Health Information Compliance Alert

Your media-related policies should focus on protecting patient privacy.

Reality television shows may be exceptionally popular these days, but the HHS Office for Civil Rights (OCR) isn’t a fan — especially when film crews have access to patients’ protected health information (PHI).

Case in point: OCR slapped New York Presbyterian Hospital (NYP) with a $2.2 million fine for allowing a film crew “virtually unfettered” access to its facility for the reality television show “NY Med,” according to an April 21 announcement. In addition to the hefty payout, the settlement agreement includes a corrective action plan that requires NYP to undergo two years of monitoring by OCR.

More specifically, NYP allowed the ABC show’s crew to film two patients (one who was dying and another who was in significant distress) without prior authorization and even after a medical professional urged the crew to stop filming. Academic medical centers like NYP “tend to be out of control because of their complexity in responsibility and governance, but this takes the cake,” laments Jim Sheldon-Dean, founder and director of compliance services for Lewis Creek Systems LLC.

“This case sends an important message that OCR will not permit covered entities to compromise their patients’ privacy by allowing news or television crews to film the patients without their authorization,” OCR Director Jocelyn Samuels said in the announcement. “We take seriously all complaints filed by individuals, and will seek the necessary remedies to ensure that patients’ privacy is fully protected.”

Frank Sivilli of the Compliancy Group based in Greenlawn, N.Y. points to the following instruction from HHS as a key takeaway from this case:

“Healthcare providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media.”

Lesson learned: So any policies that you have in place regarding media releases should be primarily concerned with protecting the privacy and identity of your patients, Sivilli says.

Resources: You can read the Resolution Agreement at www.hhs.gov/sites/default/files/NYP NYMed RACAP April 2016 (508)_0.pdf. HHS also posted an FAQ on media access to PHI at www.hhs.gov/hipaa/for-professionals/faq/2023/film-and-media/index.html.