Using the attached form fill out the required sections to develop an annotated bibliography for the journal article attached and read this week.  Submit your completed form using the above link. 

Volume 28 • Number 8 • August 2016 Intellectual Property & Technology Law Journal 11

Lights, Camera … No Unauthorized
Disclosure! Taking “Action” to Protect
Patient Privacy When the Media Appear
By Kimberly C. Metzger

In April 2011, Mark Chanko died at New York-Presbyterian hospital (NYP) after being hit by
a truck. While Chanko was receiving emergency
treatment, a film crew from a major television net-
work was onsite at the hospital, with its knowledge
and permission, filming the medical documentary
series N.Y. Med. The crew filmed Chanko’s treat-
ment, the doctor declaring him dead, and the doc-
tor informing the family of his death, all without
Chanko’s or the family’s consent—or even their
knowledge.1 Sixteen months after Chanko’s death,
while watching an episode of N.Y. Med, Chanko’s
wife “recognized the scene, heard decedent’s voice
asking about her, saw him on a stretcher, heard him
moaning, and watched him die.”2 This was the first
time she, and other family members, became aware
that his treatment had been recorded.

The Civil Case
Chanko’s widow and family members brought a

civil lawsuit, which is proceeding against the hos-
pital and treating physician for breach of doctor/
patient confidentiality.3 However, that is not the
limit of the hospital’s troubles. The Department
of Health and Human Services’ Office for Civil
Rights (OCR) also investigated the hospital—a
Health Insurance Portability and Accountability
Act (HIPAA) covered entity—for alleged violations
of the HIPAA Privacy Rule.

On April 21, 2016, OCR announced its $2.2M
settlement4 with NYP. The agency’s investigation
revealed that the hospital had impermissibly dis-
closed two patients’ protected health information

(PHI) to the film crew and other media staff,
failed to reasonably and appropriately safeguard
the patients’ PHI from disclosure during filming,
and failed to implement policies, procedures, and
practices to protect the privacy of the patients’ PHI
during filming, all in violation of the Privacy Rule.

The Corrective Action Plan
The hospital agreed to pay a $2.2M resolu-

tion amount and enter into a corrective action
plan (CAP), to settle the investigation.5 The CAP
required the hospital to develop, distribute, and
update policies and procedures including:

• A specific prohibition on the use or disclosure of
PHI to any person or entity planning, coordinat-
ing or engaging in photography, video record-
ing, or audio recording other than for purposes
related to providing medical care without the
individual’s prior authorization;

• A process for evaluating and approving
authorizations requesting the disclosure of PHI
by NYP;

• Identification of NYP personnel or representa-
tives whom workforce members, agents, or busi-
ness associates may contact in the event of any
inquiry or concern regarding compliance with
HIPAA in relation to these activities;

• A requirement that all photography, video
recording, and audio recording conducted on
NYP premises be actively monitored by appro-
priate NYP representatives for compliance with
the Privacy Rule and NYP’s policies;

• Measures that address the following Privacy Rule
provisions: Uses and disclosures of PHI;6 safe-
guards;7 authorizations;8 training;9 and internal

Kimberly C. Metzger is a partner in the Litigation and
Intellectual Property Group at Ice Miller LLP. She focuses her

practice on data security and privacy, and drug and device

litigation. Ms. Metzger, who may be contacted at kimberly.
metzger@icemiller.com, is a Certified Information Privacy
Professional (CIPP/US) and Certified Information Privacy

Manager (CIPM) through the IAPP.

12 Intellectual Property & Technology Law Journal Volume 28 • Number 8 • August 2016

reporting procedures mandating that workforce
members report policy/procedure violations to
the hospital’s Privacy Officer as soon as possible;

• Measures providing that upon receiving infor-
mation that a member of its workforce may have
violated these policies and procedures, NYP
shall promptly investigate and address the viola-
tion in an appropriate and timely manner; and

• Application of appropriate sanctions (which may
include re-training or other instructive correc-
tive action, depending on the circumstances)
against members of NYP’s workforce, including
supervisors and managers, who fail to comply
with the NYP Policies and Procedures.

The CAP also included workforce training require-
ments, a two-year monitoring period, and acceler-
ated notice to OCR of HIPAA Rule violations.

Commenting on the settlement, OCR Director
Jocelyn Samuels emphasized:

This case sends an important message that
OCR will not permit covered entities to
compromise their patients’ privacy by allow-
ing news or television crews to fi lm the
patients without their authorization. We take
seriously all complaints fi led by individuals,
and will seek the necessary remedies to ensure
that patients’ privacy is fully protected.

OCR’s Media FAQ
Although most covered entities (CEs) and busi-

ness associates (BAs) will not experience a televi-
sion drama filming on their premises, news media
do come calling. OCR has published a film and
media guide10 to assist HIPAA-covered providers
in fulfilling their obligations to patient privacy. As a
general rule, CEs and BAs cannot disclose PHI to
the media without the individual’s (patient) prior
authorization. As the guide makes clear:

Health care providers cannot invite or allow
media personnel, including fi lm crews, into
treatment or other areas of their facilities
where patients’ PHI will be accessible in
written, electronic, oral, or other visual or
audio form, or otherwise make PHI acces-
sible to the media, without prior written

authorization from each individual who is
or will be in the area or whose PHI other-
wise will be accessible to the media. Only
in very limited circumstances, as set forth
below, does the HIPAA Privacy Rule permit
health care providers to disclose protected
health information to members of the media
without a prior authorization signed by the
individual.

It is not enough to ask or require media to mask
patients’ identities (e.g., pixilation, voice alteration)
because the media may not have unauthorized
access to patients in the first place. Providers must
also take care to institute reasonable safeguards to
limit incidental disclosures of PHI.11

Under carefully circumscribed circumstances,
a covered entity may disclose limited PHI to the
media without the patient’s prior authorization.
For example, a healthcare provider may seek media
assistance in locating family of an unidentified,
incapacitated patient if doing so is in the patient’s
best interest.12 The Privacy Rule does not require
providers to deny media access to areas of the facil-
ity generally accessible to the public.

Providers may engage contract film crews for
their own legitimate business purposes, such as
producing training videos. However the provider
must enter into a business associate agreement
with the crew if the provider will be disclosing
PHI to allow the crew to perform services on the
provider’s behalf, such as interviewing patients.
A HIPAA-compliant BAA will obligate the film
crew to comply with the Security Rule and many
provisions of the Privacy Rule, and thus to appro-
priately safeguard the PHI.13 Patient authorization
is required if any of the materials containing PHI
will be publicly disseminated.

Notes
1. Chanko, et al. v. American Broadcasting Companies,

Inc., et al., 2016 WL 1247664 (N.Y. Ct. App. March 31,
2016).

2. Id.
3. Plaintiffs brought a lawsuit against the hospital, the

treating physician, the television station, and others.
The defendants moved to dismiss the complaint, and
the New York Supreme Court partially granted the
motions, dismissing all causes of action except breach
of physician-patient confidentiality against the hos-
pital and treating physician, and intentional infliction

Volume 28 • Number 8 • August 2016 Intellectual Property & Technology Law Journal 13

of emotional distress against the station, the hospital,
and the treating physician. The defendants separately
appealed the order insofar as the motions to dismiss
were denied. Plaintiffs did not cross-appeal. The state’s
Appellate Division modified the Supreme Court’s
order by reversing the portions of the order that were
appealed, granted the motions in their entirety and
dismissed the entire complaint. That court granted
plaintiffs leave to appeal.

The appellate court modified the Appellate Division’s
order, denying the hospital’s and treating physician’s
motion to dismiss the breach of confidentiality claim
and otherwise affirming. Id. As to the intentional inflic-
tion of emotional distress claim, the court noted that
one of the elements of the tort under New York law is
“extreme and outrageous conduct.” This requirement
is “rigorous, and difficult to satisfy.” Here, the court
determined that while broadcasting an individual’s
last moments of life without consent “would likely
be considered reprehensible by most people” and the
court does not condone it, “it was not so extreme and
outrageous as to satisfy [the] exceedingly high legal
standard.” The aired footage “was edited so that it did
not include decedent’s name, his image was blurred, and
the episode included less than three minutes devoted
to decedent and his circumstances.” As compared with

other conduct the state appellate courts concluded was
not sufficiently “extreme and outrageous” to satisfy the
elements of the tort, the Chanko court determined that
the defendants’ conduct in allowing the “brief, edited
segment” to be broadcast did not support a cause of
action for intentional infliction of emotional distress. Id.

4. http://www.hhs.gov/about/news/2016/04/21/unauthorized-
filming-ny-med-results-22-million-settlement-new-york-
presbyterian-hospital.html.

5. Under the terms of the Settlement Agreement, the hos-
pital did not admit liability, and OCR did not concede
that the hospital did not violate the Privacy Rule.

6. 45 CFR 164.502(a).
7. 45 CFR 164.530(c)(1).
8. 45 CFR 164.508(a).
9. 45 CFR 164.530(b)(1).
10. http://www.hhs.gov/hipaa/for-professionals/faq/2023/film-

and-media/index.html.
11. An incidental disclosure is secondary to a permitted

disclosure, limited in nature, that cannot reasonably be
prevented (45 CFR 164.502(a)(1)(iii)). Reasonable safe-
guards to limit incidental disclosures will vary with such
things as the entity’s size and the nature of its business.

12. 45 CFR 164.510(b)(1)(ii).
13. 45 CFR 164.504(e)(2).

Copyright of Intellectual Property & Technology Law Journal is the property of Aspen
Publishers Inc. and its content may not be copied or emailed to multiple sites or posted to a
listserv without the copyright holder’s express written permission. However, users may print,
download, or email articles for individual use.

Annotated Bibliography Worksheet

Student Name:

A. Bibliographical Information:

Author(s) Name:

Title of Article:

Date of Article:

Journal Name:

B. Summary of Article:

C. Evaluation of Article:

D. Reflection on Application to Practice:

Annotated Bibliography Rubric

50 Pts

Exemplary

Developing

Needs Improvement

Written Criteria

10 Points

7 Points

4 Points

Faculty Comments

Bibliographical Information 

Bibliographical information is accurately stated and formatted.

Bibliographical information contains 2-3 errors.

Bibliographical information contains more than 3 errors.

Summary of Article 

Article is concisely summarized in one paragraph with no more than one error

Article is more than one paragraph with one error

Article exceeds one paragraph and has more than 2 errors.

Evaluation of Article

Article is evaluated in light of its purpose and credibility

Evaluation is loosely based on evidence but well organized

Evaluation does not relate to purpose of article and is not evidence-based.

Reflection on Application to Practice

Reflection contains reference to application to current of future practice merits or lack of merit.

Reflection is vague and only loosely related to current or future practice.

Reflection does not connect merit or lack of merit to practice.

Grammar, Syntax, APA Format

APA format, grammar, spelling, and/or punctuation are accurate, or with zero to three errors.

Four to six errors in APA format, grammar, spelling, and syntax noted.

Paper contains greater than six errors in APA format, grammar, spelling, and/or punctuation or repeatedly makes the same errors after faculty feedback.