Filming in Healthcare: How to Produce Medical Videos Without a HIPAA Problem

A hospital marketing director once told us the fastest way to kill a video project: show the first cut to the compliance officer after the shoot. A whiteboard with patient names in the background of one shot, a face reflected in a glass door in another — and suddenly half the footage is unusable, the reshoot budget doesn’t exist, and everyone involved has learned what “PHI” stands for the expensive way.

Healthcare is one of the most rewarding spaces in corporate video. Patient stories move people. Physician profiles build trust no ad copy can match. But medical video production runs on a different set of rules than a standard brand shoot, and those rules start long before anyone touches a camera. Here’s the playbook, from a production point of view.

What actually counts as PHI on camera

HIPAA protects “protected health information” — and on a video set, PHI hides in more places than people expect. A face is the obvious one. Less obvious: a name on a wristband, a chart on a monitor, a schedule board down the hall, a distinctive tattoo, a room number paired with a visible condition, even a voice describing symptoms. If footage lets someone identify a patient and connect them to care they received, it’s a problem.

The practical rule for crews: treat every surface in a clinical environment as if it’s displaying patient data, because it probably is. That mindset changes how you frame, where you point lights, and what ends up soft in the background versus readable in 4K.

Consent is a document, not a nod

For any patient who appears on camera, verbal agreement on the day is worth nothing six months later. You need a written authorization that covers what was filmed, where it will be used (website, social, paid ads, trade shows — list them), and for how long. Healthcare organizations usually have their own authorization forms; use theirs, not a generic talent release, and get the signed copies to their compliance team before the edit starts.

Two production habits that save projects:

Film consent, then film content. Rolling on the authorization conversation itself creates a record and sets a professional tone with patients who are often nervous.

Plan for revocation. Patients can withdraw authorization. If a testimonial anchors your whole edit, that’s a risk to flag in pre-production — build the story so no single patient’s removal collapses the cut.

The shoot: control the frame, control the room

On location in a clinical setting, the production plan needs items that never appear on a normal call sheet: a walkthrough with facility staff to clear or cover anything displaying patient information, a designated escort who can answer “can we shoot this hallway?” in real time, and a hard rule that no crew member photographs the set for personal social media. One behind-the-scenes Instagram story with a chart in the background undoes everything the main production did carefully.

Schedule around patients, not just around light. Early mornings and administrative wings exist for a reason.

The part everyone forgets: what happens to the footage

Here’s the uncomfortable question that separates professional healthcare production from a liability: once you’ve filmed identifiable patients, your drives now contain PHI. The cards in the DIT bag, the editor’s laptop, the cloud review links — all of it.

That has real consequences. A production company handling PHI for a covered entity is typically a “business associate” in HIPAA terms, which means signing a Business Associate Agreement (BAA) and actually living up to it: encrypted storage, access limited to people on the project, review links that expire and require a password instead of open URLs anyone can forward, and a documented answer to “who had access to this footage, and when?” If a client’s compliance team asks that question and the honest answer is “it’s on a Dropbox link from March,” the relationship is over.

This is one area where it pays to borrow discipline from industries that live under audit. The setup that satisfies a hospital’s compliance office — encrypted drives, per-project access, expiring delivery, an audit trail — is the same infrastructure any security-conscious business runs daily, and it’s worth having an IT and security partner configure it once, properly, rather than improvising per project. Firms like everpinelab.com build exactly this kind of controlled environment for small businesses; for a production company that wants healthcare clients, it’s the difference between pitching “we make great videos” and “we make great videos your compliance team will approve.”

Pre-production checklist for a healthcare shoot

Before the first scout, confirm: who signs the BAA, which authorization form patients will sign and who collects it, which areas of the facility are approved for filming, who the on-set compliance escort is, how footage will be stored and transferred (encrypted, access-limited), how review cuts will be shared (expiring, password-protected), and how long you’re required to retain — or destroy — raw footage after delivery. One page, ten lines, and it turns the scariest client category in corporate video into a repeatable process.

None of this is legal advice — your client’s counsel and compliance office get the final word, always. But walking in with this checklist means the conversation with them takes twenty minutes instead of derailing the timeline.

Why it’s worth it

Healthcare organizations have real budgets, ongoing video needs, and very few agencies they trust. The barrier to entry isn’t creative — it’s operational. Handle consent, framing, and footage security like it’s second nature, and you become the production partner they never want to replace.

The story of a patient who got their life back is the most powerful footage you’ll ever cut. Earn the right to tell it.