Question: We are holding a Halloween party for our children’s ward. A musician has volunteered to host a sing-along with the kids and a local church is going to send some volunteers (dressed in costume) to hand out small candies and toys and paint children’s faces (as the children are able). Do we have to get any special consent for HIPAA purposes prior to holding the party? What about if we take pictures?
Answer: You do not need to have patients (or their parents) sign an authorization form permitting volunteers to be present on the children’s ward. It is not a violation of patient privacy to have those individuals present for the purpose of hosting a holiday celebration for hospitalized children.
If volunteers intend to go into patient’s rooms (instead of greeting them at a centralized location, such as a lounge), you should consider getting the patient’s prior consent (in this case, the parent’s prior consent) due to the greater likelihood that the patient’s privacy and modesty could be encroached.
You do not need to have volunteers sign business associate agreements (after all, they are not providing an administrative service for the hospital – some might argue they are providing a treatment or health care operations function by keeping patients happy). But that does not mean privacy issues are not raised by the presence of party volunteers. Volunteers who come to the hospital to provide services to patients, including brightening their spirits, fall within the hospital’s “workforce” and should be given basic training about patient privacy. This does not mean that those individuals need to sit through an entire HIPAA training session. The “training” can be limited to that necessary for the role they will play in the hospital. In the case of individuals coming to the hospital on a one-time or occasional basis to play music, paint faces, or help with holiday celebrations, the HIPAA training might consist merely of a statement signed by volunteers indicating that they understand patient privacy is paramount and they agree not to disclose specific information about patients, including their identities and specific health information, outside of the hospital. Consider, too, having them agree not to take pictures.
Finally, it is okay to take pictures when events such as a Halloween party are hosted. Before any such pictures are taken, however, we recommend that patients/parents are clearly informed that photographs will be taken at the event. And better yet, get a signed authorization from the parent of each patient who is photographed (this could be attached to a general “permission form” to attend the party). This will ensure that any future use of the photographs is authorized (for example, posting on a bulletin board, sharing with other parents on the ward, publishing in a hospital newsletter, release to a newspaper, or advertisement in a fundraising communication).