Small Health Care Provider Fails to Implement Multiple HIPAA Security Rule Requirements
This is an HHS Press Release announcing resolution of case with Metropolitan Community Health Services (Metro), doing business as Agape Health Services.
Issued by: Office for Civil Rights (OCR)
Issue Date: May 05, 2020
FOR IMMEDIATE RELEASE
May 5, 2020
OCR Issues Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities
Today, the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) issued additional guidance reminding covered health care providers that the HIPAA Privacy Rule does not permit them to give media and film crews access to facilities where patients’ protected health information (PHI) will be accessible without the patients’ prior authorization.
The guidance explains that even during the current COVID-19 public health emergency, covered health care providers are still required to obtain a valid HIPAA authorization from each patient whose PHI will be accessible to the media before the media is given access to that PHI. The guidance clarifies that masking or obscuring patients’ faces or identifying information before broadcasting a recording of a patient is not sufficient, as a valid HIPAA authorization is still required before giving the media such access. Additionally, the guidance describes reasonable safeguards that should be used to protect the privacy of patients whenever the media is granted access to facilities.
“The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll,’” said Roger Severino, OCR Director. “Hospitals and health care providers must get authorization from patients before giving the media access to their medical information; obscuring faces after the fact just doesn’t cut it,” Severino added.
The guidance may be found at https://www.hhs.gov/sites/default/files/guidance-on-media-and-film-crews-access-to-phi.pdf.
For more information related to HIPAA and COVID-19, please visit: https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html.
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the email@example.com.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.