We continue with our series of general educational articles penned by one attorney, an MD, JD, giving you a view of the world through a malpractice plaintiff attorney’s eyes. This attorney is a seasoned veteran.  The series includes a number of pearls on how to stay out of harm’s way. While I do not necessarily agree with 100% of the details of every article, I think the messages are salient, on target, and fully relevant.  Please give us your feedback – and let us know if you find the series helpful. Finally, these articles are not intended as specific legal advice. For that, please consult with an attorney licensed to practice in your state.

Photography has been a part of medicine since, well, the advent of photography. However, with the dissemination of the smartphone camera, anyone can grab and share an image with barely two screen taps.

It is essential doctors understand the rules they must follow to avoid breaches of both privacy and ethics. Those who violate these rules run the risk of ruin.

(Note: For the purpose of this topic the rules applying to still photography should be assumed to apply to videos as well.)

There’s a lot to unpack here, so we’re addressing the major issues in two parts. With that said, let’s dive in. 

Is a photograph Protected Health Information (PHI)?

It may be, depending on what it includes.

PHI is defined for HIPAA as “individually identifiable health information transmitted or maintained by a covered entity or its business associates in any form or medium.” State confidentiality laws follow a similar paradigm. Translated from statute speak, this means that PHI is a medical fact about a patient coupled to something that can reasonably reveal the patient’s identity.

A patient photo is therefore considered to be PHI if it includes any of the following:

• Any portion of the face
• Tattoos
• Name or initials
• Birth Date
• Social Security number
• Address
• Date of service
• Medical Record Number
• And more…

However, this list is the floor, not the ceiling. For example, a photo of just Mikhail Gorbachev’s distinctive port-wine mark would easily identify him. Similarly, if your patient has a distinctive physical feature, which even may be the condition itself, assume that you have entered the realm of PHI and follow the privacy requirements. Also be alert for jewelry and clothing that may identify the patient, such as a name or initial necklace, or a T-shirt with a business name on it.

Err on the side of caution. You will never be sorry that you got consent to take an image from a patient who is willing rather than deal with the blowback from a patient who is not.

Can I store photographs on a digital camera or on my phone?

Possibly. The issue will be the capacity for encryption for photos that contain PHI.

Your camera is most likely not capable of this without expensive modification so it is best to download to a HIPAA-compliant device or into your EHR system as soon as possible.

Of course, if you are carrying PHI-containing images on your phone or on another mobile device then the usual care that you need to take as far as safe transport and storage apply just as they do for any other PHI (most modern smartphones are equipped with encryption by default). One practice was fined heavily when a laptop containing PHI was stolen from a car. It was sanctioned not for being a crime victim but for not securing the device safely, or more accurately for not having the data encrypted.

Are photographs part of the Designated Record Set (DRS)?

Yes, they are.

The DRS includes medical records that are used in whole or in part for a covered entity to make treatment decisions. This would encompass photography used to document the pre-treatment state and then, as is often done in wound care clinics, for example, to assess treatment, comparing the baseline condition to the most recent intervention.

The Treatment, Payment, and Healthcare Operations exceptions otherwise requiring a patient to specifically authorize the release of their PHI in certain circumstances will then apply to these images. So, no signed patient authorization would be required.

Can I share patient photographs that contain PHI with a colleague as part of a curbside or consultation?

Yes. These uses would come under the Treatment exception that allows PHI to be shared among practitioners as part of the care of the patient without the patient signing a specific release.

However, if you are going to be sending the image electronically then you must use a HIPAA-compliant system, just as you would for any other part of the medical record.

Can I receive photographs from a patient if they are not using a HIPAA-compliant system?

You can, as they are not a covered entity. This is no different from PHI-containing documents that they may send to you.

In fact, having a patient send you an image of their rash or of their swollen eye or of the spider that bit them or even a video of the fact that they have trouble balancing can be very useful in making your assessment when you are on-call.

However, once the image is received, your own obligations under HIPAA for storage and transmittal apply fully.

Can I send a photograph to an insurer or health plan if they request it to substantiate a claim?

Yes. This comes under the Payment exception to the need for a specific authorization

Again, of course, though, HIPAA-compliant transmittal is required. Printing out a photo for attachment may be the best route.

Can I use patient photographs that contain PHI as part of a presentation?

It depends on what that presentation is.

The general rule is that if a photograph contains PHI, a release from the patient to use it will be required, but the Healthcare Operations exception to the need for a specific authorization permits use of PHI, including that in photographs, for training and teaching without such.

When the images are used in treatment, the patient is deriving a personal benefit from that sharing, but once the images are used beyond that, for what is the wider societal benefit of training new practitioners, all that the patient receives is the risk of unwanted identification. Nevertheless, the rule allows such use for limited educational and training purposes. However, if you want to go further than intra-institutional education and use the picture as part of a seminar or conference outside your institution, or in a journal article or textbook, or on a scientific website, then you will need the patient’s permission.

You could avoid the latter situation by fully de-identifying the image, but ethical considerations should also be your concern such that even if you do not have to get the patient’s permission to use their case in a public presentation, you should tell them that that use is contemplated and get their agreement since, after all, they are the subject. We’ll continue our deep dive into this topic next week – stay tuned. And as always, let us know your thoughts below.

[Medical Justice comments: When in doubt, ask the patient. It is not fair to the patient to bury authorization to post photos online in a 20-page surgical consent form. Get their affirmative consent for photos. BTW, for our members, we have a template Photo and Video Release. Just email us at info@medicaljustice.com.com for it. Finally, HIPAA allows a patient to withdraw authorization they previously provided. So, a patient may sign a release giving permission to post their photo online. If down the road, they ask that the photo be removed, you have to do it – assuming doing so is reasonably in your control. You cannot argue they gave prior authorization and they must live with that forever.)

Learn how Medical Justice can protect you from medico-legal mayhem… 

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2021 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.