On April 21, 2016, the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) announced a $2.2 million settlement with The New York and Presbyterian Hospital (“NYP”) regarding NYP’s impermissible disclosure of protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) of two of its patients to ABC film crews producing the television series “NY Med.” This settlement comes on the heels of a finding by the New York Court of Appeals—the highest appeals court in New York—that the same facts support the family of one of the patients asserting breach of physician-patient confidentiality, potentially exposing NYP to additional damages under state law. Taken together, the federal settlement and state law action highlight both (1) the significant risks associated with media access to patient care areas when appropriate and reasonable safeguards have not been imposed, and (2) the relationship between impermissible HIPAA disclosures and potential state law causes of action that may increase financial exposure of HIPAA covered entities and their business associates.
According to the OCR settlement documents and the New York Court of Appeals opinion, NYP granted ABC and its film crew access to NYP treatment areas to observe and record patients for “NY Med,” a documentary series about patients experiencing medical trauma and the professionals who attend to them. Neither NYP nor ABC sought the consent or authorization of the patients being filmed. In some cases, ABC recorded patients without their knowledge. The Court of Appeals opinion explained that the emergency room events, in which one of the patients died, were replayed during an episode of NY Med that aired in 2012. It was while watching the television episode that the late patient’s wife first learned that her husband had been filmed, recognizing him based on his voice and the visual context of the scene (despite ABC’s “blurring” of his face and providing no other identifiable health information). None of the Court documents mentioned whether NYP had any role in the “blurring” process, and the extent to which it masked the patient’s identity, which may have served as a reasonable basis for NYP to conclude that adequate safeguards existed to prevent impermissible disclosure of patients’ PHI. Thereafter, the patient’s wife and other family members brought suit against NYP and the physician responsible for the patient’s treatment for breach of the physician-patient privilege. The OCR investigation was initiated at approximately the same time as the lawsuit, following OCR’s receipt of a patient complaint.
In its Resolution Agreement, OCR found that NYP’s disclosure of the deceased patient’s (and one other patient’s) PHI—in the form of identifiable images—without their written authorization, constituted a violation of the HIPAA Privacy Rule. Additionally, OCR found that NYP failed to safeguard the PHI of its patients when it provided ABC with “virtually unfettered” access to its patient care areas because such access did not make it possible for NYP to monitor and protect against impermissible disclosures. As a result of these findings, and despite non-admission language by NYP in the Resolution Agreement, OCR imposed a two-year Corrective Action Plan (“CAP”) to ensure that NYP enacts appropriate safeguards to prevent recurrence. As part of the CAP, NYP is required to update its policies and procedures, specifically as they relate to the use of photography, video recording or audio recording without patient written authorization and when not related to the provision of medical care. OCR also released frequently asked question (“FAQ”) guidance on its website in connection with the CAP, which provides general guidance to all HIPAA covered entities and business associates as to the very limited circumstances when it may be appropriate for health care providers to invite film crews into patient care areas without patient written authorization.
Although HIPAA is enforced by OCR and does not give rise to causes of action by private parties, New York has enacted a statutory physician-patient privilege, which addresses the relationship between patients and physicians (and other licensed health care professionals and professional corporations). On March 31, 2016, the New York State Court of Appeals held that the family of one patient properly stated a claim for breach of physician-patient confidentiality. In analyzing the elements of the cause of action—including whether the physician disclosed information relating to the patient’s treatment or diagnosis to a person not connected with the patient’s medical treatment and in a manner that allows the patient to be identified—the Court of Appeals disagreed with NYP and ABC, who argued that because the deceased patient was not identifiable on the aired program, his confidential information was not disclosed. The Court of Appeals found that, although the patient’s face was blurred in the aired episode, evidence supports the claim that the patient was still identifiable by certain people who knew him. Moreover, leaving aside that population-limited disclosure to the audience of the broadcast episode and the potential that ABC was entitled to view this information as a business associate of NYP under HIPAA, the Court of Appeals found that inappropriate disclosure had occurred even earlier—when the defendants disclosed the patient’s PHI during the course of treatment to the ABC film crew itself, and possibly to any ABC production employees who worked with the raw footage.
The recent settlement and active state law claim provide an important reminder that participation in film and media projects poses a risk of liability of both HIPAA violations and state civil suits. Grounds for liability may exist based on the disclosure of PHI to both the general audience consuming the media product and to the individuals involved in creating the media product, even if these entities or individuals may be business associates under HIPAA. Accordingly, the language of the FAQ released by OCR with the Resolution Agreement may be appropriately instructive: other than for limited reasons, health care providers should not “invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media.”
If you would like to discuss additional details and implications of the HIPAA settlement, the physician-patient confidentiality case, or any other patient privacy issues, please contact your usual Ropes & Gray attorney.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
