On November 20, 2023, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced an $80,000 HIPAA settlement with Saint Joseph’s Medical Center (“SJMC”) in New York State. The settlement was the result of OCR’s investigation of SJMC after the Associated Press published, in 2020, an article profiling SJMC’s response to the COVID-19 pandemic that included photos and information about SJMC patients. OCR concluded that SJMC disclosed three (3) patients’ protected health information (“PHI) without first obtaining a HIPAA written authorization from these patients. OCR’s press release announcing the settlement noted that “These images were distributed nationally, exposing protected health information including patients’ COVID-19 diagnoses, current medical statuses and medical prognoses, vital signs, and treatment plans.” 

What You Need to Know:

• Providers must be careful and compliant when interacting with the media, particularly when there is video and or audio that includes Protected Health Information.
• HIPAA compliance remains important and will depend on providers’ on-going, effective workforce training regarding their HIPAA policies.
• While settlement agreements bring closure, they can be an expensive resolution process.

SJMC admitted no wrongdoing but did agree to a two-year Corrective Action Plan (“CAP”) with OCR in addition to paying the $80,000 settlement. The CAP requires SJMC to:

• review and revise, as needed, its HIPAA policies and procedures to address minimum content requirements, including: prohibiting the use or disclosure of PHI by SJMC workforce members to any person or entity using photography, video recording or audio recording without the prior written authorization of the patient whose PHI is to be disclosed; create a process to approve authorizations before allowing third parties to have access to a patient’s PHI; require an SJMC workforce member to actively monitor these recordings on SJMC premises by a third party; and, provide appropriate sanctions against any member of SJMC’s workforce who does not comply with SJMC’s policies;
• distribute these policies to members of its workforce, after the updated policies are approved by OCR;
• report violations to HHS, and
• train its workforce on its policies.

HHS began investing this issue in April 2020, eight (8) days after the AP article was published. Over three and one-half years later, the SJMC settlement was announced. OCR investigations can be a long (and likely costly) process not including any settlement amounts that may be included. HIPAA compliance remains important, even though we are hopefully long past being in a pandemic.

The SJMC resolution agreement and CAP is located here.