Patient Story Videos: HIPAA and Consent Basics for Health Nonprofits

A patient's story is often the most powerful video a health nonprofit can make. It is also the one most likely to go wrong if consent is handled loosely. This guide covers the HIPAA and consent basics comms leads, development directors and hospital foundation teams need before the camera rolls, with links to the primary regulations. It is practical guidance, not legal advice: have your privacy officer or counsel review your release forms.

Key facts

• HIPAA applies to covered entities (health plans, clearinghouses and providers that transmit health information electronically in standard transactions) and their business associates (HHS).
• Using protected health information (PHI) for marketing requires the patient's written authorization under 45 CFR 164.508(a)(3) (HHS FAQ).
• A valid authorization needs six core elements, including an expiration date or event and the patient's signature and date (45 CFR 164.508(c)).
• The HIPAA fundraising exception covers limited data for targeting appeals (demographics, dates of service, department, treating physician, outcome, insurance status), not featuring a patient on camera (45 CFR 164.514(f)).
• Full-face images are listed HIPAA identifiers, so a patient video cannot be "de-identified" while showing a face (164.514(b)(2)).
• OCR has fined hospitals for filming without authorization: $2.2 million (NewYork-Presbyterian, 2016) and $999,000 across three Boston hospitals (2018).

Does HIPAA apply to your organization?

Start here, because the answer changes your paperwork.

• Hospitals, clinics, FQHCs and health plans that bill electronically are covered entities. Any patient story involving information they hold needs a HIPAA-compliant authorization.
• Hospital foundations are typically "institutionally related foundations." They can receive limited PHI for fundraising under 164.514(f), but a video that identifies a patient and their care is a use beyond that exception.
• Patient advocacy charities, disease associations and support nonprofits that don't provide care or act as a business associate are generally not covered entities, per the definitions HHS publishes. HIPAA may not apply, but state privacy law, right-of-publicity law and basic ethics still do. Use a clear media release either way.
• Your video agency may need a business associate agreement if the covered entity shares PHI with it to produce the video. Settle this before scouting.

What a HIPAA authorization for a patient video must include

Under 45 CFR 164.508(c), the form must be in plain language and include:

1. A specific description of the information to be used (for example: name, image, voice, diagnosis, treatment details discussed on camera).
2. Who is authorized to make the disclosure (the hospital or clinic).
3. Who receives it (the foundation, the production company, the public through named channels).
4. The purpose of each use (fundraising video, website, social media, gala screening, paid ads).
5. An expiration date or expiration event.
6. The patient's signature and date, or a personal representative's signature with a description of their authority.

It must also state that the patient can revoke in writing, whether treatment is conditioned on signing (it can't be for marketing), and that information disclosed may be redisclosed and no longer protected. The patient gets a copy of the signed form. If a third party pays for the communication, the authorization must say so.

Revocation and expiration in practice

A patient may revoke an authorization at any time in writing, except to the extent you've already acted in reliance on it (164.508(b)(5)). For video, that means building a takedown plan into your workflow: know where every cut lives (YouTube, website, paid social, partner channels) so you can stop new uses quickly. Pick an expiration that matches your realistic use, such as five years or "end of the 2027 capital campaign," and calendar a renewal conversation before it lapses.

Minors and patients who can't sign

For an unemancipated minor, the parent or guardian with authority to make health care decisions under state law usually signs as personal representative (164.502(g)). There are exceptions where a minor lawfully consents to their own care. For a deceased patient, the executor or administrator acts as personal representative. Best practice for pediatric stories: get the parent's signature and the child's own assent on camera, and revisit consent when the child turns 18.

What the enforcement cases teach

• NewYork-Presbyterian, $2.2 million (2016): HHS found the hospital disclosed two patients' PHI to the film crew of the TV program "NY Med" without authorization and lacked policies to protect privacy during filming (HHS).
• Boston Medical Center, Brigham and Women's and Massachusetts General, $999,000 combined (2018): the hospitals invited crews to film an ABC documentary series "without first obtaining authorization from patients" (HHS).

The lesson: background patients, whiteboards, monitors and hallway conversations count. Authorization for your featured patient does not cover everyone else in the frame.

Media release vs. HIPAA authorization

A standard media or talent release grants permission to use someone's name, image and voice. A HIPAA authorization grants permission for a covered entity to use or disclose health information. If you are a covered entity, a media release alone is not enough, and a HIPAA authorization alone may not cover publicity rights in your state. Many health organizations use both, or a combined form drafted by counsel. Non-covered health nonprofits still benefit from naming the health details the participant agrees to share, so there is no ambiguity later.

A shoot-day checklist for health nonprofits

• Signed authorization (or media release for non-covered nonprofits) in hand before the crew arrives, reviewed by your privacy officer.
• A pre-interview covering what the patient is comfortable discussing on camera, including diagnosis and prognosis.
• Clear sets: no patient boards, charts, screens or wristbands in shot; schedule filming in closed areas or off-hours.
• A staff escort who knows privacy rules on set at all times.
• Releases for every clinician, volunteer and family member who appears.
• A review screening with the patient before publishing, so there are no surprises.
• A disclosure if a participant was compensated or is connected to staff. The FTC Endorsement Guides require clear disclosure of material connections in advertising, and it's sound practice in appeals too.

Health stories we've produced

Happy Productions has produced clinic and health-access stories for organizations including Project HOPE and a documentary on Medicaid coverage for CREPH. The checklist above is the backbone of a good health shoot: consent first, a clean set, and a patient who has seen the final cut before donors do. See our approach for healthcare nonprofits, real healthcare nonprofit video examples, our broader legal tips for nonprofit video production and the testimonial video guide.

Book a free 15-minute consult to plan a patient story that moves donors and protects the people who share it.