The Office of Civil Rights of the Department of Health and Human Services has announced settlements with three different Boston-area hospitals for allegedly compromising the privacy of protected health information by inviting documentary film crews on premises without first obtaining patient authorization.  The three settlements call for a total of almost $1 million in penalty payments and require each of the hospitals to undertake corrective action.  The corrections are not the same for each hospital and range from workforce education and communication to the establishment of specific procedures, for example,  for deciding when to allow media access and for putting safeguards in place to monitor film crew activity.

HIPAA generally prohibits health care providers from giving media representatives access to patients and patient information without authorization from each affected individual.  Even if media representatives agree to mask the identities of the patients in any program or report, such access would give media personnel themselves an impermissible opportunity to view patients and their information.

HIPAA does not generally bar media members from public waiting areas or prohibit them from obtaining publicly available information, such as information about a patient’s location in a hospital (which may be given out unless the patient objects).  However, additional access or information may be provided only in accordance with patient authorization or in narrow circumstances, such as when it is determined that it will serve a patient’s interests to allow the media to help find the patient’s family.

The recent settlements suggest that the making of the documentary was an isolated incident.  The largest of the financial settlement amounts was $515,000.  Although substantial, this amount is not of the same magnitude as some settlement payments made in the past few years, which have extended into the millions of dollars.  The corrective action requirements largely target interactions with the media, without sweeping extensively into other areas.

Nevertheless, the settlement serves as an alert to health care providers and health plans that the confidentiality of protected health information needs to be a paramount consideration in even the most distracting of circumstances.