The HHS Office for Civil Rights (OCR) has issued another notice of enforcement discretion, one that will be of interest to academic medical centers, medical schools, HIPAA covered entities and others dealing with heighted public interest due to the COVID-19 pandemic.

Specifically, with new research funding flowing to help develop tests and treatments for COVID-19 amid intense attention from the media, it is only natural for them to want to showcase their work helping manage the unprecedented pandemic.

But a word of caution: When patients (or research subjects) might be shown on camera or identifying details mentioned in print or online, HIPAA protections continue to apply, despite the public health emergency. And OCR has let it be known that it is watching.

Since the public health emergency was declared in March, OCR has been issuing various waivers of enforcement, indicating it would be lenient in certain circumstances if privacy, security and/or breach notification rules are violated.^[1]

But its most recent announcement ran in the opposite direction. Last month OCR issued new FAQs about “restrictions to media access,” clarifying, for example, that “masking or obscuring patients’ faces or identifying information before broadcasting a recording of a patient is not sufficient, as a valid HIPAA authorization is still required before giving the media such access.”^[2] Obtaining prior permission is something OCR is stressing.