Compliance

What You Need to Know About the High Cost of 15 Minutes of Fame, HIPAA Edition

September 24, 2018

Andy Warhol famously said, “in the future, everyone will be world-famous for 15 minutes.”

Well, a little bit more than 15 minutes of fame, television style, just cost three Boston area hospitals, Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital, a collective $999,000.

I Wanna Be on TV!

The $999,000, paid $100,000 by Boston Medical Center, $384,000 by Brigham and Women’s, and $515,000 by Massachusetts General, was required to settle charges brought by the U.S. Department of Health and Human Services, Office for Civil Rights that the hospitals compromised the privacy of patients’ protected health information (PHI) by inviting film crews on premises to film an ABC television network documentary series, without first obtaining authorization from patients.

Ah, the high cost of fame.

And to think, the administrators of those facilities could’ve avoided the mess if they themselves watched television news: In 2016, New York City’s New York-Presbyterian Hospital settled with OCR in connection with HIPAA violations related to the hospital’s “appearance” on ABC television’s “NY Med.” And that’s not fake news!

Lights, Action, HIPAA Violation!

Okay, I know you’re smarter than these geniuses. But it still pays to heed HIPAA requirements when allowing film crews and televised media onto your premises, whether it’s a hospital, ASC, or physicians’ office.

As the director of the Office of Civil Rights said when announcing the recent $999,000 settlement, “Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments. Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.”

The same rules apply to you.

HHS has very specific guidance for facilities and physicians in connection with media access on your premises. Other than in some very limited circumstances, among other things, HIPAA-compliant authorizations are required from all affected patients, blurring out faces and disguising voices is completely ineffectual in preventing disclosure of PHI, and reasonable safeguards must be in place to protect against impermissible disclosures or to limit incidental disclosures of other PHI that may be in the area even if authorizations are obtained.

Hey, we all like publicity, but “free” publicity that costs you close to $1 million isn’t free, is it?

The bottom line: It pays to understand the limits of HIPAA and the media before you’re on the news . . . for being on the news.



Leave a Reply