OCR reaches $999,000 in settlements for disclosure of PHI during “Boston Med” filming

The Department of Health and Human Services, Office for Civil Rights (OCR) announced in a press release yesterday that it has reached separate settlements with three facilities for compromising the privacy of patient protected health information (PHI) during the filming of “Boston Med,” an ABC television documentary series.

In its statement, OCR says three entities, Boston Medical Center (BMC), Brigham and Women’s Hospital (BWH), and Massachusetts General Hospital (MGH), paid OCR $999,000 to settle “potential violations” of the HIPAA Privacy Rule. The breakdown of the fines paid to OCR is as follows: BMC paid $100,00, BWH paid $384,000, and MGH paid $515,000. Each entity also has agreed to provide workforce training.

This is not the first case of a HIPAA settlement involving an ABC medical documentary. In April 16, 2016, OCR announced a $2.2 million settlement with New York-Presbyterian Hospital that occurred during the filming of “NY Med.”

HHS has issued guidance on media and filming in treatment areas of healthcare facilities that are not generally accessible to the public. The guidelines are clear that written authorization must be obtained from each individual who will be in the area or whose PHI will be accessible to the media prior to media personnel, including film crews, being given access to areas of the facility where patients’ PHI will be accessible in any format—written, electronic, oral, or audio-visual.

HHS adds that it is not sufficient to mask identities using techniques like blurring, pixilation, or voice alteration for patients from whom authorization was not obtained, because HIPAA does not allow media access to patient’s PHI without an authorization in the first place. The healthcare provider must also ensure reasonable safeguards to protect against incidental disclosures of other PHI that may be in the area.