Skip to main content

OCR Issues Guidance on Media Access to Protected Health Information

Analysis  |  By Revenue Cycle Advisor  
   June 02, 2020

OCR noted that it is not sufficient for media to simply blur out faces to mask patient identity in videos.

A version of this article was first published June 2, 2020, by HCPro's Revenue Cycle Advisor, a sibling publication to HealthLeaders.

The Office for Civil Rights (OCR) in May issued guidance regarding the HIPAA Privacy Rule and media coverage throughout the COVID-19 pandemic.

The guidance served as a reminder to healthcare organizations that the current circumstances do not invalidate basic aspects of the HIPAA Privacy Rule. Media outlets may desire video footage in and around hospitals that are treating COVID-19 patients, but there are strict guidelines that must be followed. OCR noted that it is not sufficient for media to simply blur out faces to mask patient identity in videos.

The HIPAA Privacy Rule does not permit a covered entity (CE) to give the media access to protected health information (PHI) unless it obtains a valid HIPAA authorization from the patient before such access is granted.

Related: Ohio Business Associate Experiences Email Hack, Exposes PHI of 30K Individuals

As OCR pointed out, masking a patient’s identity in B-roll footage does not necessarily ensure that PHI will not be captured on camera. Patients are typically surrounded by PHI—such as their names, medical record numbers, notes that include conditions or medications, and real-time displays of heart or lung function—when they are receiving treatment.

For a CE to allow media to film patients in areas of the facility where PHI will be accessible, every patient who is or will be in the area must first sign a valid HIPAA authorization.

Even then, according to OCR, CEs must ensure that reasonable safeguards are in place. This could include putting up barriers to block the film crew from accessing patients who did not sign a valid HIPAA authorization, as well as blocking computer screens so that the film crew does not capture any PHI that may be viewable on the screen.

Related: Epic Uproar Exposes Conflict Between Data Privacy and Innovation

Revenue Cycle Advisor combines all of HCPro's Medicare regulatory and reimbursement resources into one handy and easy-to-access portal. News is not just repeated from other sources. It is analyzed by our Medicare experts so professionals can comprehend any new rule and regulatory updates thoroughly. Learn more.


Get the latest on healthcare leadership in your inbox.