Given the widespread media coverage of the COVID-19 public health emergency, on May 5, 2020, the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) issued guidance in the form of an FAQ reminding healthcare providers of the restrictions on disclosures of protected health information (“PHI”) to the media under the HIPAA Privacy Rule.
First, OCR emphasizes that the COVID-19 public health emergency does not alter the HIPAA Privacy Rule's existing restrictions on disclosures of PHI to the media. The guidance specifically stresses that the HIPAA Privacy Rule requires covered healthcare providers to obtain a written HIPAA authorization from each patient whose PHI would be accessible to the media (e.g, film crews) before permitting the media to access any areas of their facilities where PHI would be accessible in any form. Furthermore, covered healthcare providers are prohibited from requiring a patient to sign a HIPAA authorization as a condition of receiving treatment.
Second, OCR clarifies that covered healthcare providers are still required to obtain prior written authorization from a patient before allowing the media access to areas where patients' PHI is accessible, even if the media masks the patients' identities when airing recorded video (e.g., through blurring faces or voice alteration). In the guidance, OCR reminds healthcare providers that it successfully resolved investigations of covered hospitals' unauthorized disclosures of patients' PHI to television film crews in 2016 and 2018 and that all of these cases resulted in corrective action plans and monetary settlements.
Third, OCR reiterates that, even in the event a patient signs a valid HIPAA authorization, covered healthcare providers must still implement reasonable safeguards to protect against unauthorized disclosures of PHI. Such reasonable safeguards may include the installation of computer monitor privacy screens and setting up opaque barriers to block the film crew's access to the PHI of patients who did not sign a HIPAA authorization.
Originally published Shipman & Goodwin, May 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
