OCR has reaffirmed its position on television film crews in clinical care areas, issuing substantial fines on three hospitals that OCR says violated HIPAA by disclosing PHI to a broadcast news organization.

In September, OCR announced that three hospitals in the Boston area have agreed to pay a collective $999,000 to settle potential violations of the HIPAA Privacy Rule. (The OCR announcement is available at: https://bit.ly/2pUVq9F.) HHS alleges that the covered entities allowed television crews into patient areas of the hospitals in late 2014 and January 2015 and that PHI was not adequately protected.

This was not the first large penalty related to allowing media crews inside hospitals. In April 2016, a New York hospital agreed to pay a $2.2 million penalty and to institute corrective action plan for similar alleged HIPAA violations related to the filming of a television show. (The OCR announcement of that settlement is available at: https://bit.ly/2ylUIqF.)

OCR issued guidance on allowing media crews into patient care areas, specifically stating that patients must provide consent for their images and other PHI to be used before they are recorded in any way.

It is not sufficient to require the media outlet to blur or otherwise disguise the image, or to alter the voices, of patients who did not provide written authorization beforehand. (Read much more about the OCR guidance on this issue at: https://bit.ly/2CvKhUY.)