Lights, camera, HIPAA! HHS announces settlement related to “Boston Med”

On September 20, 2018, the U.S. Department of Health and Human Services (HHS) announced that it reached settlements with three hospitals for compromising the privacy of patients’ protected health information (PHI) by permitting film crews to film the television show “Boston Med” on their premises without first obtaining patient authorization. Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital (MGH) reached separate settlements with HHS totaling $999,000.

HHS learned that the hospitals permitted ABC News to film “Boston Med” on their premises from a Boston Globe article and a post on the MGH website. The Resolution Agreements entered into by HHS and the hospitals indicate that, while the hospitals did implement some protections regarding patient privacy related to the filming, they impermissibly disclosed PHI of patients to the film crew during production and filming of the program. 

There are at least two important lessons for all covered entities in this settlement. First, covered entities must be extremely cautious when permitting filming on their premises. Whether the video is being recorded by a third party film crew or the covered entity’s own marketing team (e.g., for the organization’s website), authorizations must be obtained from all patients who may appear in the video, even if they are only visible in the background. Second, this settlement is notable in that HHS cited the impermissible disclosure of PHI to the film crew itself, rather than to the public while watching the program. This highlights the importance of obtaining authorization before a film crew encounters a patient rather than after filming occurs.