OCR Resolution Agreement Flags Continuing Concerns Over Privacy and the Media
While the volume of Resolution Agreements coming out of OCR in 2018 have been significantly less than in prior years (five thus far in 2018 versus 10 for the same period in 2017), with each Resolution Agreement, OCR continues to send very strong messages to covered entities and there are certainly lessons to be learned from each. In the single Resolution Agreement from September, the underlying facts giving rise to OCR enforcement is not a new one – allowing third parties access to patients for marketing or other media purposes. What prompted the investigation should also catch everyone’s attention.
The resolution involves three separate covered entities – (i) Boston Medical Center Corporation, a 567-bed academic medical center in Boston, MA; (ii) Brigham and Women’s Hospital, Inc., the teaching hospital of Harvard Medical School and (iii) Massachusetts General Hospital, a 1,035-bed academic medical center also located in Boston. OCR became aware of the upcoming filming of a new ABC News documentary after initially seeing a story posted to MGH’s website on October 3, 2014. It posted: “Boston Medical Center is proud to take part in a new medical documentary created by ABC…You can read more about it in this article from the Boston Globe.” After filming was complete, OCR indicated it reviewed an article in the Boston Globe in January describing the documentary and ABC News’ unparalleled four-month access to real life trauma encounters. OCR initiated a compliance review on its own initiative based on these media stories.
OCR found that despite each of the entities’ assessment of its HIPAA compliance obligations and implementing certain protections, including providing HIPAA training to the ABC film crew, the covered entities nevertheless impermissibly disclosed PHI of patients to ABC. The three hospitals maintain that they complied with HIPAA by providing training to the ABC film crew and by making the news crew each sign confidentiality agreements. The problem with that position is that HIPAA does not permit disclosure to a third party on the basis of training and confidentiality agreements alone. All disclosures must fit within some authority for the disclosure under HIPAA. The hospitals have publicly commented that they obtained patient consent from every patient and no patients have complained. According to OCR, those consents were not obtained prior to giving ABC News access to patients. The three entities collectively settled with OCR for $1M.
With regard to the settlement, Roger Severino, OCR Director, stated: “Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments.” Despite the settlement, full episodes of “Save My Life: Boston Trauma” can still be seen on abc.go.com.