Hospitals pay nearly $1 million over ABC television documentary

After allegations that the privacy of patients was compromised by inviting film crews for an ABC television documentary series without first obtaining authorization, three hospitals in Boston have agreed to pay nearly $1 million to settle potential violations. The HHS Office for Civil Rights (OCR) has reached separate settlements with Massachusetts General Hospital (MGH), Brigham and Women’s Hospital (BWH), and Boston Medical Center (BMC) for compromising the privacy of patients’ protected health information (PHI) by inviting film crews for an ABC television network documentary series, without first obtaining authorization from patients. Collectively, the three entities paid OCR $999,000 to settle potential violations of the HIPAA Privacy Rule. HHS has also provided specific guidance about the Health Insurance Portability and Accountability Act (P.L. 104-191) and media coverage, including direction that blurring or pixilation is insufficient to protect patient privacy (Resolution Agreement, August 3, 2018; Resolution Agreement, September 6, 2018; Resolution Agreement, September 6, 2018).

Settlements 

To resolve potential HIPAA violations, MCH agreed to pay $515,000, BWH agreed to pay $384,000, and BMC agreed to pay $100,000. Each entity also agreed to provide workforce training as part of a corrective action plan that will include OCR’s guidance on disclosures to film and media. HHS initiated the investigation of BWH based on information in a Boston Globe newspaper article that indicated BWH permitted ABC News to film a medical documentary program at BWH. HHS also initiated of an investigation of MGH based on a news story posted to MGH’s website indicating that ABC News would be filming a medical documentary program at MCH.

This is the second HIPAA case involving an ABC medical documentary television series. In 2016, New York-Presbyterian Hospital entered into a settlement in association with the filming of “NY Med.” “Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments,” said Roger Severino, OCR director. “Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.”

Guidance on media coverage

HHS reaffirmed that health care providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible. This includes any written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media. It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients. Using techniques such as blurring, pixelation, or voice alteration software for whom an authorization was not obtained is insufficient.

Only in very limited circumstances does the HIPAA Privacy Rule permit health care providers to disclose protected health information to members of the media without a prior authorization signed by the individual. For example, a covered entity may seek to have the media help identify or locate the family of an unidentified and incapacitated patient in its care. The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility. A health care provider may also utilize the services of a contract film crew to produce training videos or public relations materials on the provider’s behalf if certain protections are in place.