On September 20, 2018, HHS announced settlements totaling nearly $1 million with three Boston-area hospitals (and HIPAA covered entities) regarding potential violations of HIPAA's Privacy Rule (see Practice Note, HIPAA Privacy Rule and HIPAA Privacy, Security, and Breach Notification Toolkit).

Between December 2014 and January 2015, HHS began reviewing the hospitals' Privacy Rule compliance after news stories indicated that the hospitals had allowed television film crews to film a medical documentary series at their facilities. In some cases the hospitals had reviewed and assessed patient privacy issues concerning the filming and adopted protections concerning patient privacy, for example, providing the film crews with the same HIPAA privacy training that workforce members received (see Standard Document, HIPAA Training for Group Health Plans: Presentation Materials). Despite these protections, however, HHS concluded in its investigations that the hospitals:

HHS entered into separate settlement agreements with the three hospitals (one agreement for $515,000, a second agreement for $384,000, and a third agreement for $100,000), which collectively totaled nearly $1 million.

The settlement agreements involving two of the hospitals are substantially similar in many aspects and include the requirements addressed below.

Under the settlement agreement for the third hospital in this enforcement action, the hospital agreed to make a $100,000 payment. The third hospital also entered into a CAP under which it must (among other requirements) timely email its workforce members to remind them about its policy on filming patients for non-medical reasons. The email will include HHS's FAQs on permitting members of the media to enter the hospital's facilities without prior authorization. The third hospital's CAP also contains document retention and breach provisions.

This is not the first time in recent years that a hospital has become the subject of an HHS settlement agreement for improperly disclosing patients' PHI by allowing television crews to film onsite in otherwise non-public areas of the hospital. In 2016, HHS reached a $2.2 million settlement with a New York hospital for what the government characterized as an "egregious disclosure" of two patients' PHI without obtaining the patients' authorization. In that incident, which involved production of the "NY Med" television series, the hospital had permitted the television crew to film one patient who was dying and a second who was in significant distress. At the time, at least one health care professional had urged the television crews to stop filming.

Judging from the relatively smaller payments imposed in these more recent settlements, the disclosures of patient PHI here were apparently less egregious than in the 2016 incident. Moreover, as noted, at least two of the hospitals involved had attempted to implement safeguards for patient privacy, which HHS may have considered as a mitigating factor.

Although it's hard to imagine a television crew being invited to film the inner workings of an employer's health plan (as a HIPAA covered entity) and its business associate-TPAs and subcontractors, these latest settlement agreements underscore the importance of HIPAA's restrictions concerning who is allowed to access individuals' PHI. The agreements are also of interest regarding HHS's methods for discovering potential HIPAA violations. For example, HHS's compliance review of one of the hospitals resulted from a news story posted on the hospital's own website indicating that a television crew would be filming a medical documentary program at the hospital.

For analysis of other HHS settlements with HIPAA covered entities and business associates, see Practice Note, HIPAA Enforcement: Settlement Agreements.