Last week, a Texas health system agreed to a $2,400,000 HIPAA settlement arising out of a hospital's disclosure of a patient's name in a press release. (See here). Last year, a New York hospital agreed to pay $2,200,000 for allowing media to film in its facilities. (See here ). Given these cases, it is a good time to review the HIPAA rules on disclosures to the media.

Protected Health Information. HIPAA applies to a patient's protected health information ("PHI"), which includes any individually identifiable information concerning a patient's health, healthcare or payment for their care. (45 CFR § 160.103). It includes the patient's name or any other identifiable information even if additional details of treatment are not included. A provider may not avoid HIPAA by simply omitting the name; PHI includes any information "[w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual". (Id.). Accordingly, details about an individual that would allow others to identify the individual are considered PHI even if the usual identifiers are omitted. PHI remains protected by HIPAA even if the information is widely known in the community or the patient has disclosed the information himself or herself.

Disclosures to Media. HIPAA generally prohibits healthcare providers from disclosing a patient's protected health information to media unless either (i) the patient or their personal representative authorizes the disclosure, or (ii) the disclosure fits within a HIPAA exception. (45 CFR § 164.502).

1. Authorization. When seeking to disclose information to the media, the safest course is to obtain the patient's or their personal representative's written authorization to make the disclosure. Providers should ensure that the authorization clearly covers the information that will be disclosed, describes the purpose of the disclosure, and identifies the persons or entity permitted to make and receive the disclosure. (45 CFR § 164.508). In addition to obtaining a HIPAA authorization, the provider may want to obtain a separate media release.

2. Response to Media Inquiries. HIPAA's "facility directory" exception is often used to justify disclosures to news media, but it is very limited in scope. Under this exception, a provider may disclose certain limited information "for directory purposes", i.e., to notify persons who inquire about the patient of the patient's general condition and location in the facility. (45 CFR § 164.510(a)). To make the disclosure, the following standards must be met:

1. Disclosure is Consistent with Patient's Wishes. The exception will only apply if either (i) the patient or personal representative "is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure" for directory purposes, or (ii) "[i]f the opportunity to object … cannot practicably be provided because of the individual's capacity or an emergency treatment circumstance," the provider concludes that the disclosure is "consistent with the prior expressed preference of the individual, if any" and the disclosure is "[i]n the individual's best interest…." (45 CFR § 164.510(a)). The provider's Notice of Privacy Practices likely contains a provision that notifies the patient that disclosures may be made for facility purposes unless the patient objects. For competent patients, the notice arguably provides the required "opportunity to agree to or prohibit" disclosures for facility purposes; however, the OCR has stated:

   The patient must be informed about the information to be included in the directory, and to whom the information may be released, and must have the opportunity to restrict the information or to whom it is disclosed, or opt out of being included in the directory. The patient may be informed, and make his or her preferences known, orally or in writing.

   If the patient objects, the provider may not make the disclosure. If the patient is incompetent, the provider will have to establish both (i) that the disclosure is consistent with the patient's prior expressed preferences and (ii) that the disclosure is in the patient's best interests. That may be difficult to do in the case of media disclosures, and virtually impossible if the provider has never treated the patient before.

2. Ask for Patient by Name. Assuming that disclosure is consistent with the patient's wishes, disclosure for directory purposes may only be made "to persons who ask for the [patient] by name." (45 CFR § 164.510(a)(1)(ii)(B)). Thus, providers may not disclose PHI in response to general media inquiries where media do not identify the patient by name.

3. Disclose Only Limited Information. If the foregoing conditions have been satisfied, the provider may only disclose the limited information set forth below (45 CFR § 164.510(a)(1)(i)):

Undetermined: Patient awaiting physician and assessment.
Good: Vital signs are stable and within normal limits. Patient is conscious and comfortable. Indicators are excellent.
Fair: Vital signs are stable and within normal limits. Patient is conscious but may be uncomfortable. Indicators are favorable.
Serious: Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
Critical: Vital signs are unstable and not within normal limits. Patient may be unconscious. Indicators are unfavorable.
Treated and Released: Patient received treatment but was not admitted.
Treated and Transferred: Received treatment. Transferred to a different facility. (Although a hospital may disclose that a patient was treated and released, it may not release information regarding the date of release or where the patient went upon release without patient authorization.)

1. The patient's name. Of course, the media already has the patient's name because they can only obtain PHI if they asked for the patient by name.

2. The individual's location in the healthcare provider's facility. Providers should not disclose the location in the facility if it would effectively disclose the nature of the patient's treatment, e.g., the psychiatric unit, labor and delivery, or a drug and alcohol treatment facility.

3. The individual's condition described in general terms that does not communicate specific medical information about the individual, e.g., "fair, critical, stable, etc." (65 FR 82521). The American Hospital Association has recommended the following one-word descriptions of a patient's condition.

The OCR has stated, "[t]he fact that a patient has been "treated and released," or that a patient has died, may be released as part of the directory information about the patient's general condition and location in the facility, provided that the other requirements at 45 CFR § 164.510(a) also are followed."

To summarize, the "facility directory" exception may allow limited disclosures to the media, but it is difficult to satisfy all the necessary prerequisites, including patient notice and consent. Moreover, I question whether such disclosures to the media are really for "facility directory purposes"—the reason the exception exists. Finally, the exception does not require disclosures to the media; it merely allows the disclosures if the conditions are satisfied. Out of respect for their patient's privacy, the patient's best interests, and regulatory intent, providers may appropriately decide it is safer not to disclose PHI to the media, or to limit the disclosure, unless the patient or the patient's personal representative expressly consents to such disclosures.

Media Access to or Filming in Treatment Areas. The provider's primary duty is to care for his or her patients. Media access, if not managed in an appropriate way, may impede care along with violating patient privacy, including the privacy of patients who may not be the subject of the media inquiry. Per the OCR's FAQ:

Health care providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients' PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media. Only in very limited circumstances, as set forth below, does the HIPAA Privacy Rule permit health care providers to disclose protected health information to members of the media without a prior authorization signed by the individual….

There are very limited situations in which the HIPAA Privacy Rule permits a covered entity to disclose limited PHI to the media without obtaining a HIPAA authorization. For example, a covered entity may seek to have the media help identify or locate the family of an unidentified and incapacitated patient in its care. In that case, the covered entity may disclose limited PHI about the incapacitated patient to the media if, in the hospital's professional judgment, doing so is in the patient's best interest. See 45 C.F.R. 164.510(b)(1)(ii). In addition, a covered entity may disclose a patient's location in the facility and condition in general terms that do not communicate specific medical information about the individual to any person, including the media, without obtaining a HIPAA authorization where the individual has not objected to his information being included in the facility directory, and the media representative or other person asks for the individual by name. See 45 C.F.R. 164.510(a). The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility.
 

(OCR FAQ at https://www.hhs.gov/hipaa/for-professionals/faq/2023/film-and-media/index.html).

Remember Other Laws. HIPAA preempts less restrictive laws, but providers must comply with more restrictive privacy laws. It may be that state or other federal laws prohibit media disclosures even if HIPAA might allow them. For example, 42 CFR part 2 places stringent privacy requirements on federally assisted drug and alcohol treatment programs. Providers should consider other potentially applicable laws or common law duties before making any disclosure.

In short, when it comes to dealing with the media, it is generally safer to simply explain that federal and state law prohibits your disclosure of health information. If a disclosure is to be made or media access allowed, providers must take extreme caution to comply with the HIPAA rules.