Since the outbreak of COVID-19, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has issued various notifications of enforcement discretion related to compliance with the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, discussed previously. However, OCR issued guidance on May 5, 2020, reminding covered healthcare providers that the HIPAA Privacy Rule remains in force during the COVID-19 public health crisis except as expressly relaxed under OCR’s prior guidance. Specifically, OCR’s most recent guidance addresses the disclosure of patient protected health information (PHI) to the media by allowing the media to film patients in facilities where PHI is accessible.
The HIPAA Privacy Rule’s restrictions on PHI disclosures to the media have not been altered by the public health crisis. Under HIPAA, providers may not give the media and/or film crews access to any areas of a facility where patients’ PHI is accessible in any form without first obtaining the consent of every patient whose PHI would be accessible. This requirement may not be satisfied after the media has been allowed access simply by blurring patients’ faces or otherwise masking their identities in the eventual broadcast. “Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it,” warns OCR Director Roger Severino. As a reminder to providers, OCR notes that even with prior authorization from every patient whose PHI will be accessible, the provider must ensure that reasonable safeguards are in place to protect against unauthorized disclosures of PHI.
Allowing the media access without prior authorization from patients can result in substantial liability for providers. Most recently, in 2018, OCR reached separate settlements totaling $999,000 with Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital after the hospitals invited film crews to their facilities to film a documentary without prior authorization from patients. As Severino noted in OCR’s news release regarding these settlements, “[patients] in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments.”
The OCR press release and guidance may be accessed here. For assistance with implementing or reviewing a compliance program to minimize any risks to health information privacy and security, please contact one of the authors. McGuireWoods will continue to monitor additional HHS and OCR developments and guidance related to HIPAA compliance during the COVID-19 public health emergency.
McGuireWoods has published additional thought leadership related to how companies across various industries can address crucial coronavirus-related business and legal issues.