This article is for informational and educational purposes only and does not constitute legal advice.
A patient story can help people understand a nonprofit’s work. In a health care setting, though, filming is also a privacy-planning exercise. The key decisions need to happen before a camera enters the facility, not during editing.
Federal guidance from the U.S. Department of Health and Human Services (HHS) says a HIPAA-covered provider generally may not allow media personnel or film crews into treatment areas, or other places where they can see, hear, or otherwise access patient protected health information (PHI), without prior written authorization from each affected patient or an appropriate personal representative. HHS also makes clear that blurring faces, pixelating footage, or changing voices afterward does not fix unauthorized access that occurred during filming.
Start with scope and the right people
HIPAA does not apply to every nonprofit that works on a health-related cause. It regulates covered entities, including health plans, health care clearinghouses, and certain providers that conduct specified electronic transactions, as well as their business associates. An outside nonprofit may become a business associate when it performs work for a covered entity involving PHI. HHS explains these roles and relationships.
That distinction does not make filming risk-free when a nonprofit is not itself HIPAA-regulated. The facility may have privacy policies, contracts, or state-law requirements that control access. Before scheduling, identify the health care organization’s communications contact and privacy or compliance lead. Ask them to review the story concept, intended locations, participants, crew access, storage plan, and publication plan.
Use a conservative default in clinical spaces: do not enter or film until the facility has approved the plan and identified the required authorizations. Select willing participants in advance whenever possible, instead of recording broadly and trying to isolate usable material later.
Recognize what a camera and microphone can expose
A privacy problem is not limited to an interviewee’s face. PHI can appear visually, in writing, electronically, or in conversation. HHS identifies risks such as patient names or medical record numbers on wristbands, charts, door signs, and badges; computer screens and monitor readouts; spoken care discussions; and information on whiteboards. A person’s presence in a condition-specific treatment setting can also reveal information about care. HHS’s film-crew guidance provides these practical examples.
Plan the shot and sound environment accordingly. A closed set is often the safer approach: limit the space to the authorized participant, essential participating staff or caregivers as appropriate, and a small crew. Keep other patients outside camera and microphone range. Clear or shield paperwork and screens, and pause care conversations within earshot. HHS identifies privacy screens and opaque barriers as examples of reasonable safeguards.
Some entrances or waiting areas may be generally open to the public. HHS says HIPAA does not itself require providers to exclude media from every such area. That is not permission to film there. The facility can prohibit filming, and another person’s PHI could still be exposed. Obtain location approval and follow the facility’s instructions.
Use the right authorization, not a generic release
An ordinary photo or talent release may address production permissions, but it may not meet HIPAA’s requirements. When HIPAA authorization is required, voluntary consent alone is not enough unless it contains the elements of a valid authorization. Those elements include details about the information involved, who may disclose it, who may receive it, the purpose, and an expiration date or event. HHS distinguishes consent from authorization.
Use the provider’s approved HIPAA authorization process rather than treating a standard release as a substitute. The process should also be genuinely voluntary. Except in limited circumstances, a covered entity may not make treatment or coverage conditional on signing an authorization. Explain the project plainly, allow time to decide, and make clear that declining will not affect care.
Ask the provider whether the nonprofit, filmmaker, editor, storage provider, or subcontractors will receive PHI on the provider’s behalf. If a covered provider hires a crew for training or public-relations material and the crew may access PHI, HHS says a business associate agreement is required. A BAA is a contract that sets safeguards and limits for PHI use, disclosure, and return or destruction. It is not a universal requirement for every nonprofit production; the provider’s privacy office and counsel should determine the relationship.
Treat publication as a separate approval point
Even when a contract crew works under a BAA, HHS says patient authorizations are required before patient PHI in the resulting materials is publicly posted, printed, or otherwise distributed. Before release, have the facility conduct a final review of both picture and sound. Check for unintended names, screens, signage, care discussions, monitor details, or contextual clues that reveal another patient’s care.
Build a stop-use process into the project. A person may revoke a HIPAA authorization in writing at any time. The revocation is effective when the covered entity receives it, although it does not undo actions already taken in reliance on the authorization. HHS explains the timing of revocations. The provider should maintain the authorization record and tell the nonprofit whom to contact if a participant changes their decision.
Escalate complex participant and program questions
Do not assume a parent’s signature always resolves authorization for a minor. Under HIPAA, state law substantially affects who can act as a personal representative, and exceptions may apply when a minor can consent to specific care or someone else has legal authority. Ask the provider to verify who may authorize disclosure for the care and jurisdiction involved. HHS guidance on personal representatives explains this limitation.
State health-information privacy laws can be more protective than HIPAA and may continue to apply. For substance-use-disorder programs, stop and obtain specialized review. Federal confidentiality rules in 42 CFR Part 2 apply to federally assisted programs providing SUD diagnosis, treatment, or referral and generally restrict sharing records that identify someone as having or having had a substance use disorder unless permitted by Part 2. HHS’s Part 2 overview notes that compliance with the 2024 final rule has been required since February 16, 2026.
The most reliable approach is simple: design a controlled story, obtain the facility-approved permissions before access, protect what the crew can see and hear, and pause for privacy review before publishing. HHS has resolved investigations involving hospitals that allowed television crews access to patient PHI without authorization, a reminder that careful planning is more than a production detail.
Sources / References
HHS: Media and film crews in treatment areas
HHS: Guidance on media access to PHI in facilities
HHS: Covered Entities and Business Associates
HHS: HIPAA consent and authorization