With new research funding flowing to help develop tests and treatments for COVID-19 amid intense interest from the media, it would be only natural for academic medical centers, medical schools and other HIPAA covered entities to want to showcase their work helping manage the unprecedented pandemic.

But a word of caution: When patients or research subjects might be shown on camera or identifying details mentioned in print or online, HIPAA protections continue to apply, despite the public health emergency. And the HHS Office for Civil Rights (OCR) is watching.

Since the public health emergency was declared in March, OCR has been issuing various waivers of enforcement, indicating it would be lenient in certain circumstances if privacy, security and/or breach notification rules are violated.^[1]

But its most recent announcement ran in the opposite direction. Last month OCR issued new FAQs about “restrictions to media access,” clarifying, for example, that “masking or obscuring patients’ faces or identifying information before broadcasting a recording of a patient is not sufficient, as a valid HIPAA authorization is still required before giving the media such access.”^[2] Obtaining prior permission is something OCR is stressing.

Gone are the days when public relations officials might permit a media crew to walk through a hospital or research facility on a promise (perhaps in writing) that no patients would be identified, or that, if they were going to be, the journalists would retroactively get signed HIPAA authorizations.