OCR Issues Guidance in relation to Filming and Access to Healthcare Facilities

The HHS’ Office for Civil Rights (OCR) has released a directive for healthcare providers to follow which states that the HIPAA Privacy Rule does not permit the media and film crews to access healthcare facilities where patients’ protected health information is accessible.

There is an exception if written authorization is in place from any patients concerned  prior to filming. A public health emergency, such as the COVID-19 Pandemic, does not alter the requirements of the HIPAA Privacy Rule.

OCR has issued Notices of Enforcement Discretion during the COVID-19 crisis and will not be imposing sanctions and financial penalties on HIPAA-covered entities for a number of specific violations of HIPAA Rules. Financial sanctions can and will be imposed on covered entities for breaches of HIPAA Rules not included in the Notices of Enforcement Discretion, such as unauthorized sharing to the press.

In the recently-released guidance, OCR says that protected health information includes written, electronic, oral, and other visual and audio forms of health information which must be secured from  unauthorized access and disclosure. In all cases, HIPAA authorizations must be obtained from patients earlier, before the film crews are allowed access to the facilities. It is not allowable for film crews to simply disguise the identities of patients in video footage, such as blurring out people before broadcast.

The HIPAA Privacy Rule does not forbid film crews from entering healthcare facilities. Once HIPAA authorizations have been obtained prior to this from all patients who are in or will be in the areas where film crews are operating, filming is permitted. However, in such cases, reasonable safeguards must still be put in place to protect against unauthorized sharing of PHI, including measures such as privacy screens on computer monitors to stop electronic PHI from being viewed. Screens must also be put in place to ensure patients who have not signed HIPAA authorizations are not recorded.

Roger Severino, OCR Director said: “The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll,’” said  “Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”