filming area, who will be in the filming area, or whose PHI will be in the filming area has first provided a valid, signed HIPAA authorization. To account for the fact that patients are transferred between facility units and new patients are continually admitted, the entity should implement a process to allow it to confirm, on a particular day of filming and in an expedient manner, that each patient in the area being filmed executed an authorization.
The OCR guidance warns that patients’ authorization does not completely protect a covered entity from liability. Rather, covered health care providers must have reasonable safeguards in place during filming to protect against unauthorized disclosure of PHI as well as opaque barriers that block the media’s access to PHI of patients who did not consent to disclosure of their PHI.
Hospitals, skilled nursing facilities, and other health care providers regulated under HIPAA also should ensure that any of their personnel who are processing media requests or who are assisting members of the media on-site at the facility are properly trained on the entity’s HIPAA policies and procedures, particularly those applicable to the provision of in-person access to reporters and other third parties.