HHS settles HIPAA privacy case related to filming at hospitals

The Department of Health and Human Services’ Office for Civil Rights recently announced settlements that serve as a reminder to hospitals about the importance of obtaining patients’ authorization before inviting film crews on premises where filming could potentially disclose patients’ protected health information. Under the settlement agreements, Boston Medical Center, Brigham and Women's Hospital, and Massachusetts General Hospital will pay $100,000, $384,000 and $515,000, respectively, to OCR and provide workforce training as part of a corrective action plan. An HHS FAQ on PHI disclosures to film and media notes, “It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients (using techniques such as blurring, pixelation, or voice alteration software) for whom an authorization was not obtained, because the [Health Insurance Portability and Accountability Act] Privacy Rule does not allow media access to the patients’ PHI, absent an authorization, in the first place.”