Preventing unauthorized audio and video recording at your practice

We all know audio, video, and photography capabilities are standard on smartphones and tablets, allowing anyone to record anywhere, including physician offices. For healthcare, these features have caused troubling incidents related to the unauthorized dissemination of information about patients and practices. While it’s impossible to completely prevent unapproved recordings, steps can be taken to minimize the risks. Here’s how:

All practice staff should be instructed to never record patients unless they have approval of both the patient and the practice. This should be included in written policies.

The actual recording of patients is not prohibited by law. However, the use and disclosure of such recordings are strictly regulated by numerous federal and state laws and accreditation standards.  Except in very limited circumstances, the patient’s authorization is required before using or disclosing recordings. 

Patient authorization

There are different requirements for authorizations depending on the purposes of the recording and its use.

In all circumstances, the patient’s authorization for the practice and its staff to record and use or disclose such recordings should be in writing.  If the recording is for treatment purposes, a general consent form is typically sufficient.  

If the recording is for the practice’s external purposes such as research or marketing, a separate authorization that complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) must be used. 

If the patient requests the recording for his or her own purposes-such as to document before and after images for certain procedures, or to participate in a television documentary-the authorization should be accompanied by language that releases the practice from liability for subsequent use of the recording.  Having the written approval of the patient for the recording is a strong defense against any future allegations by the patient or a regulatory or accreditation agency.

Next: Staff violations

Staff violations

If it is determined that a staff member has violated the practice policies regarding unauthorized use or disclosure of recordings (e.g., a technician takes a picture of an unusual skin condition and texts it to a friend or posts it on Facebook), immediate action needs to be taken. 

First, steps must be taken as quickly as possible to mitigate any harm (e.g., any unauthorized posts must be taken down).  Then the practice needs to evaluate whether the incident constitutes a “breach” under HIPAA, and follow its breach notification policy.  

The practice could face significant financial consequences with potential HIPAA penalties of up to $1.5 million per year for the same type of violation as well as exposure to state regulatory penalties.

Less control of patient recordings

The practice has less liability for the actions of its patients and visitors, but the practice also has less control over the actions of those groups. 

Once again, a good starting point is a policy that prohibits recording without approval. 

This can be best communicated by signs in the waiting and public areas.

If the practice becomes aware that a patient or visitor has captured another patient on a recording, the practice may not have a legal obligation to inform the affected patient, but should consider doing so to allow the affected patient an opportunity to protect against harm.

Depending on the facts and circumstances, it may not be permissible to inform the affected patient of the identity of the person who made the recording because the confidentiality of the person who made the recording may also be protected. Navigating these areas of confidentiality and transparency with your patients is important for gaining their trust.

Dealing with noncompliance

Another difficult question is how to respond if a patient refuses to stop recording, particularly during treatment.

In some circumstances, the practitioner may be comfortable with the recording, but practitioners should be aware that such recordings can be used for subsequent legal action, including malpractice claims, even if the practitioner believes that the care was appropriate.

If the patient who refuses to stop recording is capturing the images of other patients, it is within the purview of the practice to require the patient to leave the premises. If there is a health-related reason that the patient cannot be removed from the premises, he or she can be seated in a treatment room away from others.

If a patient refuses to cease recording during treatment, practitioners can refuse to treat the patient or discharge the patient from the practice, especially if a clear policy prohibits recording. Refer to laws and regulations on discharging a patient  in your state first.

It may seem like a solution to simply prohibit recording devices, but that is practically impossible. 

Instead, the practice must be aware of the risks, and implement the strategies discussed herein and other identified safeguards to protect the practice and the confidentiality of its patients.

Stacey L. Gulick, JD, is a partner at Garfunkel Wild, P.C. in Great Neck, new York. Send your legal questions to medec@advanstar.com.