Healthcare organizations and media professionals must work together to balance the public interest in healthcare storytelling with the right to patient privacy.
The Health Insurance Portability and Accountability Act (HIPAA) sets strict standards for protecting patient health information. When it comes to filming in healthcare settings, HIPAA's Privacy Rule is important. This federal law safeguards individually identifiable health information, including visual recordings that may reveal:
Healthcare facilities must provide explicit permission for any filming on their premises. This typically involves:
Written consent from patients is mandatory before filming can include them. This authorization must:
An HHS FAQ on PHI disclosures to film and media notes, “It is not sufficient for a health care provider to request or require media personnel to mask the identities of patients (using techniques such as blurring, pixelation, or voice alteration software) for whom an authorization was not obtained, because the [Health Insurance Portability and Accountability Act] Privacy Rule does not allow media access to the patients’ PHI, absent an authorization, in the first place.”
Educational filming in healthcare settings has broader permissions under HIPAA when used for training medical professionals, students, or staff. Distinctions include:
According to a resource titled HIPAA Guidance on Photos, Video and Audio Recording in Clinical Areas published on the Yale University website, “Prior consent is recommended for recordings taken for either internal student/staff training or external presentations (such as at conferences, academic presentations, etc.), even if those recordings do not identify the patient or contain PHI (e.g., skin rash on the arm). Recordings of a patient that identify the patient or contain PHI require HIPAA authorization or de-identification before they can be used for academic purposes (such as at conferences, academic presentations, etc.) or for training of individuals not part of the institution’s workforce.”
Commercial filming has more strict requirements:
The Association of Healthcare Journalists states that, “The Health Insurance Portability and Accountability Act includes privacy protections for patients that can be misunderstood and misapplied by health officials and health care organizations. In some instances, HIPAA has been improperly used to deny reporters’ requests for interviews with patients and clinicians or to obtain medical information. Reporters should be familiar with the law in order to understand when and to whom it applies.”
News organizations operate under different legal frameworks when covering healthcare stories:
Documentary and entertainment productions face more restrictions:
Several court cases have shaped these distinctions:
Crews must carefully select dedicated locations that minimize patient exposure, avoiding high-traffic areas like waiting rooms where accidental recording could occur. Clear physical boundaries and visible signage help prevent unintended patient documentation.
Technical safeguards are equally crucial in protecting patient confidentiality. All recorded footage demands secure storage with robust encryption for digital files. Comprehensive logging systems and clear protocols for footage review and deletion ensure that sensitive information remains protected throughout the production process.
Every team member must undergo thorough HIPAA training, with a dedicated compliance officer monitoring filming activities. Identification badges are mandatory, and rigorous screening of both personnel and equipment helps prevent potential privacy breaches.
According to the Department of Health and Human Services, “The HIPAA Privacy Rule does not require health care providers to prevent members of the media from entering areas of their facilities that are otherwise generally accessible to the public, which may include public waiting areas or areas where the public enters or exits the facility.”
Furthermore, “If patients are to be identified by the provider and interviewed by a film crew, or if PHI might be accessible during filming or otherwise disclosed, the provider must enter into a HIPAA business associate agreement with the film crew acting as a business associate. Among other requirements, the business associate agreement must ensure that the film crew will safeguard the PHI it obtains, only use or disclose the PHI for the purposes provided in the agreement, and return or destroy any PHI after the work for the health care provider has been completed. See 45 C.F.R. 164.504(e)(2). As a business associate, the film crew must comply with the HIPAA Security Rule and a number of provisions in the Privacy Rule, including the Rule’s restrictions on the use and disclosure of PHI. In addition, authorizations from patients whose PHI is included in any materials would be required before such materials are posted online, printed in brochures for the public, or otherwise publicly disseminated.”
When healthcare filming crosses international borders, compliance becomes more complex:
Incidental disclosure represents a risk in healthcare filming. Even background footage can violate HIPAA privacy protections by capturing sensitive patient information. This includes details like patient names visible on charts or doors, computer screens displaying health information, overheard conversations about patient care, or medical records and prescriptions within camera range. Such incidental captures can quickly transform a well-intentioned filming project into a serious privacy breach.
In 2016, New York-Presbyterian Hospital (NYP) faced penalties for allowing a television film crew to record footage within its facilities without obtaining prior authorization from patients. This filming was intended for the ABC series "NY Med." The Office for Civil Rights (OCR) investigated the incident and found that the hospital had compromised patients' privacy rights, leading to a substantial settlement.
The OCR identified several issues in NYP's approach:
As a result of these violations, NYP agreed to a settlement that included:
This case shows the importance of adhering to HIPAA regulations during any media-related activities within healthcare settings. Key takeaways include:
According to the HHS, media can enter public areas generally accessible to the public, like waiting rooms or entry/exit areas. However, accessing patient care areas or recording patients requires explicit authorization and patient consent.
Incidental capture of patient health information (PHI) can constitute a HIPAA violation. Even background details like names on charts, computer screens, or overheard conversations can breach patient privacy.
Yes. If patient identification or PHI might be disclosed, healthcare providers must establish a HIPAA business associate agreement with the film crew.
Yes, as long as they are used for legitimate security purposes and do not improperly disclose patient health information.
Yes, but only when necessary for treatment or operations and in compliance with HIPAA's minimum necessary rule.