Scenario #1. Your nurse is teaching an incontinent male patient to self-catheterize. His wife wants to record the encounter on her cell phone to “help” her husband perform the task in the future. The male nurse does not want to be recorded; he is concerned with his own privacy. Moreover, he is not sure that the patient actually wants his wife to film this. The wife is adamant that filming is necessary. The practice has plenty of other resources to assist the patient in completing this self-care task.
Scenario #2. You operate an OB/GYN practice. In your waiting room, a 12-year-old girl, whose mother is a patient of the practice, covertly snaps a photo of a 13-year-old patient when she is called back to the treatment area. The photograph is subsequently posted to Instagram, with the hashtag #Slutlife, suggesting that the girl is sexually active. The post clearly identifies the patient and your practice. The photographed patient’s mother calls the practice, concerned for her daughter’s welfare when she is bullied online after the photograph is posted.
Legal issues. Both Pennsylvania and federal law permit filming – including audio recording – in public places. However, with respect to private property, the property owner or leaseholder controls the taking of photographs and filming. Individuals who do not comply with directions of the party that controls the property are subject to trespassing charges or allegations of invasion of privacy. Importantly, with respect to audio recording, Pennsylvania is a two-party consent state: Both (or all, if more than two) parties must consent to an audio recording if the parties otherwise have an expectation of privacy. Accordingly, as the owner or leaseholder of property, the practice gets to determine whether any filming or audio recording can take place. Note, however, that regardless of your policy, audio recording can only lawfully be conducted with the consent of all parties.
These scenarios also potentially implicate HIPAA. While HIPAA does not apply to the person doing the recording because he or she is not a covered entity or a member of a covered entity’s workforce, it does apply to the practice, which, as a covered entity, is required to take reasonable physical, technical and administrative safeguards to protect patients’ privacy.
Offense is the best defense. Pennsylvania law grants a practice the authority to control video and audio recording on its premises, and a practice should do so: Be proactive and establish a patient non-recording policy. It is your right and, further, should be a HIPAA safeguard that you implement to protect the privacy of your patients. With an established policy, an employee in the first scenario could immediately respond to the patient’s spouse’s request that there is a policy prohibiting filming. If notice of the policy has been properly and effectively posted, verbally reinforcing its existence should typically end the issue. Further, posting notice of the policy, including explicit reference to prohibiting use of smartphone cameras, should help prevent most such issues. Notice should be posted in both waiting and treatment areas. Such a policy is especially important if your practice provides services that receive special protection under the law, such as HIV treatment or mental health services or that otherwise are considered to be sensitive.
While we have found no circumstances in which covered entities have been cited under HIPAA for photographs or recordings taken by patients or visitors and publicly posted, it is in covered entities’ best interests to have such a policy and to enforce it. How far the duty extends – for example, does the practice have an obligation to take steps to get Instagram to remove the post on the basis that it includes protected health information (PHI)? – is a matter of debate. Legally, there has been no “breach” by the practice. However, a practice would be well-advised to take reasonable efforts to assist the patient in removing the post to mitigate the damage both to the patient and to the practice. Other steps, including the dismissal of patients who violate an established non-recording policy, may be considered. Any such dismissals would have to comply with applicable regulations requiring notice to avoid allegations of patient abandonment.
Consult a qualified attorney prior to implementing a non-recording policy to ensure that all legal issues are appropriately addressed. Occasionally, allowing a patient to record a discussion with a provider – with, of course, the knowledge and consent of the provider – may be a reasonable accommodation to a disability.
DISCLAIMER: This article is for informational purposes only and does not constitute legal advice. You should contact your attorney to obtain advice with respect to your specific issue or problem.