- Boston Medical Center, Brigham and Women's Hospital and Massachusetts General Hospital were slapped with a cumulative $999,000 in fines from HHS' Office of Civil Rights (OCR) for allowing film crews from the ABC documentary series "Save My Life: Boston Trauma" to film patients on premises without obtaining prior authorization.
- It's the second time hospitals filmed for the documentary series have been hit with HIPAA fines, the first having been New York-Presbyterian Hospital for $2.2 million in 2016.
- "Patients in hospitals expect to encounter doctors and nurses when getting treatment, not film crews recording them at their most private and vulnerable moments," Roger Severino, OCR director, said in a statement.
The HIPAA blunder comes at a time where cyberattacks and data breaches are usually the biggest threat to a hospital's good-standing with OCR. Not counting this latest action, three organizations have been hit with HIPAA fines this year.
The University of Texas MD Anderson Cancer Center paid out more than $4.3 million in June after a data breach, and Fresenius Medical Care North America was on the hook for $3.5 million as the result of five separate breaches. An Illinois company advertising storage and delivery of medical records was fined $100,000 in February because an employee left records at a shredding and recycling facility.
In a joint statement, Brigham and Women's and Massachusetts General Hospital said they had not received complaints from patients or patients' families regarding the filming. Some patients, the hospitals said, had even "expressed gratitude about being given an opportunity to share their stories and experiences in a way that could help others across the nation."
Boston Medical Center, in a statement to Healthcare Dive, argued that it actually had obtained consent from those involved in the filming "in full compliance with HIPAA," but chose to pay the fine to "avoid further burden and expense."
According to OCR, Massachusets General was hit the hardest with a $515,000 fine. Brigham and Women's agreed to pay $384,000 and Boston Medical Center coughed up the least at $100,000. In addition to the fines, each hospital must now provide workforce training as part of a corrective action plan, including OCR's guidance on disclosures to film and media.