HHS-OCR Issues Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities

On May 5, HHS’ Office of Civil Rights (“OCR”) issued guidance on covered healthcare providers and restrictions on media access to Protected Health Information (“PHI”) about individuals in their facilities. 

In its guidance, OCR reminded healthcare providers that, under the HIPAA Privacy Rule, they are not permitted to give the media or film crews access to facilities where patients’ PHI will be accessible without the patients’ prior authorization.

OCR made it clear that this restriction remains intact even during the COVID-19 pandemic and that providers ae required “to obtain a valid HIPAA authorization from each patient whose PHI will be accessible to the media before the media is given access to that PHI” (emphasis in original). The guidance also clarifies that “masking or obscuring patients’ faces or identifying information before broadcasting a recording of a patient is not sufficient.”

According to OCR Director Roger Severino, [t]he last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll. Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it.”

The full version of OCR’s guidance can be found here.

The attorneys at Chilivis Grubman represent healthcare clients of all types and sizes in connection with HIPAA and cyber security matters, including investigations and audits by HHS-OCR.  If you need assistance with such a matter, please contact us today.