Learn when patient video needs HIPAA authorization, required form details, when crews need a BAA, plus an NIH form example and practical on set checks.
Patient Consent for Video: HIPAA, NIH Form, and On Set Checks
Public or marketing use of patient video requires a written HIPAA authorization with all required elements. A routine treatment consent form does not cover it. If an outside film crew might see protected health information (PHI), you also need a signed business associate agreement (BAA) before anyone picks up a camera. If you do not have both, pause filming today.
TL;DR:
For website, social media, fundraising, or advertising, use a plain language authorization naming the footage, authorized users, recipients, purpose, expiration, signature, and written revocation rights.
If an outside crew or freelancer can access PHI, execute a business associate agreement before filming and limit access to necessary areas.
Have a staff member outside production obtain consent, give the patient a copy, verify identification before filming, and confirm the planned use before publication.
Raleigh Orthopaedic paid $750,000 after releasing patient imaging without a business associate agreement; protect footage with access controls, encryption, and a custody log.
Simchon ProductionsMake Patient Stories ResonateSimchon Productions creates authentic healthcare films with focused messaging and thoughtful cinematography for organizations across the tri-state area.Visit Simchon Productions
Table of Contents
When does patient consent for video require a full HIPAA authorization?
What must a valid video authorization include?
How do you run the consent process step by step?
Do outside film crews need a business associate agreement?
What should a patient video consent form include?
How do you document and protect footage after filming?
What should you check on filming day?
A producer’s view: consent is part of the story
How can a healthcare production partner make compliant shoots easier?
FAQ
Sources
When does patient consent for video require a full HIPAA authorization?
A full HIPAA authorization is required when patient footage is disclosed for public or marketing use. Recording for treatment or documentation can fall under normal operations. A testimonial on your website cannot.
HHS explains that consent and authorization are different things. Authorizations cover disclosures the Privacy Rule does not otherwise permit, and they must meet specific content and plain-language standards. HHS also says providers may not invite film crews into treatment areas where PHI is accessible without prior written authorization.
Here is how we sort the common cases:
Treatment or clinical documentation: check with your privacy team about the consent and authorization requirements for the specific recording.
Internal training: your choice, but we suggest using authorization-level language anyway.
Website, social media, fundraising, or ads: full HIPAA authorization, every time.
Media crews or outside producers: authorization plus a BAA if PHI is accessible.
Informal verbal consent or a standard treatment form does not clear the bar for public use.
What must a valid video authorization include?
A valid authorization contains the core elements listed in 45 C.F.R. §164.508, written in plain language.
Description of the PHI: what footage, images, or audio will be used.
Who may use it: the people or organizations allowed to use and disclose the footage.
Recipients: who may receive it.
Purpose: why the video is being made and shown.
Expiration: a date or an event, such as “when the campaign ends.”
Signature and date: from the patient or a legally authorized representative.
Right to revoke: a statement that the patient can revoke in writing.
The form must also explain whether treatment is conditioned on signing. For marketing video, it should not be.
Beyond the regulation, our drafting habits are simple. Name the exact platforms and audiences. Set an expiration event instead of leaving it open. Offer tiered choices, such as internal use only versus public use, rather than one all-purpose release.
Pro Tip: Read your form out loud to someone outside healthcare. If they stumble, your patient will too.
How do you run the consent process step by step?
Run it as a repeatable workflow with a clear owner, and keep the person asking for consent separate from the production team. The AMA ethics guidance says consent for non-medical filming should come from a disinterested third party, so patients do not feel pressured.
Approach the patient. A staff member outside the production team explains the project and that saying no changes nothing about their care.
Review the authorization. Walk through the purpose, platforms, expiration, and revocation rights.
Sign and copy. The patient signs and receives a copy.
Verify on site. Confirm the signed form and ID before the camera rolls.
Confirm before publishing. Check in again before any public release.
Capacity matters. The AMA advises limiting educational filming to patients with decision-making capacity, getting guardian consent in rare cases, and seeking patient assent when possible. Document any limits.
For revocation, accept written withdrawals, log them, and tell the edit team right away. A short viewing window before release helps patients feel in control.
Do outside film crews need a business associate agreement?
Yes, if the crew will have access to PHI. A film crew in that position is a business associate, and HHS says it needs a BAA and must follow Privacy and Security Rule protections. The BAA has to be fully executed before filming begins.
The cost of skipping this is real. Raleigh Orthopaedic paid $750,000 for releasing patient x-rays without a BAA in place. The same logic applies to a production vendor.
A solid BAA covers:
Permitted uses and disclosures of PHI.
Security safeguards for footage and files.
Return or destruction of recordings.
Breach notification duties.
On set, limit crew access to the areas that matter. Assign one staff member to monitor the shoot. Hold a short pre-shoot briefing on PHI limits. Keep a chain-of-custody log for every recorded file. For secure file transfer and messaging habits, this guide on HIPAA texting is a useful reference.
Pro Tip: Send the BAA to your privacy officer first. Legal review takes longer than the shoot.
What should a patient video consent form include?
A good form is short, specific, and easy to read. Include these fields:
Patient name and ID.
Description of the footage.
Intended uses and platforms.
Audience.
Expiration date or event.
Revocation instructions.
Signature and date.
Confirmation that the patient received a copy.
Tiered options work well. Offer “internal use only,” “training,” and “public marketing” as separate checkboxes so patients choose their comfort level.
For formatting and wording, the NIH publishes a sample you can study.
NICHD offers a photo/video consent form that shows clear release language organizations can adapt. Have your counsel review any version before you use it.
How do you document and protect footage after filming?
Treat footage like any other PHI. Keep signed authorizations and production records securely, following your institution’s retention policy and the authorization’s terms.
Access controls: only named people can open raw footage.
Encryption: protect files in storage and in transfer.
Retention: follow your institution’s retention policy and the authorization’s terms.
Records: keep BAAs, training logs, audit logs, and a named contact for OCR inquiries.
Regulators look for proof of process. The OCR enforcement summary for 2018 notes settlements totaling $999,000 with major hospitals that invited film crews in without first getting patient authorizations. A resolution agreement with New York and Presbyterian Hospital points to the fixes: policies banning noncare disclosures without authorization, approval and monitoring steps, workforce training, and sanctions.
What should you check on filming day?
Run this list before the first take. Our hospital video production process guide covers the wider coordination with clinical teams.
Confirm signed authorizations and photo IDs for everyone on camera, and make sure the scope matches the planned use.
Verify the BAA is in effect and brief the crew on PHI limits and the monitoring contact.
Control framing so screens, charts, and wristbands stay out of shot.
Start the custody log and confirm how files will move off site.
Agree on a stop word anyone can use to pause filming.
Pro Tip: Walk the space with your monitor before talent arrives. Spotting a whiteboard of patient names is far cheaper than reshooting.
A producer’s view: consent is part of the story
When the consent process is respectful and unhurried, patients relax on camera, and the story sounds like them instead of a script. A short viewing window before release does more for trust than any slogan. Patients who feel in control tend to speak plainly, and plain speech is what viewers believe. Rules and good storytelling pull in the same direction here. If your team wants to talk through how your consent process fits a shoot, we are happy to compare notes. For a sense of how this plays out on screen, see our patient testimonial video examples.
— Tzvi Simchon
How can a healthcare production partner make compliant shoots easier?
A production partner who works in healthcare every day can take much of this off your plate. At Simchon Productions, we build compliance into the workflow from the first call.
Here is what we can do for you:
Coordinate the BAA with your privacy team before filming.
Draft release language aligned with HIPAA for your counsel to review.
Run monitored shoots with a custody log.
Ask us about a consultation on a protected-shoot workflow. Start at Simchonproductions and tell us about your project.
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
FAQ
Is verbal consent enough to film a patient?
No, not for public or marketing use. HHS says consent and authorization are different, and public disclosure needs a written HIPAA authorization. Verbal agreement can be part of the conversation, but it does not replace the signed form.
Can a patient take back their video authorization?
Yes. The authorization must tell patients they can revoke in writing. Log the withdrawal and notify your editors and publishers right away, since footage already released may be hard to remove.
Do we need a BAA for a freelance videographer?
Yes, if the videographer will access PHI. A crew in that position is a business associate, and the BAA must be signed before filming starts. Freelancers are treated the same way as larger crews.
Who should ask the patient to sign?
Ideally someone who is not on the production team. The AMA recommends a disinterested third party so patients do not feel pressure. A privacy officer or patient relations staff member is a common choice.
How do we handle minors or patients with limited capacity?
Get consent from a legally authorized guardian where required, and seek the patient’s assent when possible. The AMA also advises limiting educational filming to patients with decision-making capacity. Document any limits on the form.