Practice Brief: Patient Photography, Videotaping, and Other Imaging (Updated)

Editor’s note: The following information supplants information contained in the January 1999 "Patient Photography, Videotaping, and Other Imaging (Updated)" practice brief.

Note: The likeness of a patient may be recorded through a number of visual means, including still photography, videotaping, digital imaging, scans, and others. Throughout this document, the term "patient photography" will be used for any such recording of a patient’s likeness.

Background

The use of patient photography, videotaping, digital imaging, and other visual recordings during patient care is commonplace. For example, scopes and surgical equipment may provide the capability of routinely recording events on videotape or digital media. Families may wish to record a child’s delivery, and physicians and hospitals increasingly use videotapes for seminars, teaching, and community education.

Although patient photography may be fairly common, liability issues need to be considered and federal regulations observed.

Without proper precautions during a healthcare encounter, patient photography may make a healthcare provider liable for invasion of privacy. Courts have imposed liability primarily when the provider has exploited the patient for commercial benefit. However, courts have also imposed liability when the patient’s name or likeness was used for non-commercial purposes, finding that even taking a picture without the patient’s expressed consent was an invasion of privacy.¹

Healthcare providers may be subject to liability for publishing photographs or other images under the type of invasion of privacy known as public disclosure of embarrassing private facts. In one case, the court ruled that a physician had invaded a patient’s privacy by using "before" and "after" photographs of her face to demonstrate the effects of a face-lift. The use of the photographs publicized the fact the patient had a face-lift, which she found embarrassing and distressing.2 Before allowing patient photography, healthcare providers should consider why it is being done and how the images will be used.

Regulatory

The standards for privacy of individually identifiable health information, also known as the final privacy rule from the Health Insurance Portability and Accountability Act of 1996 (HIPAA), address photographs and similar images both directly and indirectly.

Section 160.103 defines health information in a manner that implies inclusion of patient photography:

"Health information means any information, whether oral or recorded in any form or medium, that:

(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of healthcare to an individual."

According to Section 164.514(b)(2), Implementation Specifications: Requirements for Deindentification of Protected Health Information, photographic and comparable images are explicitly noted as an item to be removed during de-identification in order for records to avoid the protected health information status and fall outside the regulations:

"A covered entity may determine that health information is not individually identifiable health information only if:

(2)(i) the following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

(Q) full face photographic images and any comparable images"

Accreditation

The Joint Commission on Accreditation of Healthcare Organizations advises organizations to obtain informed consent from patients for purposes of patient photography. In the event that films are obtained prior to securing patient consent, the films should be sequestered from use or release pending receipt of an appropriate consent.

The Joint Commission further advises that a confidentiality commitment be signed by anyone conducting filming or videotaping. This would be especially important to recognize when outsiders are involved because many organizations already require employees to sign annual confidentiality statements that should include patient photography within the commitment.

Documentation of Patient Care

In facilities where patient photography is used routinely to document patient care, the practice of patient photography in healthcare operations should be included in the HIPAA-mandated notice of information practices, as well as in the consent for treatment signed on admission. It is advised that a consent paragraph, such as the one below, be inserted into the standard admission consent form.

Note: This consent does not authorize the use of the images for other purposes, such as teaching or publicity. A separate consent for photography form should be used for such purposes.

HIPAA requires patient authorization for the release of protected health information, which includes patient photography, for purposes beyond treatment, payment, and healthcare operations.

If images will be routinely recorded as part of a diagnostic or therapeutic procedure, the above paragraph may be incorporated into the consent form for that procedure.

Documentation of Abuse or Neglect

Laws in most jurisdictions require healthcare providers to report cases of actual or suspected abuse or neglect of children or adults. HIPAA provides for variation in state laws. Providers should check their state laws for specifics. Generally, photographs taken to document abuse or neglect do not require consent from the patient or his or her legally authorized representative. Such photographs may be submitted with the required report to the investigating agency, but they should not be used for other purposes (such as teaching) without authorization.

Research

Photographs taken as part of a research protocol should be approved by an institutional review board (IRB) or privacy board, as termed by HIPAA. Consent for such photography should be incorporated into the consent form the patient signs to participate in the research protocol. The HIPAA-directed privacy board (or IRB) should be directly involved in decisions related to practices regarding the collection and release of patient photography.

Medical Education, Teaching, or Publicity

Written authorization should be obtained before photographing patients for medical education, staff teaching, or publicity purposes. The patient or his or her legal representative should sign and date the authorization form. Anyone other than the patient who has the legal authority to sign should indicate his or her relationship to the patient. The signature should be witnessed, and the witness’ signature should be included on the authorization form. The signed authorization form should be filed with the patient’s health record. A new authorization form should be signed for each new series of photographs taken by individuals other than those named in prior authorizations. The authorization given for photography remains valid unless and until the patient or his or her legal representative withdraws or restricts the authorization.

Media or Law Enforcement

When representatives from the news media or law enforcement agencies ask to photograph a patient, permission may be given if (1) the patient’s physician does not feel it would be detrimental to the patient and (2) the patient or his or her legal representative signs a written authorization form agreeing to the photography. HIPAA supports the patient’s authority to grant authorization, provided no state laws to the contrary exist. See "Sample Consent for Photography/Videotaping."

Photography of Newborns

If facilities routinely take photographs of newborns to give or sell to parents, consent should be obtained before this is done. A separate consent form may be used or a brief consent statement, such as the one below, may be incorporated into the standard admission form.

Family

Consent is not needed for photography done by the patient’s family members or friends, but this should be addressed in the provider’s policies and procedures. If parents want to videotape a child’s delivery, for example, it may be helpful to provide them with written information prior to the delivery. Allowances to discontinue taping if the physician deems it necessary should be included.

Telemedicine or Internet

Consent should be obtained before any photographs or other images are used in telemedicine or on the Internet. The images, along with the complete medical record, should be encrypted to protect the patient’s privacy. The technology used in some telemedicine and the Internet may not support the media originally used to record the patient data. Video, scans, or photo images may have poor resolution resulting in misinterpretations. Quality monitoring should be performed periodically to verify the quality of images transmitted.

Policies

As a first step in developing their policies, providers should take an inventory of the types and locations in which patient photography is being done. Areas to be considered include the emergency department, operating room, endoscopy, cardiac catheterization laboratory, labor and delivery, radiology, nuclear medicine, patient/ staff education, and corporate communications.

Each healthcare provider’s policies should outline the circumstances under which the facility will allow patients to be photographed for any reason and the requirements for patient consent. Statements that address the sensitive nature of patient photography need to be in the facility’s policy. Staff training on the issues of photograph and image handling should be included in HIPAA-mandated privacy and security training of the work force, extended work force, and all business associates and chain of trust partners. Business associate agreements should obligate business associates, chain of trust partners, and any subcontractors to the same privacy standards regarding patient photography as those of the covered entity. Ownership issues should also be addressed.

Maintenance

Still photographs and scanned printouts taken for medical reasons may be filed with the patient’s record for safekeeping. Videotapes, because of their size, may need to be filed separately in the HIM department or other secure area. The issue of patient privacy and confidentiality needs to be addressed when maintaining patient images. Sensitive images (i.e., photographs taken in the ER, psychological therapy sessions that are recorded, sensitive diagnostic scans) need to be available for patient care, but also need to be maintained in a manner that protects the patient from unauthorized viewing. Maintenance of medical record policies should address how and where patient images are kept. For example, patient photographs can be stored in sealed envelopes that are secured within the actual medical record, scan images should be affixed to pages of the medical record or concealed within an affixed envelope, and videotapes should be stored in a secure filing cabinet. If videotapes or other recordings are not filed with the patient’s record, a note should be made in the patient’s record indicating the availability and location of these recordings. All photos, videos, and other images should be stored in a manner that ensures timely retrieval when requested. All recordings should be identified with the patient’s name, identification number, and the date on which the recording was made. The name of the photographer or recorder may also be included. Because photographs, videotapes, and other images used to document patient care may be considered part of the patient’s record, they should be kept for the same time period state law requires medical records to be kept.

Disclosure

Unless otherwise required by federal or state law, photographs, videos, scans, and other images should not be released to outside requestors without specific written authorization from the patient or his or her legal representative. The authorization should state that the patient agrees to have the photographs released to the requestor and the purpose for which they will be used. This may be incorporated into the facility’s standard authorization for release of information form. See "Sample Authorization for Disclosure of Health Information."

If the patient wants the photographs for his or her own use, a copy may be provided unless otherwise prohibited by state law. The healthcare provider should keep the originals. If procedures involving several patients have been recorded on the same videotape, the footage specific to that patient should be dubbed onto a separate tape, so the patient is not given access to other patients’ information. In cases of the release of group therapy and family therapy, each person portrayed in the image must approve of the disclosure prior to the release of the information. Only the information pertaining to the persons who consented to the disclosure may be released. Editing or other means of protecting the information and images of the non-consenting parties must be done to protect their confidentiality. Patients may be charged a reasonable fee to cover the cost of duplication.

Liability Reduction

Malpractice cases commonly use videotapes that contain a potentially questionable medical incident. There are many pros and cons to having a video recording of a special event or procedure, but the facility must be aware of the liability risks involved. The following list offers a few ways to reduce the facility’s risks involved when video recording:

• Create a policy that addresses the subject of videotaping surgery, childbirth, etc. Use it consistently to avoid charges of "hiding" images in cases that may have involved malpractice
• Document every video recording in the medical record. A videotape can be used to prove innocence as well as guilt and both parties are entitled to complete, unedited copies
• Do not offer souvenir copies of facility-made videotapes

Notes

1. Roach, William H. Jr. et al. Medical Records and the Law. Gaithersburg, MD: Aspen Publishers, Inc. (1994): 207-208.

2. Ibid.

References

"Are Videotapes Part of the Medical Record?" Medical Records Briefing 6, no.4 (April 1995): 8.

Fletcher, Donna M. "Practice Brief-Telemedical Records." Journal of AHIMA 68, no. 4 (1997): Insert after page 44.

Joint Commission Perspectives 20, no. 6 (2000): 6.

Pickering, Ann M. "Risk Management Tips for Video Technology." Journal of Healthcare Risk Management 15, no. 1 (Winter 1995): 16-19.

"Special Report: Videotaping." Healthcare Risk Management 20, no. 10 (October 1998): 127-129.

"Standards for Privacy of Individually Identifiable Health Information; Final Rule." 45 CFR Parts 160 and 164. Federal Register 65, no. 250 (December 28, 2000).

Revised by

Beth Hjort, RHIA, HIM practice manager

Originally prepared by Mary D. Brandt, MBA, RHIA, CHE

First revision by Jennifer Carpenter, RHIA

Acknowledgments

Molly Alfers, RHIA
Jill Callahan Dennis, JD, RHIA
Donna M. Fletcher, MPA, RHIA
Kathleen Frawley, JD, MS, RHIA
Sandra Fuller, MA, RHIA
Gwen Hughes, RHIA
Sandra Meyers, RHIA
Harry Rhodes, MBA, RRA
Pamela Wear, MBA, RHIA
Julie Welch, RHIA