The circumstances in which a provider may lawfully disclose a patient's protected health information to the media without the patient's prior approval are quite limited.
Three hospitals in Boston have agreed to pay nearly $1 million total to settle allegations they violated patient privacy rights by allowing TV crews with ABC's "Save My Life: Boston Trauma"* to film patients without first securing their permission.
The separate settlements were announced Thursday by the Health and Human Services Office for Civil Rights (OCR), which enforces the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. OCR Director Roger Severino took the opportunity to remind hospitals of their duty under the law.
"Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments," Severino said in a statement. "Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information."
An OCR fact sheet notes that the circumstances in which a healthcare provider may lawfully disclose a patient's protected health information (PHI) to members of the media without the patient's prior approval are quite limited:
- A provider could, for example, ask the media for help identifying or locating family members of a patient who is either incapacitated or unidentified; or
- If anyone asks about a patient by name, a provider may share the patient's general condition and location within the facility without the patient's prior permission, as long as the patient has not objected.
These limited circumstances, alongside a few others outlined in the law, do not provide for the sort of access granted to documentary crews.
"It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients (using techniques such as blurring, pixelation, or voice alteration software) for whom an authorization was not obtained, because the HIPAA Privacy Rule does not allow media access to the patients' PHI, absent an authorization, in the first place," the OCR fact sheet states.
Boston Medical Center paid $100,000, Brigham and Women's Hospital paid $384,000, and Massachusetts General Hospital paid $515,000 for the filming that took place in late 2014 and early 2015, according to agreements OCR reached with each organization. That's a total of $999,000.
This isn't the first settlement of its kind. In 2016, NewYork-Presbyterian Hospital settled similar allegations for $2.2 million related to the filming of "NY Med," HHS OCR said.
*Correction: Citing incorrect information from HHS, a previous version of this story misstated the title of the ABC series involved in this investigation. The correct ABC series is "Save My Life: Boston Trauma," released in 2015, not "Boston Med," released in 2010. A correction was added to the HHS press release. This story has been corrected accordingly, and the "Boston Med" promotional video that had been embedded in this story has been removed.
Steven Porter is an associate content manager and Strategy editor for HealthLeaders, a Simplify Compliance brand.
KEY TAKEAWAYS
One of the hospitals paid more than half a million dollars for its alleged failure to protect patient information from a TV crew.
Federal officials offered a stern reminder: Don't give media members patient information without patient permission.