Filming Seizures -- A HIPAA Violation?

Introduction

Epilepsy is a condition of recurrent seizures. As is the case for many neurologic diseases, no blood test or scan clinches the diagnosis. Epilepsy, in particular, can be particularly difficult to diagnose. Attacks may be atypical and infrequent. Even if there are witnesses, they may not know what to look for or become too upset by the event to remember crucial details.

Because epileptic seizures are brief and unpredictable, physicians rarely witness the actual event. Seizures can be confused with syncopal events, transient ischemic attacks, and certain psychiatric conditions. It's axiomatic in medicine that an accurate diagnosis leads to the most effective treatment. To diagnose epilepsy, physicians take a detailed history, perform a physical and neurologic examination, and obtain a brain MRI and a brain wave study called an electroencephalogram (EEG). Even after all these tests, it may still be impossible to make a definitive diagnosis.

I encourage family members and people who spend time with the patient to capture seizures on their cell phones and bring them to clinic. Videos taken by hospital staff prior to a patient being admitted for monitoring — for example, in the emergency department for monitoring — are also useful. A 10-second video is often worth more than a thousand words!

Yet, some people may be afraid to videotape a patient because of fears of violating the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a complicated and often misunderstood federal statute that protects patient privacy.

HIPAA and Patient Videos

Congress passed HIPAA primarily to protect people from losing health insurance when changing jobs. Enacted several years later, the HIPAA Privacy Rule rightly recognized that digitized health information could be instantaneously and inappropriately distributed outside the healthcare system. The Rule defined protected health information (PHI) as any information that could identify or lead to an identification of the patient.

In 2003, HIPAA-covered entities were required to comply with the Privacy Rule. Covered entities include clearinghouses, health plans, and healthcare providers such as chiropractors, dentists, doctors, nursing homes, pharmacies, and psychologists. Businesses associated with covered entities, such as medical transcription or billing companies, also fall under HIPAA's purview.

To allow the business of medicine to function, HIPAA permits sharing of PHI for patient care or healthcare administration (ie, billing). Consequently, physicians and other caregivers can freely discuss information essential for patient care without breaching HIPAA.

Protecting patient privacy is hardly a new concept, extending at least as far back as Hippocrates. However, HIPAA formalized privacy protection in the United States and imposed severe penalties for privacy transgressions.

HIPAA violations must fulfill two criteria: First, one must be a "HIPAA-covered entity"; second, one must disclose PHI for nonmedical or nonadministrative purposes.

So, what does this mean in the case of filming someone's seizure?

Cut to the Tape

Among the information that falls under PHI are "full-face photos and comparable images," which, of course, would include any identifying video footage. However, bystanders filming a seizure are not covered entities. HIPAA does not apply, and there is no breach.

Not so in the case of covered entities.

It is not uncommon to admit patients with epilepsy or possible epilepsy to the hospital for EEG and video monitoring. It's the hospital doing the videotaping, which is a covered entity. Because this videotaping is for patient care, obtaining images of the patient is not a HIPAA violation. Should the videotape be released on the internet purposely or accidentally, however, that would constitute a flagrant HIPAA violation. Fines may be imposed, up to $50,000 per incident.

To protect PHI, covered entities such as clinics and hospitals invest vast resources to ensure that only authorized individuals access their computer systems. However, inappropriate sharing of patient photos by healthcare personnel has occurred, resulting in job termination, criminal charges, and jail time for the perpetrators. Thankfully, such occurrences are infrequent.

HIPAA correctly anticipated that the advent of digital media would facilitate the widespread sharing of personal information. Currently, millions, if not billions, of individuals freely share intimate details of their lives on Facebook and other social media platforms, but HIPAA reassures patients that their medical and personal information will not be shared willy-nilly by those who care for them.

If physicians wish to record a video of a patient's seizure in the hospital or outpatient setting for diagnostic purposes, they are bound by HIPAA. Prior to recording, it would be prudent to obtain written informed consent if at all possible. Another precaution is to record the video with a camera vetted by the hospital's IT department.

The Department of Health and Human Services Office for Civil Rights has a history of rigid HIPAA enforcement. Consequently, hospital policy may not allow staff to video patients with their cell phones even if they promise to delete the video after uploading to the electronic medical record. If there is a need for videotaping in the emergency department or movement disorder clinic, for example, a hospital-approved recording device should be obtained.

Similarly, families and friends should think carefully before photographing or videotaping a patient's seizure. Sharing on Facebook, Instagram, YouTube, or other social media, while not HIPAA violations, could result in significant embarrassment to the patient. Even if the uploads are accidental, they may be next to impossible to take down. Patient photos and videos should be reserved to provide medical information that assists in a patient's care, not for entertainment or other purposes.

Author's note: This is a neurologist's take on HIPAA. For legal advice, please consult an attorney.

Andrew N. Wilner, MD is a professor of neurology at the University of Tennessee Health Science Center in Memphis.

Follow Medscape on Facebook, Twitter, Instagram, and YouTube

Comments

Commenting is limited to medical professionals. To comment please Log-in.

Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.