The Office for Civil Rights (OCR) and NewYork-Presbyterian Hospital settled at $2.2 million for a breach case involving the “egregious disclosure of two patients’ protected health information (PHI),” the OCR stated in a recent press release.

Released on April 21, the OCR’s statement detailed the settlement conditions for NewYork- Presbyterian Hospital (NYP).  The hospital will now pay the OCR $2.2 million for a breach of mass-media scale.

The case stems from an incident in 2012 where ABC Television filmed scenes at NewYork-Presbyterian for the show, “NY Med,” featuring Mehmet Oz, MD.  While filming, ABC’s crew was allowed to “film someone who was dying and another person in significant distress, even after a medical professional urged the crew to stop,” the OCR release states.  The issue comes from the lack of proper permissions. The filming was completed without patient authorization.

Remember, the HIPAA Rules specifically require written authorization from patients before disclosing any of their PHI, which most certainly includes photos or films of them.

During the course of the investigation, the OCR determined that NYP failed to safeguard other PHI by allowing ABC film crews unsecured access to the health care facility.  As the film crews were able to wander around the facility, NYP could not protect PHI from being seen or heard by these crews.

The OCR director, Jocelyn Samuels, is quoted saying: “This case sends an important message that OCR will not permit covered entities to compromise their patients’ privacy by allowing news or television crews to film the patients without their authorization.”

OCR will monitor NYP for two years as a part of this settlement agreement.

Do you know what you are required to do in the event of media disclosures?  If not, use HIPAAgps to get you started.