OCR fines three hospitals nearly $1 million in HIPAA settlements
Three Boston hospitals have agreed to collectively pay nearly $1 million to the HHS Office for Civil Rights for compromising the privacy of patients’ protected health information during filming of a TV series.
Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital have each reached separate settlements with OCR for “inviting film crews on premises to film an ABC network medical documentary series without first obtaining authorization from patients,” according to the agency.
“Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments,” said Roger Severino, director of OCR, in a written statement. “Hospitals must get authorization from patients before allowing strangers to have access to patients and their medical information.”
The agency noted that this is the second HIPAA case in as many years involving an ABC medical documentary TV series. In April 2016, New York-Presbyterian Hospital was fined $2.2 million under sanctions from OCR and entered into a corrective action plan for unauthorized filming of two patients while participating in the “NY Med” TV series.
In this latest HIPAA case, Massachusetts General Hospital paid the most to OCR ($515,000) to settle the potential HIPAA violations, followed by Brigham and Women's Hospital ($384,000) and Boston Medical Center ($100,000).
As part of a corrective action plan, all three hospitals will provide workforce training on OCR’s guidance regarding disclosures to film and media which states: “Healthcare providers cannot invite or allow media personnel, including film crews, into treatment or other areas of their facilities where patients’ PHI will be accessible in written, electronic, oral, or other visual or audio form, or otherwise make PHI accessible to the media, without prior written authorization from each individual who is or will be in the area or whose PHI otherwise will be accessible to the media.”
Boston Medical Center, Brigham and Women’s Hospital and Massachusetts General Hospital were not immediately available for comment.
However, the respective resolution agreements and corrective action plans that the three hospitals signed all state that the agreements are “not an admission” of liability and that “potential violations alleged in the covered conduct do not constitute findings of fact.” Further, in the agreements, each hospital denied that it “impermissibly disclosed PHI and contends that it had proper consent for the filming.”
For its part, OCR made a point of stating in the respective resolution agreements that there is no concession that the three hospitals were not in violation of the HIPAA Rules and not liable for civil money penalties.