Reality television programs addressing a broad array of topics—including shows featuring health care providers furnishing medical services to patients—have permeated many network and cable channel offerings. From 1997 through 2002, TLC aired “Trauma: Life in the ER,” a weekly show featuring cases at different Level One trauma centers and emergency rooms throughout the United States. The show’s production was terminated, in part, because the then-recently-enacted Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) required patients or their representatives to provide authorization for television crews to record the provision of health care services to such patients before such recording could begin. Before HIPAA became effective, the show’s camera crew typically requested patients’ permission after they began taping, due to the emergency nature of the services; if permission was refused, that patient’s case would not be included in the program that aired.1
Recently, the filming of an ABC News medical documentary series resulted in HIPAA enforcement actions against the hospitals involved by the Department of Health and Human Services’ Office for Civil Rights (“OCR”). During the filming of “BostonMed” at Boston Medical Center (“BMC”), Brigham and Women’s Hospital (“BWH”), and Massachusetts General Hospital (“MGH”), OCR found that the hospitals permitted filming to begin before they had obtained all necessary patient authorizations. To resolve these potential HIPAA violations, BMC paid OCR $100,000, BWH paid $384,000, and MGH paid $515,000, and each hospital has entered into a Resolution Agreement and Corrective Action Plan (“CAP”).2
In this case, the hospitals attracted the attention of OCR through stories appearing in different media outlets. A news story was posted to MGH’s website in October 2014 indicating that ABC News would be filming a medical documentary program there. A Boston Globe article in January 2015 indicated that both BMC and BWH had permitted ABC News to film a medical documentary program onsite. Following these published stories, OCR initiated a compliance review at these hospitals to determine whether each had implemented appropriate and sufficient patient privacy protections before the film crews were permitted to begin their work. OCR determined that each hospital impermissibly disclosed the protected health information (“PHI”) of patients to ABC employees during the show’s production and filming. In the MGH and BWH cases, this determination was “based on the timing of when” each hospital had received some written patient authorizations. The BMC CAP requires the hospital to send an e-mail reminding workforce members of the hospital’s policy on filming patients for non-clinical purposes, and the e-mail must include a copy of HHS’s Frequently Asked Question about the circumstances under which film crews may enter treatment areas.3 The nearly identical MGH and BWH CAPs require each hospital to ensure that its written policies and procedures prohibit use or disclosure of PHI for non-clinical uses of photography, video or audio recording without first obtaining a valid authorization from all patients whose PHI may be disclosed in such recording. To assure that proper safeguards are in place, each hospital also must establish a process for evaluating and approving media requests to film in areas of the facilities that are not generally accessible to the public and identify a contact person to respond to such media requests. Finally, the hospitals must distribute these policies to all workforce members and train all workforce members whose job functions involve working with the media.4
Ironically, “BostonMed” is not the first ABC News medical documentary that has resulted in HIPAA enforcement activity. In January 2013, OCR received a complaint against New York and Presbyterian Hospital (“NYP”) alleging that NYP impermissibly disclosed PHI to individuals filming “NY Med” at the hospital in April 2011. After OCR’s investigation, NYP agreed to pay $2,200,000 and enter into a Resolution Agreement and CAP with OCR. There, OCR found that NYP’s impermissible disclosures of two patients’ PHI to the film crew and staff were “egregious;” NYP had permitted the filming of someone who was dying and another patient in “significant distress,” and the crew did not stop filming even when a medical professional urged it to do so.5
Despite the lure of publicity and potential payment from documentary films or reality shows, hospitals and other health care providers must assure that appropriate HIPAA privacy safeguards are in place before permitting film crews into treatment areas. Their failure to do so likely will cost them any profits derived from the filming and make them wish they had avoided the cameras.