COVID-19 Update: Providers beware – OCR reiterates that HIPAA restrictions on disclosures to the media apply during the pandemic

On May 5, 2020, the Office for Civil Rights (OCR) issued additional guidance on HIPAA compliance during the COVID-19 pandemic. OCR affirmed that the restrictions on disclosures of protected health information (PHI) to the media still apply and that providers must obtain a valid HIPAA authorization from each patient whose PHI will be disclosed to the media, including any onsite film crews, before making such disclosures.

Disclosures to the media generally do not fit within any exception to the HIPAA authorization rule. In 2016, OCR issued guidance that providers cannot invite or allow media, including film crews, into treatment or other areas of their facilities where patients’ PHI may be accessible. Prior written authorization is required from each individual who is in the area or whose PHI would otherwise be accessible to the media. The new OCR guidance confirms that the COVID-19 public health emergency does not alter this restriction and also reminds providers that they may not require patients to sign HIPAA authorizations as a condition for receiving treatment.

The latest guidance is not the first time since the pandemic started that the government has cautioned providers about the risk of inappropriate disclosures of PHI to media. The Department of Health and Human Services (HHS) addressed this topic in COVID-19 guidance issued in March. HHS warned that “[i]n general, except in the limited circumstances described elsewhere in this Bulletin, affirmative reporting to the media or the public at large about an identifiable patient, or the disclosure to the public or media of specific information about the treatment of an identifiable patient, such as specific tests, test results or details of a patient’s illness, may not be done without the patient’s written authorization (or the written authorization of a personal representative who is a person legally authorized to make health care decisions for the patient).”

Specific to COVID-19, the new guidance also states that blurring patients’ faces and otherwise masking their identities is not sufficient to permit onsite filming. OCR emphasizes that authorization must be obtained before filming, and it must expressly permit such filming. OCR notes that it would be difficult to sufficiently blur or mask all PHI, as patients receiving treatment are typically surrounded by PHI, and a patient’s presence in an area of a facility dedicated to COVID-19 treatment reveals the patient’s diagnosis. The guidance expressly states that a covered hospital may not allow the media access to its emergency department where patients are receiving treatment for COVID-19 without first obtaining each patient’s authorization for such filming.

Finally, OCR notes that, even when valid authorizations for filming have been obtained, providers must ensure that reasonable safeguards are in place to protect against unauthorized disclosures. Suggested safeguards include installing computer monitor privacy screens and setting up opaque barriers to block the film crew’s access to PHI of patients who did not sign an authorization.

It is important for providers, such as hospitals, to conduct appropriate staff education to ensure adherence to this consistent and repeated guidance on media interactions.