Healthcare providers cannot invite or arrange for members of the media, including film crews, to enter treatment areas of their facilities without prior written authorization from patients whose protected health information (PHI) may be accessible or disclosed during filming.
HIPAA guidelines on media access
The HIPAA Privacy Rule prohibits healthcare providers from allowing media personnel into treatment areas where patients’ PHI may be accessible, whether in written, electronic, oral, or visual forms, without prior written authorization. The US Department of Health and Human Services (HHS) states: “Healthcare providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible…without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media.” The guideline demonstrates that written authorization is required and makes it clear that other measures, such as anonymization techniques (e.g., blurring faces or altering voices), are insufficient.
Limited exceptions
There are a few situations where PHI may be shared with the media without explicit authorization. For example:
- Identifying incapacitated patients: If a patient is unidentified and incapacitated, healthcare providers may disclose limited PHI to the media to locate their family, provided it is in the patient’s best interest.
- Facility directory information: Providers may confirm a patient’s location and general condition—without specific medical details—if the individual has not objected to being included in the facility directory, and the media asks for the patient by name.
These exceptions are rare and must align with the provider’s professional judgment.
Ethical and legal obligations
The HHS emphasizes the importance of balancing transparency with privacy, stating that “covered entities can continue to inform the media of their treatment services and programs…provided that, in doing so, the covered entity does not share PHI with the media without the prior authorization of the individuals who are the subject of the PHI.”
See also: HIPAA Compliant Email: The Definitive Guide
How to manage media requests responsibly
If healthcare providers wish to accommodate media in their facilities, they must follow these critical steps:
- Obtain written authorization: Before any filming occurs, ensure all patients whose PHI might be exposed sign a HIPAA compliant authorization form.
- Restrict access: Media personnel should not be allowed in areas where incidental exposure to PHI is likely without proper safeguards.
- Train staff: Ensure all employees understand HIPAA rules and the importance of protecting patient privacy, particularly when interacting with media.
- Supervise media activity: Appoint a compliance officer or staff member to monitor media interactions to ensure adherence to privacy protocols.
- Consider alternatives: Use staged scenarios with actors or obtain permission from discharged patients for post-treatment interviews in non-clinical settings.
FAQs
Is verbal consent from patients enough to permit media access?
No. HIPAA requires written authorization from each patient whose PHI might be accessible. Verbal consent or promises to obscure patient identities (e.g., blurring faces) are insufficient.
Can media access public areas of a healthcare facility?
Yes. Media can access areas that are generally open to the public, such as waiting rooms or entrances. However, providers must still safeguard against incidental PHI disclosures in these areas.
What are the consequences of allowing unauthorized media access to treatment areas?
Violations of HIPAA can result in:
- Fines ranging from $147 to $71,162 per violation.
- Lawsuits from affected patients.
- Reputational damage and loss of public trust.
- Potential loss of federal funding for persistent non-compliance.
Tshedimoso Makhene
