July 13, 2020

Volume X, Number 195

July 13, 2020

Subscribe to Latest Legal News and Analysis

July 10, 2020

Subscribe to Latest Legal News and Analysis

OCR Issues Guidance About Media Access to Health Care Facilities

These days, news stations are frequently running stories concerning people being treated for COVID-19, the providers working tirelessly to care for them, and politicians visiting health care facilities for a first-hand look at the crisis. In response to the media interest, the Office for Civil Rights (OCR) issued guidance on May 5, 2020 to healthcare providers answering the question “Does the COVID-19 Public Health Emergency alter the HIPAA Privacy Rule’s restrictions on disclosures of protected health information to the media?” The guidance reminds them “that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities” in which patient health information may be accessible without the patients’ authorization. This includes any areas of the facility where patients’ protected health information (PHI) may be accessible in any form (e.g., written, electronic, oral, or other visual or audio form).

During the coronavirus pandemic, film crews and media representatives have parked themselves outside of hospitals and health care facilities and have shown patients being wheeled into hospitals from ambulances to dramatize the strain on the healthcare system and the number of people affected by the coronavirus. In addition, news reporting and special features have been produced to get an inside look into the pandemic from health care providers’ perspectives.

Health care providers often transport patients with large sheets covering the patients on stretchers so their identity cannot be disclosed, or show a patient on a respirator or in a bed without showing the patient’s face.

The guidance addresses the question “May HIPAA-covered health care providers allow media or film crews to film patients in their facilities where patients’ protected health information will be accessible without the patients’ authorization if the patients’ faces are blurred or their identities are otherwise masked in the video?”

The answer in the guidance is just plain “No.” It reminds healthcare providers that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities where patients’ PHI will be accessible without the patients’ prior authorization. As the guidance points out, patients are typically surrounded by PHI, including such things as their name or medical record number on room doors or identifying bracelets, notes about care written on bulletin boards, and real-time displays of heart or lung function. In addition, a patient’s presence in an area of a facility dedicated to treatment of a specific disease or condition (such as COVID-19) reveals that patient’s diagnosis.

With specific regard to the current COVID-19 public health emergency, the guidance explains that healthcare providers must obtain patients’ consent before the media can be given access to patients’ PHI. Masking or obscuring the patient’s face is insufficient, particularly if the blurring is done after the fact. “Prior, express authorization from the patient is always required.”

The OCR further stated that hospitals “may not allow media personnel access to the emergency department where patients are receiving treatment for COVID-19, without first obtaining each patient’s authorization for such filming.”

According to the guidance, the only time the media or film crew can access any part of the facility where patients’ PHI may be accessible is if “every patient who is or will be in the area, or whose PHI otherwise may be accessible to the media, has first signed a valid HIPAA authorization….Even then, covered health care providers must ensure that reasonable safeguards are in place to protect against unauthorized disclosures of PHI.”

The guidance describes reasonable safeguards that should be used to protect patient privacy whenever the media is granted access to facilities. Such safeguards can include installing computer monitor privacy screens to prevent the film crew from viewing PHI on computers, and use of opaque barriers to block access to the PHI of patients who did not sign an authorization.

Copyright © 2020 Robinson & Cole LLP. All rights reserved.National Law Review, Volume X, Number 128


About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

Jean Tomasco, Robinson Cole Law Firm, Hartford, Labor and Employment, Litigation Law Attorney

Jean Tomasco's practice involves employer counseling and employment litigation, with an emphasis on the Employee Retirement Income Security Act (ERISA) and benefits litigation. She is a member of the firm’s Health + Benefits Litigation Team and its Labor, Employment, Benefits + Immigration Group.

Employee Benefits and Compensation Litigation

Jean has more than two decades of experience handling benefit claims litigation. She represents insurers, managed care organizations, and employers in benefit claims litigation, including retaliatory discharge claims and claims brought against plan fiduciaries. She represents plan administrators and insurers in enforcing plan and policy terms and recovering overpayments. Jean’s extensive experience in this area has led to positive results for her clients, such as her successful defense of a financial institution against a claim by its pension plan participants for additional retirement benefits.