Assignment task:
A documentary producer approaches a major academic medical center and asks whether he and his crew can embed themselves into the life of the hospital, capturing the amazing care the clinicians as well as the private lives of the professional staff at the hospital. The hospital sees this as an opportunity for some very good P.R., and welcomes the producer in. He and his crew sign confidentiality agreements and are given the same intensive HIPAA training program that workforce members of the hospital get. However, it is clear the the documentary is not going to be done on behalf of the hospital --- the producer will retain all rights to the footage and retain editorial control over the content. He does, however, agree that he will obtain the consent of any patient (or the patient's legal surrogate of the patient is incapacitated) he films, as soon as practicable --- before any filming if possible, and soon thereafter if the patient arrives by way of the emergency room (as the producer wants to get the drama of the patient's arrival but obviously will not get consent before the arrival occurs). He also agrees that if such consent is not obtained, he will digitize the face and any other identifying characteristic of any such non-consenting patient if the footage is used. Some clinicians raise concerns about whether this plan is compliant with the Privacy Rule, and you, a new lawyer in the Office of General Counsel, are asked to consider whether they are correct.
Q1. Is the exposure of the medical situation of the patient to the film crew prior to any filming in and of itself a violation?
Q2. If consent is obtained, after some filming has already begun, is that a violation?
Q3. Does training of the film crew, in the same way the workforce is trained, change your analysis?
Q4. Are the "good faith" efforts to de-identify anyone who has not consented through voice changing and digitization sufficient to remedy any potential violation?