By Helen Oscislawski, JD
As healthcare workers across the nation care for patients afflicted with COVID-19, many may feel compelled to share their agonizing experiences and stories with the public.
One such recent example comes out of Lincoln Hospital in the Bronx neighborhood of New York where, according to a story published by The Intercept, an emergency room nurse is being investigated by her employer for allegedly sharing video footage that documents the personal experiences of several of her coworkers who treat COVID-19 patients every day. A review of the video, which was posted by The Intercept—and, as of the post date of this article, remains online—does not at first glance seem to reveal the identity or personally identifiable health information of any patient. However, in one segment the emergency nurse’s coworker refers to a person by name who is allegedly a patient which, according to The Intercept, the hospital is alleging might violate HIPAA.
The Lincoln Hospital incident is not an isolated case, however. As the COVID-19 pandemic rages on, an increasing number of organizations and individuals have been speaking to media outlets and, in some cases, inviting them into their facilities to cover and report on these unprecedented events. In fact, so many such cases were popping up that the Office for Civil Rights (OCR) was recently compelled to step in and remind covered entity healthcare providers that reporters and media outlets are essentially “third parties,” which have no legal right to gain access to identifiable patients and/or their health information without such patient’s affirmative written authorization in advance.
Specifically, on May 5 OCR posted a guidance document reviewing the boundaries on healthcare providers’ interactions with the media, and reiterated that HIPAA prohibits the release of any identifiable health information to such third parties without the advance written authorization of every single patient who might be impacted. Although some believe that getting patients’ COVID-19 stories out serves a critical public interest—and would be in the interest of all patients—OCR Director Roger Severino has a different viewpoint.
In OCR’s press release on the topic, Severino states: “The last thing hospital patients need to worry about during the COVID-19 crisis is a film crew walking around their bed shooting ‘B-roll.’”
One of the arguments from the Lincoln Hospital nurse and another of her colleagues is that a story about the specific patient named in the video was already the subject of other news stories, and the patient’s name and the fact that the patient had died was already “public” information. However, in a June 2013 Resolution Agreement reached with Shasta Regional Medical Center (Shasta), OCR required the CEO and privacy officer for each facility affiliated with Shasta to sign and submit to OCR an affidavit stating that they each:
“understand that (a) an individual’s protected health information (“PHI”) is protected by [sic] Privacy Rule even if such information is already in the public domain or even though it has been disclosed by the individual . . .” (See pg 12 of the Settlement Agreement).
Specifically in the Shasta case, two senior leaders shared detailed patient information with multiple media outlets without the patient’s authorization because they erroneously believed that since the patient had already released personally identifiable health information to a news outlet that ran a story about her allegations of Medicare fraud, such information was in “public domain” and no longer protected by HIPAA.
However, OCR disagreed and the mistake resulted in Shasta having to pay a $275,000 monetary settlement. Therefore, the Lincoln Hospital nurse and her colleague are incorrect in their assumptions that public information negates a healthcare provider’s duty under HIPAA to keep a patient’s information private unless a prior written authorization is obtained from the patient, or in the case where the patient is deceased, from the patient’s legal representative (e.g., the executor).
Several other hospitals have learned the “no-media-allowed-under-HIPAA” lesson the hard way. In 2016, New York Presbyterian Hospital was hit with a $2.2 million-dollar settlement with OCR for allowing film crews into their emergency room to film for a reality television program called NY Med. Even though the identities and names were often blurred out or obscured in an attempt to protect the privacy of patients, according to certain accounts, a widow who was watching the program from her home claimed she suffered emotional distress after she recognized footage in which her husband was experiencing a medical emergency at the hospital from which he ultimately died.
Unfortunately, the HIPAA lesson New York Presbyterian Hospital learned did not reach others. In September 2018, three separate hospitals in Massachusetts were forced to enter into HIPAA settlements with OCR totaling $999,000 for inviting film crews on premises to film an ABC television network documentary series. In connection with those settlements, the OCR director pointed out again, “[p]atients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments.”
Despite HIPAA’s restrictions, healthcare providers still have options that would allow media to cover newsworthy stories involving patients, such as with COVID-19. First, with permission from the hospital, nursing home, or other private provider facility, media may be allowed to enter any portion of a facility that is equally accessible to the public at large. This might include any waiting room, lobby, parking lot, and even emergency entrance area. Second, a provider can seek to obtain the prior written authorization of the patient. Where a reporter wishes to speak to just one patient, and such patient agrees to sign a HIPAA authorization in advance, then the patient could temporarily be cordoned off from other patients so that the reporter would only have access to the patient who has affirmatively agreed to the interview.
If a media crew desires general access to a treatment area such as the emergency room, then the hospital could attempt to obtain the signed written HIPAA authorization from every patient who would be present in such treatment area during the filming. With this option, healthcare providers will need to bear in mind that HIPAA would prohibit their conditioning treatment on patients signing such an authorization. Additionally, as new patients enter the same treatment area they would have to be asked to grant authorization for the media crew to be permitted to view or access any of their identifiable health information, or otherwise reasonable safeguards must be installed to prevent the on-site media from having access to such declining patient.
Finally, HIPAA does not prohibit reporters and the media from having access to healthcare workers, so long as such workers do not reveal any identifying patient information during any such interview or filming. HIPAA would not prohibit healthcare workers from telling their COVID-19 stories, provided the employer’s policies are followed. Therefore, there are options that allow a better balance between patients’ privacy needs and the public’s interest in obtaining newsworthy information about COVID-19. Neither one should be carelessly abrogated in the sole interest of the other.
Helen Oscislawski (firstname.lastname@example.org) is a corporate and regulatory attorney whose practice for over the last 20 years has focused almost exclusively on advising and representing clients in the health care industry. She is the founding member of Attorneys at Oscislawski LLC.