Film Crews Not Permitted in Hospitals Unless HIPAA Authorizations are Obtained from Patients, Warns OCR

Hospitals have been warned that they must not allow film crews into parts of hospitals where there is protected health information unless prior authorization has been obtained from all patients that are or will be present. The COVID-19 public health emergency has not seen any relaxation of this requirement of the HIPAA Privacy Rule and violations will be subject to financial penalties.

The HHS’ Office for Civil Rights has previously imposed penalties on hospitals for violating patient privacy by allowing film crews to record footage without first obtaining HIPAA authorizations. In 2018, three fines were imposed on Boston Medical Center ($100,000), Brigham and Women’s Hospital ($384,000), and Massachusetts General Hospital ($515,000) who allowed filming to take place without obtaining consent from patients.

OCR issued new guidance to HIPAA covered entities on May 5, 2020 confirming media and film crew access to healthcare facilities where the protected health information of patients is accessible is only permitted by the HIPAA Privacy Rule if a HIPAA authorization has been obtained in advance from each patient in the area that will be accessed by the media and film crews.

OCR explained that PHI can take many forms and covers oral, audio and visual forms of PHI, not only written and electronic PHI. In the guidance, OCR said it is not permissible to record video footage of patients and blur their faces prior to broadcast to prevent the patients from being identified. That may still be appropriate, but HIPAA authorizations are still required.

Provided HIPAA authorizations are obtained, the HIPAA Privacy Rule does not prohibit film crews from recording footage at hospitals and other healthcare facilities; however, even if authorizations are obtained, it is still necessary to take steps to prevent unauthorized disclosures of PHI. For instance, privacy screens should be used to prevent the film crews from viewing electronic PHI on computer monitors. It would also be necessary to erect screens to ensure the privacy of patients who have not signed a HIPAA authorization is protected.

“The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll,’” said Roger Severino, OCR Director.  “Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”