[fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” status=”published” publish_date=”” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_size=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=””][fusion_builder_row][fusion_builder_column type=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_image_id=”” background_position=”left top” background_repeat=”no-repeat” hover_type=”none” border_size=”0″ border_color=”” border_style=”solid” border_position=”all” border_radius=”” box_shadow=”no” dimension_box_shadow=”” box_shadow_blur=”0″ box_shadow_spread=”0″ box_shadow_color=”” box_shadow_style=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” margin_top=”” margin_bottom=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”no”][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]

The Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS) recently issued guidance and FAQs reminding health care providers that the COVID-19 public health emergency has not changed the federal health privacy protections concerning disclosure to the media an individual’s health information or reporting on their treatment. OCR has previously placed special emphasis through its enforcement activity that the HIPAA Privacy Rule does not permit health care providers to give media and film crews access to facilities where patients or their protected health information (PHI) will be accessible without the patients’ prior authorization.

The most recent guidance explains that even during the current COVID-19 public health emergency, health care providers are still required to obtain a valid HIPAA authorization from each patient whose PHI will be accessible to the media before the media is given access to that PHI.  The accompanying FAQ goes on to clarify that masking or obscuring patients’ faces or identifying information before broadcasting a recording of a patient’s treatment or testing in a community based testing site is not sufficient, as a valid HIPAA authorization is still required before giving the media access to the facility or treatment area.  In addition, the guidance describes reasonable safeguards that should be used to protect the privacy of patients whenever the media is granted access to facilities.

However, OCR’s decision to relax enforcement of the HIPAA standards for healthcare providers operating some COVID-19 testing sites removes the threat of the agency levying fines or penalties for violations of the Privacy or Breach Notification Rules when a covered entity allows members of the media to observe or film treatment associated with services provided contemporaneously to the testing service.

The Notice of Enforcement Discretion for Community Based Testing Sites During the COVID-19 Nationwide Public Health Emergency encourages, but does not require, covered entities and business associates operating Community Based Testing Sites (CBTS) to put into place physical safeguards to shield patients from view during the testing process as well as to provide a buffer to keep the media away from patients at a CBTS.[i]

The HIPAA Privacy Rule balances patients’ rights to control how and when their protected health information is disclosed for purposes outside of treatment while allowing health care providers flexibility to use and disclose PHI in order to treat that patient or coordinate the continuation of that care with family members and partners.

While OCR has used its enforcement discretion during the COVID-19 public health emergency, OCR has drawn a line in the sand that covered entities risk consequences when disclosing PHI to the media without patient authorization. Health care providers must approach very carefully the risks of their obligations to shield PHI when exposing patients or their treatment records to the glare of television lights or a reporter’s notebook without first obtaining an authorization that meets the requirements of the HIPAA Privacy Rule.

[i] OCR encourages covered health care providers participating in the good faith operation of a CBTS to implement reasonable safeguards to protect the privacy and security of individuals’ PHI. Reasonable safeguards include the following: ….

Although covered health care providers and business associates are encouraged to implement these reasonable safeguards at a CBTS, OCR will not impose penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in connection with the good faith operation of a CBTS.

[1] OCR encourages covered health care providers participating in the good faith operation of a CBTS to implement reasonable safeguards to protect the privacy and security of individuals’ PHI. Reasonable safeguards include the following: ….

Although covered health care providers and business associates are encouraged to implement these reasonable safeguards at a CBTS, OCR will not impose penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in connection with the good faith operation of a CBTS.

[/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]