Reprinted with Permission from the Medical Association of the State of Alabama

The Office for Civil Rights ("OCR"), the entity responsible for HIPAA compliance and enforcement, has issued a series of guidance documents regarding the interplay of HIPAA and the COVID-19 pandemic. The most recent guidance serves as a reminder to health care providers to follow the requirements of HIPAA when speaking with the media or allowing filming within the office or facility. This has even greater importance due to the increased amount of media attention on healthcare providers and the facilities treating COVID-19 patients.

The recent guidance reminds health care providers that the HIPAA Privacy Rule is not altered during the COVID-19 public health emergency. HIPAA does not permit a health care provider to give media and film crews access to facilities where patients' protected health information ("PHI") will be accessible without the patients' prior authorization. Even during the current COVID-19 public health emergency, health care providers are still required to obtain a valid HIPAA authorization from each patient whose PHI will be accessible to the media. Consistent with past guidance, OCR reminds providers that masking or obscuring patients' faces or identifying information before broadcasting a recording of a patient is not sufficient. According to the guidance, by way of an example, "a covered hospital may not allow media personnel access to the emergency department where patients are receiving treatment for COVID-19, without first obtaining each patient's authorization for such filming."

We have seen at least two (2) previous OCR investigations regarding inappropriate disclosure of PHI to film crews (in 2016 and 2018), both of which were resolved with corrective action plans and monetary settlements. I would not be surprised if we see additional future OCR enforcement actions in this regard in light of the increased media coverage surrounding COVID-19.

The recent guidance may be found here.

Download PDF