HIPAA Compliance Failures Make for Bad Television
In response to the increased media presence in hospitals, the Department of Health and Human Services (“HHS”) issued guidance this week reminding health care providers that the COVID-19 outbreak does not change HIPAA’s privacy rules with respect to giving the media access to treatment areas. The guidance reinforces and amplifies existing HHS guidance by providing examples of its application to the COVID-19 public health emergency. A patient receiving treatment in a health care facility is typically surrounded by protected health information (“PHI”), which includes health information in any form or medium (e.g., oral communications, life function monitors, charts, etc.). HHS’s guidance provides several examples of PHI in treatment areas, including how the mere presence of a patient in the area of a health care facility dedicated to treating a specific disease, such as COVID-19, reveals the patient’s diagnosis. As such, members of the media entering a health care facility’s treatment areas immediately have access to PHI they can see, hear and record. HIPAA’s privacy rules do not permit health care providers to give members of the media access to any areas of their facilities where patients’ PHI will be accessible without first obtaining written authorization from each patient:
- who is or will be present in the area, or
- whose PHI will be accessible to the media.