When a reporter asks about a patient: HIPAA rules for media inquiries at a medical practice

A reporter calls the front desk and asks whether a named person was treated at your practice today. Or a local news site emails your office manager after a patient posts about a bad visit. Or a camera crew asks to film in the waiting room. The person who picks up has a few seconds to decide what to say, and the HIPAA Privacy Rule gives them very little room. This guide is for owners, office managers and front desk staff at independent medical, dental, med spa, chiropractic and integrative practices.

It covers the facility directory rule that hospitals rely on when they give a one-word condition, why that rule does little for an outpatient office, when a patient’s written authorization makes a media conversation possible, the media notice the Breach Notification Rule requires after a large breach, and a short script and call log for the front desk. Press releases, paid placements and five OCR media settlements are covered in our guide to medical practice press releases and media interviews. Replies to online reviews, which raise the same issue in writing, are covered in HIPAA and negative review replies, and staff posting rules are in our social media policy guide. Card, reminder and post decisions after a patient dies are covered in our guide to practice contact after a patient dies. If coverage of your practice later goes on your own website, our guide to “as seen on” media badges covers paid segments, outlet logos and patients in the clip.

The short version

• The default answer is no. A covered practice may not disclose protected health information to the media unless the Privacy Rule permits it or the patient has signed a valid authorization.
• The directory rule is narrow. A provider that keeps a facility directory may give a patient’s location and a general condition, such as fair or stable, to a person who asks for that patient by name, unless the patient objected.
• No directory, nothing to confirm. The directory permission is tied to a directory of people in the facility. An office that keeps none has no directory information to give.
• A patient going public does not open the door. OCR settled with an allergy practice whose doctor answered a reporter after the patient contacted the station.
• One spokesperson, one script, one log. Media calls go to a named person, the front desk uses the same words each time, and each call is written down.

Why a reporter’s question is a privacy question

Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires. Protected health information is defined in 45 CFR 160.103 as individually identifiable health information in any form or medium, including spoken words. The definition stops covering a person only once they have been deceased for more than 50 years, so a question about a patient who died last year is still a question about protected information.

The HHS Office for Civil Rights (OCR) FAQ on media and film crews, last reviewed January 9, 2023, says that generally the Privacy Rule does not permit health care providers to disclose protected health information to media personnel without a prior authorization signed by the patient or their personal representative. It says this is allowed only in very limited circumstances. Confirming that a named person is your patient is itself a disclosure: it tells the caller that the person received care from you, and for a specialty practice it can tell them what kind.

The FAQ also says covered entities can continue to inform the media about their treatment services and programs, as long as they do not share protected health information without authorization. That is the space a practice has with the press: talk about services, policies and general health topics, and say nothing about any individual.

The facility directory and the one-word condition

The one route the rule gives for answering a question about a named patient without a signed authorization is the facility directory in 45 CFR 164.510(a). Under it, a covered health care provider may keep a directory of individuals in its facility with four items: the person’s name, their location in the facility, their condition described in general terms that does not communicate specific medical information, and their religious affiliation. It may disclose the religious affiliation only to clergy. It may disclose the other items to people who ask for the individual by name.

The rule does not list words for the condition. The preamble to the 2000 Privacy Rule, at 65 FR 82522, gives examples: fair, critical, stable. That is where the one-word condition that hospital media lines use comes from. A diagnosis, a procedure, a test result or the name of the treating specialist goes beyond general terms.

Three limits apply. The caller must ask for the person by name; a question such as “who did you treat after the crash” does not qualify. The provider must tell the patient what the directory will include and who can receive it, and give them the chance to restrict or opt out, under 164.510(a)(2); the opt-out may be oral. And if the patient cannot be asked because of incapacity or an emergency, 164.510(a)(3) allows directory use only if it is consistent with any known prior preference of the patient and in their best interest in the provider’s professional judgment, with the chance to object offered once it becomes practicable. The OCR FAQ confirms that directory information may go to any person, including the media, under these conditions.

What this means for an outpatient office

The directory permission describes a directory of individuals in the provider’s facility, which fits a hospital or another setting where patients stay. If your practice does not keep a facility directory and has not told patients what one would contain, there is no directory information to give out, and the safe answer to “is this person your patient” is that you cannot confirm or deny whether anyone is a patient.

Give the same answer to each caller. If the front desk says “no, they are not a patient” to one caller and “we cannot say” to another, a reporter learns something from the difference. The same line works for a caller who says they are a relative; a request from family or friends involved in a patient’s care follows 45 CFR 164.510(b), which is a separate process with its own steps, not a media rule.

One more limited permission is named in the OCR FAQ. A covered entity may seek the media’s help to identify or locate the family of an unidentified and incapacitated patient, and may disclose limited information for that purpose if, in its professional judgment, doing so is in the patient’s best interest, under 45 CFR 164.510(b)(1)(ii). That is a hospital situation and does not turn up at a routine office.

When the patient goes to the media first

A patient who complains to a news station has not given you permission to answer with their health information. In the case announced by HHS on November 26, 2018, a patient of Allergy Associates of Hartford contacted a local television station about a dispute with one of the practice’s doctors. According to the HHS press release, the reporter contacted the doctor for comment and the doctor disclosed the patient’s protected health information, after the privacy officer had told the doctor to either not respond or respond with “no comment”. The practice agreed to pay 125,000 dollars and to a corrective action plan with two years of monitoring. Our press release guide covers this case and four others in detail.

What you can say in that situation is a statement about your policies, not about the person: that you take patient concerns seriously, that privacy law does not allow you to discuss any individual, and how any patient can raise a concern with the practice. The same applies to review sites and social media, as our guide to HIPAA and negative review replies shows.

When a patient wants their story told

A patient story can be worth telling with the patient’s full agreement: a recovery, a new service they used, an event they spoke at. For that, the route is a written authorization under 45 CFR 164.508. Under 164.508(c), a valid authorization must describe the information to be disclosed in a specific and meaningful way, name who may disclose it and who may receive it, describe each purpose, carry an expiration date or event, and be signed and dated. It must also tell the patient of their right to revoke it in writing.

For a media story, make the authorization specific. Name the outlet or describe the class of recipient (for example, “[News outlet] and its reporters”), list what may be discussed (the procedure, the dates, photographs), and set an end date. An authorization signed for a website testimonial does not cover a television interview unless it says so. Our guide to patient photo and video consent covers how to run the form, revocation and storage.

Cameras raise a wider issue. The OCR FAQ says providers may not invite or allow media personnel into treatment or other areas where patients’ information will be accessible without prior written authorization from each patient who is or will be in the area, and that masking identities later by blurring, pixelation or voice changes is not sufficient. It also says the rule does not require providers to keep the media out of areas open to the public, such as public waiting areas. Plan the shoot with our healthcare video marketing guide.

When the news is about your practice: breach notice to the media

There is one situation where the Privacy Rule’s companion, the Breach Notification Rule, requires you to contact the media. Under 45 CFR 164.406, for a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity must notify prominent media outlets serving that State or jurisdiction. The notice is due without unreasonable delay and no later than 60 calendar days after discovery of the breach.

The media notice must meet the content rules for notices to individuals in 164.404(c): a brief description of what happened with the dates of the breach and of its discovery if known, the types of information involved, steps people should take to protect themselves, what the practice is doing to investigate, mitigate harm and prevent further breaches, and contact procedures that include a toll-free number, an email address, a website or a postal address. It must be in plain language.

This is a legal notice, not a press release. Have your health care attorney and privacy officer write it, keep it to the required content, and route follow-up calls from reporters to your spokesperson with the same script as any other media call.

A media policy that fits a small practice

Under 45 CFR 164.530(b), a covered entity must train its workforce on its privacy policies as necessary and appropriate for their functions, and under 164.530(e) it must have and apply appropriate sanctions against workforce members who fail to comply. A one-page media policy is how those duties reach the front desk.

• A named spokesperson and a backup. Media questions go to them, whether they arrive by phone, email, a social media message or a clinician’s personal phone.
• Privacy officer review. Any statement that touches a patient, a complaint or an incident is reviewed before it goes out.
• A front desk script. The same words for each media call, written down and posted where calls are answered.
• A call log. Date, time, caller, outlet, contact details, the question asked, who took the call and what was said.
• Cameras. No filming in clinical or records areas without the authorizations the OCR FAQ describes.
• Training and sanctions. Train new hires and the whole team each year, record the training, and document sanctions when the policy is broken.
• State law check. Under 45 CFR 160.203(b), state privacy laws that are more stringent than HIPAA stay in force, so check yours.

What to say when a reporter calls

The front desk does not need to judge whether a question is safe. Their job is to use the script, take details and pass the call on. A short script can read like this:

• “Thank you for calling [Practice name]. I am not able to answer media questions, but I can take your details for [spokesperson name].”
• If asked whether someone is a patient: “Privacy law does not allow us to confirm or deny whether anyone is a patient here.”
• If pressed: “I understand. I will pass your question to [spokesperson name], who will get back to you by [time].”
• Then write down the caller’s name, outlet, phone, email, deadline and question, and send it to the spokesperson at once.

The spokesperson can then decide whether to send a general statement about services or policies, decline, or, if a patient has signed an authorization for this outlet and purpose, arrange an interview within its terms.

Questions to ask before you answer

• Does this answer confirm, deny or hint that a named person is our patient?
• Do we keep a facility directory, and did this patient get the chance to opt out of it?
• Is there a signed authorization that names this outlet, this purpose and this information, and has it expired or been revoked?
• Could anyone in the frame or within earshot be a patient who has not signed?
• Has the privacy officer reviewed the statement?
• Is this a breach that needs media notice under 45 CFR 164.406, with its own content and deadline?
• Does our state have a stricter privacy law that applies?

Use and avoid

• Use: “Privacy law does not allow us to confirm or deny whether anyone is a patient here.” Avoid: “They were here, but I cannot say why.”
• Use: “We take patient concerns seriously, and any patient can reach our practice manager at [contact].” Avoid: “That patient missed three appointments before this.”
• Use: “Our office offers [service] and here is how it works in general.” Avoid: “A patient I saw last week had exactly this.”
• Use: “[Spokesperson name] will call you back by [time].” Avoid: “No comment” followed by an off-the-record chat.
• Use: a signed authorization naming the outlet and the purpose. Avoid: a verbal “they said it was fine”.

An illustration

This example is invented. A reporter from [News outlet] calls [Practice name], a dental office in [Town], at 4:40 on a Friday. A patient has posted that they were turned away during a toothache, and the reporter asks the front desk whether the person was seen that day and why they were not treated.

The front desk reads from the script: the practice cannot confirm or deny whether anyone is a patient, and the owner, who is the named spokesperson, will call back by noon on Monday. The call goes in the log. Over the weekend the owner and the privacy officer agree on a short statement about the office’s emergency appointment policy and how any patient can raise a concern. The statement says nothing about the person who posted. A dentist who gets a call from the same reporter on their own phone gives the same line and forwards the details to the owner.

Checklist

• Name a media spokesperson and a backup, and tell the whole team.
• Write a front desk script and post it where calls are answered.
• Start a media call log with date, caller, outlet, question and response.
• Decide whether your practice keeps a facility directory; if not, train staff to neither confirm nor deny.
• Use a media-specific authorization under 45 CFR 164.508 for any patient story.
• Keep cameras out of clinical and records areas without the authorizations the OCR FAQ describes.
• Add media notice under 45 CFR 164.406 to your breach response plan.
• Train staff on the policy, record it, and document sanctions when it is broken.
• Check your state’s privacy law for stricter rules.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For media and publicity, we keep patient details out of what we write, publish general service and event news, and send any statement about a patient or an incident back to you and your privacy officer before it goes out. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 164.510: Uses and disclosures requiring an opportunity for the individual to agree or to object (facility directories)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 160.103: Definitions (protected health information)
• 45 CFR 160.203: General rule and exceptions (state law preemption)
• 45 CFR 164.406: Notification to the media
• 45 CFR 164.404: Notification to individuals
• 45 CFR 164.530: Administrative requirements (training and sanctions)
• HHS OCR FAQ: media and film crews in treatment areas (last reviewed January 9, 2023)
• HHS press release: Allergy practice settles doctor’s disclosure of patient information to a reporter (November 26, 2018)
• 65 FR 82462: Standards for Privacy of Individually Identifiable Health Information (December 28, 2000), preamble at 82522

More in Healthcare marketing rules