Legal Matters: How to Work with the Media On-Site Without Violating HIPAA

September 26, 2017

Q & A with Jennifer Perry, Counsel at Gray Reed & McGraw

// By Lisa D. Ellis //

Next time you get a request for a media interview on-site, or you’re planning a special public relations event, you may want to think twice—or at least make sure you proceed cautiously. Here’s why:

Health care marketers, relative to marketers in most other industries, have extra hurdles to overcome to achieve their organizational goals, thanks to HIPAA. This month we look at the impact of HIPAA from two different angles. First, in the article that follows, we look at how to effectively host media at your facility without stepping on any legal landmines. And in our second article, we look at how to effectively engage health care consumers via social media and tell your organization’s and your patients’ stories without violating privacy concerns.

Health care marketers today face many conflicting priorities, such as: Promote your organization widely. Protect patient privacy. Develop strong relationships with the media. Prevent journalists from coming into protected areas. Personalize your service lines. Don’t share patient names and details. Can all of these goals happen simultaneously without violating the Health Insurance Portability and Accountability Act (HIPAA)?

Jennifer Perry, counsel in the health care practice of Texas-based law firm Gray Reed & McGraw

Jennifer Perry, counsel in the health care practice of Texas-based law firm Gray Reed & McGraw

The answer is yes (at least sometimes), according to Jennifer Perry, counsel in the health care practice of Texas-based law firm Gray Reed & McGraw. But she points out that achieving the right balance requires a well-thought-out, formal media policy, along with training for everyone involved on how to follow it properly, and adequate support from your leadership and staff to make this a priority.

Therefore, to help demystify the process for readers, we recently asked Perry to share her legal expertise on what organizations should know about working with the media and having them on-site, as well as when it’s better to play it safe and decline media coverage so you don’t venture into dangerous territory.

SHCM: Most health care organizations work hard to establish strong media relations. Yet there are many important privacy issues that need to be considered in the process. Why is this such a challenging area to navigate?

JP: Unlike businesses in other industries, when hospitals are provided with a media opportunity they have many different regulatory issues to consider before saying yes to a request. Although positive press is always welcome and desired, hospitals must balance out the regulatory risks and supervision it will take to properly facilitate the exposure before agreeing to it. A hospital’s primary responsibility is to protect its patients’ confidentiality as required under state and federal privacy laws—including the health information privacy standards of the Administrative Simplification Provisions of HIPAA—and to protect its employees’ privacy rights. Allowing a media event on-site at a hospital is full of opportunities for the various privacy regulations to inadvertently be breached, which can result in fines and possible imprisonment. For this reason, if the hospital must expend great resources unequal to the amount of positive media coverage they will receive or are not given enough notice of the event to adequately prepare, a hospital is better off to deny or delay the media event rather than take any unnecessary risks.

SHCM: How can health care organizations navigate the fine line between transparency and privacy?

JP: The first obligation of the hospital is to protect patients’ privacy, so unfortunately this means that often the press is left unhappy with the restrictions imposed to ensure this protection. The more planning and notice a hospital has prior to a media event, the better it can communicate with the media to allow a clear expectation of what access will be allowed to the facility, staff, and/or individual patients. Taking time to explain the reasoning or regulations behind the restrictions imposed by the hospital is important so that the media outlet understands why the hospital is unable to give the access or information they desire. In the interest of promoting transparency, hospitals should establish a hospital media policy and enforce it consistently across all media outlets.

When working with the media, the designated hospital spokesperson should offer to get answers for the media outlet when they do not have an immediate response available and should always follow up as timely as possible with an answer. A hospital should never lie to the media and should be honest if they don’t have an answer at that time or need to ask another hospital administrator. This provides open and honest communication and allows the media outlet to understand that they will get the answers they want if the hospital is given the time it needs to get in touch with the correct resources.

One way to avoid having to turn down a media request is by having an established media policy and protocol in place to immediately implement when a media request is first presented.

SHCM: Can you explain what is involved in establishing such a media policy?

JP: A hospital’s media policy should be reviewed by legal, approved by administration, and endorsed by the hospital’s governing board. The hospital’s media policy should direct all media inquiries to the communications department of the hospital, or appropriate department, and designate a single hospital spokesperson. The policy should list a procedure to reach the appropriate spokesperson, or their delegate, at all hours of the day, including weekends and holidays. Having all information flow through one spokesperson and having that person serve as the sole contact for the event ensures the correct message is conveyed and gives the media a personal hospital contact to communicate with directly. The hospital spokesperson for the media event is critical to keeping the relationship mutually beneficial and positive for both parties.

SHCM: We’ve all seen news coverage of the first New Year’s baby, the child who has a miraculous recovery from a life-threatening accident, and the mother of quadruplets. How can such interviews be safely facilitated?

JP: To facilitate staff/patient interviews while still protecting patient privacy and confidentiality under HIPAA, the hospital must obtain, in advance of the interview, signed authorizations from patients who are interviewed, photographed, or referenced by their treating health care providers in news stories. The regulations implementing HIPAA set forth very specific criteria for what must be included in the authorization to be valid. Hospitals should carefully review the authorizations to ensure they include each of these criteria and that they cover the different media involved (e.g., photographs, video, voice recording) and the personal identifying information to be disclosed. Keep in mind that a HIPAA authorization is different from a typical consent. As such, it is important that the hospital retain the executed authorization as required by HIPAA (at least six years) and applicable state privacy laws. In addition, the hospital should maintain a copy in its records for the media event. Although HIPAA does not necessarily apply to staff, if staff want to participate in the media event/opportunity, the hospital should obtain written authorizations for staff as well. This is particularly true if the hospital intends to use any of the production materials to promote the hospital.

SHCM: What other advice can you offer to help providers be prepared when planning a media event or interview?

JP: Hospitals need to discuss internally the media protocol and on-site location restrictions prior to having the media outlet on-site. These discussions should include a representative from the marketing, communications, privacy, legal, operations, and administrative teams of the hospital. A location agreement can be drafted that outlines all of the restrictions the media outlet will be required to follow while on-site, and can be submitted early in the request process. The location agreement should include the duration and exact location of the media access, the restrictions to their access, the personnel involved, and insurance coverages required. Should an accident happen on-site or a media outlet representative cause a breach of patient confidentiality, the hospital will want reassurance that the media outlet has insurance coverage and will indemnify the hospital for any damages. If the media outlet cannot agree to the location agreement, they should not be allowed access to the hospital. It helps to have a formal location agreement on hand in case there is an emergency or sudden media event with no time for pre-planning. This allows the parties to quickly define the relationship, including hospital access restrictions.

The hospital spokesperson for the media event as defined in the location agreement, usually the marketing or communications director, can relay and enforce these restrictions. If the presence of the media in any department, e.g., the emergency department, has the potential to compromise patient care or confidentiality, interviewing or taping in the department should be reconsidered or held at off-hours to cause as little disruption of patient care and risk to confidentiality as possible. If patient confidentiality cannot be guaranteed in such areas, the hospital should do its best to provide an alternate area for the media to photograph, film, and interview away from patients. At the hospital’s discretion, hospitals may deny the media access to any area, including (but not limited to) operating rooms, intensive care units, maternity units, emergency departments, nurseries, pediatric units, and particularly psychiatric and substance abuse units where patients have a heightened expectation of privacy.

SHCM: Are there other potential areas for privacy breaches that health care organizations should be aware of?

JP: Not only do hospitals need to control the intended health information exchange, but also under federal policies and laws, “protected health information” includes direct or “overheard” conversations between and among caregivers, patients, and family members, as well as information contained in medical records. Therefore, when a hospital provides reasonable media access to its facilities, if members of the media overhear or see “protected health information” that is not covered by an authorization, they must not use or disclose that information without obtaining a specific authorization for that information. To keep inadvertent disclosures to a minimum, restrictions in some areas may be imposed and the media outlet should be escorted and continuously supervised when on-site. 

SHCM: Do you recommend any steps that can help marketers establish positive relationships with the media?

JP: The media in your local area can be a strong partner for your hospital. They have an important job to do and you need them in your health care world. Follow the hospital’s media policy and protocol, and be consistent. Be polite but firm on what your hospital’s policies will allow and restrict. Do not make promises you are not authorized to make or cannot keep. Be patient and do not become argumentative or bad-tempered, even if you are right. Stay in regular contact and be timely in your responses to the media outlet. Beyond media events, the hospital can offer to act as a resource on any other health care issues or stories the media may have questions about to establish a closer relationship with the local media. Getting to know media personalities in your local area and establishing a relationship with them is beneficial to your hospital.

Also, creating a page on the hospital’s website that explains the hospital’s media policies and outlines the restrictions is very helpful for media outlets so they can better understand the hospital’s needs and limitations and thus better frame a request.

Resources to Learn More

Perry offers the following suggestions for groups that want more information about managing media relations responsibly:

  • The American Hospital Association’s subgroup, the Society for Healthcare Strategy and Market Development (SHSMD), offers guidance and publications on crisis communications and media relations at
  • Each state’s hospital association usually has a subgroup that can help hospitals address media relations and HIPAA guidelines.
  • The Department of Health and Human Services (HHS) website provides information on media relations and HIPAA compliance at
  • Hospitals can consult a health care attorney with experience in health care marketing and media to help them establish their own hospital media policy, location agreement, and training to prepare for media events before they occur.

Lisa D. Ellis is the editor of Strategic Health Care Marketing. She is a journalist and content development specialist who helps hospitals and other health care providers and organizations shape strategic messages and communicate them to their target audiences. You can reach her at