Medical Association of the State of Alabama: Lights, Camera, Action... No!

Articles / Publications

Reprinted with Permission from the Medical Association of the State of Alabama

The Office for Civil Rights ("OCR"), the entity responsible for HIPAA compliance and enforcement, has issued a series of guidance documents regarding the interplay of HIPAA and the COVID-19 pandemic. The most recent guidance serves as a reminder to health care providers to follow the requirements of HIPAA when speaking with the media or allowing filming within the office or facility. This has even greater importance due to the increased amount of media attention on healthcare providers and the facilities treating COVID-19 patients.

The recent guidance reminds health care providers that the HIPAA Privacy Rule is not altered during the COVID-19 public health emergency. HIPAA does not permit a health care provider to give media and film crews access to facilities where patients' protected health information ("PHI") will be accessible without the patients' prior authorization. Even during the current COVID-19 public health emergency, health care providers are still required to obtain a valid HIPAA authorization from each patient whose PHI will be accessible to the media. Consistent with past guidance, OCR reminds providers that masking or obscuring patients' faces or identifying information before broadcasting a recording of a patient is not sufficient. According to the guidance, by way of an example, "a covered hospital may not allow media personnel access to the emergency department where patients are receiving treatment for COVID-19, without first obtaining each patient's authorization for such filming."

We have seen at least two (2) previous OCR investigations regarding inappropriate disclosure of PHI to film crews (in 2016 and 2018), both of which were resolved with corrective action plans and monetary settlements. I would not be surprised if we see additional future OCR enforcement actions in this regard in light of the increased media coverage surrounding COVID-19.

The recent guidance may be found here.

Download PDF

Burr
Jump to Page

Contact Us

About Burr & Forman Cybersecurity & Data Privacy Law

Burr & Forman's experienced team helps clients navigate the complex cybersecurity and data privacy landscape with strategies designed to assess current risks, develop a corrective action plan, implement best practices, and provide immediate and appropriate responses to a cybersecurity breach.

We use cookies to improve your website experience, provide additional security, and remember you when you return to the website. This website does not respond to "Do Not Track" signals. By clicking "Accept," you agree to our use of cookies. To learn more about how we use cookies, please see our Privacy Policy.

Necessary Cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.


Analytical Cookies

Analytical cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.