October 2, 2018 • RBS

Categories: Security News

Who were affected:

Boston Medical CenterBrigham and Women’s Hospital, and Massachusetts General Hospital

How many records impacted:



Occurred: 10/1/2014

Discovered by the Organization: Unconfirmed

Publicly Reported: September 20, 2018

What Happened:

Trauma centers are fascinating places. Lives very often hang in the balance, with highly skilled teams of professionals working frenetically to ensure this day is not someone’s last. Given the drama surrounding these facilities, it’s no wonder emergency rooms have long been fodder for the entertainment industry. It’s also no surprise media producers have moved beyond fictionalized accounts and seek access to these facilities to capture the real life experience. This was the case with ABC’s documentary series Save My Life: Boston Trauma.

Between October of 2014 through January of the following year, film crews from ABC spent time in the emergency and operating rooms of Boston Medical Center, Brigham and Women’s Hospital and Massachusetts General Hospital, capturing patients’ stories and the staff’s efforts to help them. Although the hospitals took steps to ensure proper patient permissions were obtained and patient privacy was respected, according to Health and Human Services Office of Civil Rights, more should have been done. On September 20th, HHS announced the three hospitals would collectively pay nearly $1,000,000 in fines to settle allegations hospital staff impermissibly disclosed protected health information to ABC employees during production and filming. In the cases of Brigham and Women’s Hospital, and Massachusetts General Hospital, it seems patient information was revealed prior to getting written permission. So while it appears the correct permission was obtained, it was done after protected information had already been shared. The chain of events at Boston Medical Center is less clear. The resolution agreement does not reference the timing of disclosure, only that private information was inappropriately shared. It is interesting to note Boston Medical Center’s share of the fine was $100,000, the lowest of the three penalties assessed for the indiscretions.

Curiously, this is not the first time filming by ABC has landed a hospital in hot water. On April 28th, 2011, Mark Chanko was hit by a sanitation truck while crossing the street. He was treated at NewYork-Presbyterian Hospital / Weill Cornell Medical Center emergency room but succumbed to his injuries later that day. The film crew from ABC’s NY Med was in the E.R. capturing the action for an upcoming episode. The show’s producers blurred Mr. Chanko’s face as they documented his last hours, but they did not get his permission to film – not that Mr. Chanko was in any position to give such permission had he been asked. Apparently, the producers did not seek the family’s permission either. Some 16 months after Mr. Chanko’s death, his widow happened to catch an episode of NY Med. She recognized her husband’s voice and immediately knew the dying victim on her TV screen was her husband, Mark Chanko.

The family filed suit against ABC and New York-Presbyterian (NYP) and reported the matter to Health and Human Services, Office of Civil Rights. On April 21, 2016, HHS announced they had reached a $2.2 million settlement with NYP for failing to protect patient privacy by allowing excessive access to the E.R. and allowing the filming of two patients in significant distress, including Mr. Chanko’s death.

Why It Matters:

In some respects, Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital should consider themselves lucky. NewYork-Presbyterian has had its share of breaches over the years, which could in part explain why they were assessed a $2,200,000 penalty for the access they gave ABC film crews compared to the $515,000 assessed against Mass General, the $384,000 against Brigham & Women’s, and the $100,000 allocated to Boston Medical Center.  

More than the costly fines – these penalties highlight the fact that it is rarely a good idea to allow third parties real-time access to medical events. Emergency medical providers are trained to focus on what is happening with the patient and rightly so. Asking or even expecting hospitals to be able to adequately ensure patient privacy during emergency care is an unnecessary burden in the midst of a crisis. Any provider thinking of opening their doors to film crews or the media should take a close look at these resolution agreements and may want to think twice about sharing the experience.

Our products
The Platform
Risk Based Intelligence
Learn more
Vulnerability Intelligence
Learn more
Cyber Risk Analytics
Threat Intelligence
Learn more
Risk Management
Learn more