The Department of Health and Human Services (HHS)’ Office for Civil Rights (OCR) has issued several Notices of Enforcement Discretion during the COVID-19 pandemic. As such, OCR will not be imposing sanctions on covered entities for good-faith violations of certain rules. OCR will continue to impose sanctions for other violations. One violation for which OCR will continue to apply sanctions is the violation of the HIPAA Media Access rule. Under the HIPAA Privacy Rule, media and film crews may not access healthcare facilities where patient PHI is accessible, unless certain safeguards are in place.
HIPAA Media Access: When Can Film and Media Crews Access Healthcare Facilities?
Under the HIPAA Media Access rule, healthcare providers may permit media and film crews to access their facilities where PHI is accessible – but only if the facility first obtains written authorization from patients. HIPAA does not permit covered health care providers to give the media, including film crews, access to any areas of their facilities where patients’ PHI will be accessible in any form (e.g., written, electronic, oral, or other visual or audio form), without
first obtaining a written HIPAA authorization from each patient whose PHI would be accessible to the media.
In addition, when film crews (after obtaining written patient authorization) access areas in which patients are present, the healthcare facility must put reasonable and appropriate safeguards in place to protect against unauthorized disclosure of PHI.
Do you have an effective HIPAA compliance program? Find out now by completing the HIPAA compliance checklist.
In the latest guidance on the topic, OCR explains that reasonable and appropriate safeguards include, among others, placing privacy screens on computer monitors to prevent electronic PHI (ePHI) from being viewed. Safeguards also include using opaque barriers to ensure that patients who have not signed written authorizations are not filmed.
OCR has taken the matter of unauthorized filming of patients very seriously in recent years. In 2018, OCR initiated enforcement actions against Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital, after it was discovered they had given film crews access to their facilities without first obtaining authorization from patients. They were fined a total of $999,000 for the HIPAA violations.
“The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll,’” said Roger Severino, OCR Director. “Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”
