Engaging with the media can be a valuable tool for healthcare providers to communicate health information, advocate for public health, and establish themselves as reliable sources of medical expertise within their communities. HIPAA's Privacy Rule sets the requirements for protecting sensitive patient data, providing the necessary guidance to healthcare providers sharing this information.
When can healthcare providers share patient data with the news?
Healthcare providers can share patient data with the news under minimal circumstances, as outlined in the HIPAA Privacy Rule. The rule generally prohibits the disclosure of protected health information (PHI) to the media without obtaining prior authorization from the individual or their personal representative.
The most common and straightforward way to share patient data with the news is by obtaining HIPAA compliant authorization from the patient or their personal representative. This authorization must be in writing and explicitly state the purpose of the disclosure, the information to be disclosed, to whom it will be disclosed, and the patient's right to revoke the authorization. Healthcare providers can use a variety of communication methods to obtain this consent, including HIPAA compliant email.
Exceptions to the requirement for consent
Healthcare providers may seek media assistance to identify or locate the family of an unidentified and incapacitated patient in their care. In such cases, limited PHI about the patient can be disclosed to the media if the disclosure is in the patient's best interest, as determined by the hospital's professional judgment.
Another circumstance includes when healthcare providers can disclose limited PHI, such as the patient's location in the facility and general condition (e.g., "stable" or "critical"). This can be shared with the media without authorization if the individual has not objected to being included in the facility directory and the media representative asks for the individual by name. However, specific medical information must not be communicated.
Media access to healthcare facilities
The HIPAA Privacy Rule does not specifically prohibit media crews from accessing areas of medical facilities that are generally accessible to the public. This means that media crews can access public waiting areas or areas where the public enters or exits the facility without requiring prior authorization or violating HIPAA regulations.
However, the situation changes when media crews want to access areas where PHI is accessible in written, electronic, oral, visual, or audio form, or if they want to interview patients or film identifiable individuals in a medical facility.
In such cases, the healthcare provider must ensure they have obtained proper authorization from the patients or their personal representatives or meet one of the exceptions mentioned in the HIPAA Privacy Rule, such as the facility directory information exception or the exception for identifying unidentified and incapacitated patients.
Go deeper:
Liyanda Tembani
