I am also not a lawyer. But I did once work in a health-related field and had to go through HIPAA compliance training. And the general issue is that simply blur

I am also not a lawyer. But I did once work in a health-related field and had to go through HIPAA compliance training. And the general issue is that simply blurring out a face isn't enough. The definition of Protected Health Information (PHI) is interpreted broadly, such that the fact that a patient was in the ER due to an accident, received certain types of treatment and died is protected. Meanwhile, the definition of what is personally identifiable (i.e., ties information about condition/treatment to a specific person) includes an 18-point list of potential identifiers; responsible practice is to remove all of these prior to making information public. That 18-point list includes both the geographic location of the treatment (should not be given in any form more specific than the state) and the date of treatment (should not be given in a form more specific than the year). So I can see a strong argument that the hospital is on the wrong side of HIPAA here. And given that their argument seems mostly to be "it wasn't Our Hospital Medical Services, Inc., it was Our Hospital TV News Productions, Inc., and that one isn't covered by HIPAA", I'd begin to suspect they believe it would be a HIPAA violation for the hospital, too.