The HHS’ Office for Civil Rights (OCR) published guidance to point out to healthcare organizations that with the HIPAA Privacy Rule, the media and film staff aren’t permitted access to healthcare amenities where the protected health information (PHI) of patients is accessible except if the involved patients have given written permission beforehand. A public health emergency doesn’t adjust the demands of the HIPAA Privacy Rule, which stays in force in emergency scenarios.
In 2018, Brigham and Women’s Hospital, Boston Medical Center, and Massachusetts General Hospital were subjected to enforcement actions by OCR after learning they had granted film staff access to their amenities without getting patient consent first. They settled a penalty of $999,000 for violating the HIPAA Rule.
OCR has given Notices of Enforcement Discretion for the period of the coronavirus crisis and won’t enforce sanctions and penalties on HIPAA-covered entities for particular HIPAA Law violations. Fines may and will be required on covered entities for violating HIPAA Rules not included in the Notices of Enforcement Discretion, for instance, unapproved disclosures to the press.
In the newest guidance, OCR makes clear that PHI consists of written, verbal, digital, and other visual and audio formats of medical data which ought to be secured against illegal use and disclosure. In all circumstances, which include giving film crews access to the healthcare facilities, HIPAA permissions need to be acquired from patients beforehand. It’s not allowable for film crews to merely cover up the identities of patients in the video clip, including blurring faces prior to showing the video.
The HIPAA Privacy Rule doesn’t stop film crews from stepping into medical establishments. As long as there are HIPAA permissions acquired first from all people who are in or are likely to be in the locations accessed by the media staff, filming is granted. Nonetheless, in such circumstances, reasonable safety measures should still be used to secure against inappropriate disclosures of PHI, which include measures like privacy screens on computer monitors to avert seeing electronic PHI. Screens need to also be utilized to make certain patients who haven’t signed HIPAA permissions aren’t recorded.