High drama drives popular reality TV shows. Whether it’s a bachelor, a real housewife, a designer on the runway or an emergency medical tech, the camera brings us drama we don’t see every day.
Catching people off guard having conversations that are normally private creates awkward moments and embarrassment, and it’s hard not to watch. In medicine, the drama might be extreme, because lives are at stake and decisions are split second. But in the medical field, there’s another problem. Protecting patient privacy is essential for the trust required between doctors and patients, and HIPAA is a federal law that requires protection of privacy.
A health care provider who invites the media or a film crew into an area where patients are treated without patients’ prior written authorization violates HIPAA even if the TV show never airs publicly. Patients have the right to privacy from the film crew or media.
And you could pay big fines if you ignore the rule.
OCR Hits Hard on Violations of the Privacy Rule
In the past several years the Office for Civil Rights (OCR), the agency responsible for HIPAA enforcement, has settled investigations of four hospitals, collecting huge settlements, for allowing ABC TV film crews in to the hospitals. In 2018, three Boston hospitals paid a total of $999,000 for violating HIPAA Rules. At two of the hospitals, they had reviewed privacy issues before the filming and decided to give the film crews HIPAA training, thinking that would be enough. All three hospitals obtained authorizations from patients only after the filming took place.
After was not soon enough.
At the time, OCR director Roger Severino said:
“Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments. Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.”
In 2016, New York Presbyterian Hospital paid $2.2 million to OCR to settle a similar investigation for the same TV show, Boston Med. The hospital had provided wide access to the film crew and only obtained patient authorizations after the fact. But it is not sufficient to film patients and then obtain consent to broadcast the material after the event, nor is it permissible to use blurring, pixilation, or voice alteration to mask the identities of patients whose consent has not been obtained. The exposure of protected health information is simply a violation of the HIPAA Privacy Rule. But to underscore its application in the case of film and media, OCR has published guidance directly on the topic.
In addition to fines, all four hospitals were required to enter Corrective Action Plans (CAP) for one to three years. A Corrective Action Plan includes additional oversight from OCR; requires specific actions by the hospitals, including reports back to OCR.
First Responders, EMS and Ambulances
Emergency Medical Service (EMS) providers who administer health care in the field, in a private home or another setting, are covered entities, as are doctors and hospitals. The HIPAA Privacy Rule applies the same way and they may not invite a film crew to the scene without violating HIPAA.
OCR monitors EMS agencies just like other covered entities. On December 30, 2019 they announced a $65,000 settlement paid by West Georgia Ambulance, Inc. for longstanding HIPAA violations. West Georgia also was required to enter a two-year Corrective Action Plan.
EMS reality television can comply with HIPAA and protect patient privacy. First, they need to follow some simple steps provided by the HIPAA Privacy Rule, included in The HIPAA E-Tool®.
Call an Ambulance!
Sometimes first responders show up on reality TV shows. Competition shows are grueling and contestants get sick, or get in fights. They don’t leave the show right away, and keep trying to get to the next level or “make it work”, when all of a sudden, EMS arrives and the contestant becomes a patient receiving care on camera. Contestants sometimes are loaded into an ambulance and go to the hospital. Why is that different?
The difference is that the medic was invited to come provide care, and did not do the inviting. The medic doesn’t control the scene they walk into, and his or her priority is to care for the patient. Bravo, TLC, Hulu, Netflix, etc. are neither covered entities nor business associates so they do not have to comply with HIPAA.
Contestants have signed a release with the TV producer, which gives permission for the use of their images, their stories and conversations for the show. This publicity or image release gives up privacy rights in exchange for the benefits of being on the show. It is not a HIPAA authorization and does not extend to a health care setting that pops up during filming. The release would protect the TV show, but not the hospital if the hospital invited a film crew inside.
Bystanders, the Press, and the Privacy Rule
So what about media who show up uninvited? A health care provider in a hospital, clinic, doctor’s office or other health care setting, should ask uninvited outsiders to leave if they are interfering with patient care. Outsiders should not be allowed into any area where protected health information might be seen, and this would include corridors, private offices and treatment rooms. This is part of the HIPAA Privacy Rule, to protect against unauthorized disclosures of protected health information.
If the media shows up uninvited at the scene of a fire, a car accident or a natural disaster, a first responder is not responsible for controlling the media’s actions. Patient care is the priority, staying focused on the patient and protecting their privacy as much as possible is the task. A health care provider who did not invite the film crew or media will not be held responsible for their actions. The film crew is not a covered entity and is not required to follow HIPAA. Only the health care provider is required to follow HIPAA.
The HIPAA E-Tool® Understands the Privacy Rule
All the HIPAA Rules are explained in The HIPAA E-Tool®, with polices, forms and guidance to complete your HIPAA compliance.
If you have a problem complying with HIPAA, we have the solution.
