“Can Medical Justice solve my problem?” Click here to review recent consultations…
all. Here’s a sample of typical recent consultation discussions…- Former employee stole patient list. Now a competitor…
- Patient suing doctor in small claims court…
- Just received board complaint…
- Allegations of sexual harassment by employee…
- Patient filed police complaint doctor inappropriately touched her…
- DEA showed up to my office…
- Patient “extorting” me. “Pay me or I’ll slam you online.”
- My carrier wants me to settle. My case is fully defensible…
- My patient is demanding an unwarranted refund…
- How do I safely terminate doctor-patient relationship?
- How to avoid reporting to Data Bank…
- I want my day in court. But don’t want to risk my nest egg…
- Hospital wants to fire me…
- Sham peer review inappropriately limiting privileges…
- Can I safely use stem cells in my practice?
- Patient’s results are not what was expected…
- Just received request for medical records from an attorney…
- Just received notice of intent to sue…
- Just received summons for meritless case…
- Safely responding to negative online reviews…
We continue with our series of general educational articles penned by one attorney, an MD, JD, giving you a view of the world through a malpractice plaintiff attorney’s eyes. This attorney is a seasoned veteran. The series includes a number of pearls on how to stay out of harm’s way. While I do not necessarily agree with 100% of the details of every article, I think the messages are salient, on target, and fully relevant. Please give us your feedback – and let us know if you find the series helpful. Finally, these articles are not intended as specific legal advice. For that, please consult with an attorney licensed to practice in your state.
Photography has been a part of medicine since, well, the advent of photography. However, with the dissemination of the smartphone camera, anyone can grab and share an image with barely two screen taps.
It is essential doctors understand the rules they must follow to avoid breaches of both privacy and ethics. Those who violate these rules run the risk of ruin.
(Note: For the purpose of this topic the rules applying to still photography should be assumed to apply to videos as well.)
There’s a lot to unpack here, so we’re addressing the major issues in two parts. With that said, let’s dive in.
Is a photograph Protected Health Information (PHI)?
It may be, depending on what it includes.
PHI is defined for HIPAA as “individually identifiable health information transmitted or maintained by a covered entity or its business associates in any form or medium.” State confidentiality laws follow a similar paradigm. Translated from statute speak, this means that PHI is a medical fact about a patient coupled to something that can reasonably reveal the patient’s identity.
A patient photo is therefore considered to be PHI if it includes any of the following:
- Any portion of the face
- Tattoos
- Name or initials
- Birth Date
- Social Security number
- Address
- Date of service
- Medical Record Number
- And more…
However, this list is the floor, not the ceiling. For example, a photo of just Mikhail Gorbachev’s distinctive port-wine mark would easily identify him. Similarly, if your patient has a distinctive physical feature, which even may be the condition itself, assume that you have entered the realm of PHI and follow the privacy requirements. Also be alert for jewelry and clothing that may identify the patient, such as a name or initial necklace, or a T-shirt with a business name on it.
Err on the side of caution. You will never be sorry that you got consent to take an image from a patient who is willing rather than deal with the blowback from a patient who is not.
Can I store photographs on a digital camera or on my phone?
Possibly. The issue will be the capacity for encryption for photos that contain PHI.
Your camera is most likely not capable of this without expensive modification so it is best to download to a HIPAA-compliant device or into your EHR system as soon as possible.
Of course, if you are carrying PHI-containing images on your phone or on another mobile device then the usual care that you need to take as far as safe transport and storage apply just as they do for any other PHI (most modern smartphones are equipped with encryption by default). One practice was fined heavily when a laptop containing PHI was stolen from a car. It was sanctioned not for being a crime victim but for not securing the device safely, or more accurately for not having the data encrypted.
Are photographs part of the Designated Record Set (DRS)?
Yes, they are.
The DRS includes medical records that are used in whole or in part for a covered entity to make treatment decisions. This would encompass photography used to document the pre-treatment state and then, as is often done in wound care clinics, for example, to assess treatment, comparing the baseline condition to the most recent intervention.
The Treatment, Payment, and Healthcare Operations exceptions otherwise requiring a patient to specifically authorize the release of their PHI in certain circumstances will then apply to these images. So, no signed patient authorization would be required.
Can I share patient photographs that contain PHI with a colleague as part of a curbside or consultation?
Yes. These uses would come under the Treatment exception that allows PHI to be shared among practitioners as part of the care of the patient without the patient signing a specific release.
However, if you are going to be sending the image electronically then you must use a HIPAA-compliant system, just as you would for any other part of the medical record.
Can I receive photographs from a patient if they are not using a HIPAA-compliant system?
You can, as they are not a covered entity. This is no different from PHI-containing documents that they may send to you.
In fact, having a patient send you an image of their rash or of their swollen eye or of the spider that bit them or even a video of the fact that they have trouble balancing can be very useful in making your assessment when you are on-call.
However, once the image is received, your own obligations under HIPAA for storage and transmittal apply fully.
Can I send a photograph to an insurer or health plan if they request it to substantiate a claim?
Yes. This comes under the Payment exception to the need for a specific authorization
Again, of course, though, HIPAA-compliant transmittal is required. Printing out a photo for attachment may be the best route.
Can I use patient photographs that contain PHI as part of a presentation?
It depends on what that presentation is.
The general rule is that if a photograph contains PHI, a release from the patient to use it will be required, but the Healthcare Operations exception to the need for a specific authorization permits use of PHI, including that in photographs, for training and teaching without such.
When the images are used in treatment, the patient is deriving a personal benefit from that sharing, but once the images are used beyond that, for what is the wider societal benefit of training new practitioners, all that the patient receives is the risk of unwanted identification. Nevertheless, the rule allows such use for limited educational and training purposes. However, if you want to go further than intra-institutional education and use the picture as part of a seminar or conference outside your institution, or in a journal article or textbook, or on a scientific website, then you will need the patient’s permission.
You could avoid the latter situation by fully de-identifying the image, but ethical considerations should also be your concern such that even if you do not have to get the patient’s permission to use their case in a public presentation, you should tell them that that use is contemplated and get their agreement since, after all, they are the subject. We’ll continue our deep dive into this topic next week – stay tuned. And as always, let us know your thoughts below.
[Medical Justice comments: When in doubt, ask the patient. It is not fair to the patient to bury authorization to post photos online in a 20-page surgical consent form. Get their affirmative consent for photos. BTW, for our members, we have a template Photo and Video Release. Just email us at info@medicaljustice.com.com for it. Finally, HIPAA allows a patient to withdraw authorization they previously provided. So, a patient may sign a release giving permission to post their photo online. If down the road, they ask that the photo be removed, you have to do it – assuming doing so is reasonably in your control. You cannot argue they gave prior authorization and they must live with that forever.)
Medical Justice provides consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a consultation – or use the tool shared below.“Can Medical Justice solve my problem?” Click here to review recent consultations…
all. Here’s a sample of typical recent consultation discussions…- Former employee stole patient list. Now a competitor…
- Patient suing doctor in small claims court…
- Just received board complaint…
- Allegations of sexual harassment by employee…
- Patient filed police complaint doctor inappropriately touched her…
- DEA showed up to my office…
- Patient “extorting” me. “Pay me or I’ll slam you online.”
- My carrier wants me to settle. My case is fully defensible…
- My patient is demanding an unwarranted refund…
- How do I safely terminate doctor-patient relationship?
- How to avoid reporting to Data Bank…
- I want my day in court. But don’t want to risk my nest egg…
- Hospital wants to fire me…
- Sham peer review inappropriately limiting privileges…
- Can I safely use stem cells in my practice?
- Patient’s results are not what was expected…
- Just received request for medical records from an attorney…
- Just received notice of intent to sue…
- Just received summons for meritless case…
- Safely responding to negative online reviews…
Learn how Medical Justice can protect you from medico-legal mayhem…
Take Advantage of Our Review Monitoring Service
With eMerit, we help you automate review collection and posting to improve your online reputation.
Consult with a Medico-Legal Expert
Medical Justice Founder and CEO, Jeff Segal, MD, JD and our expert team provide consultations to doctors in need of guidance.
Meet the Experts Driving Medical Justice
Our Executive Team walks with our member doctors until their medico-legal obstacles are resolved.
Awesome article!
I’m miffed why the doc with stolen laptop was sanctioned. We use paper charts. If someone stole my bag containing patient charts and PHI from the car, would we the victims also be held liable?
Unfortunately, yes. Worst, still, (and I use paper charts) if our cleaning crew comes in and peruses my patients’ charts and they haven’t signed a Business Associates Agreement , we are held liable. Just saying.