• linkedin
  • Increase Font
  • Sharebar

    Using post-procedure photos for ads can constitute HIPAA violation

    Dr. Camera has a large medical and cosmetic dermatology practice. He is known to take high-quality photos of everything he does.


    David Goldberg, M.D., J.D.
    Two years ago, he treated a patient with dermal fillers. Prior to treatment, Dr. Camera obtained consent to perform the procedure, and he took pre-procedure photographs.

    One month later, Dr. Camera also took post-treatment photos of the patient. The results were terrific. One year later, the photos were used for local advertising purposes. The patient was horrified and filed a lawsuit alleging a HIPAA violation. What is this all about?

    The use of patient photography, videotaping, digital imaging and other visual recordings during cosmetic filler treatment is common. Although cosmetic patient photographic documentation is common, liability issues need to be considered and federal regulations observed.

    Without proper precautions during such a healthcare encounter, patient photography may make an aesthetic physician liable for invasion of privacy. U.S. courts have imposed liability primarily when the provider has exploited the patient for commercial benefit. However, courts have also imposed liability when the patient's name or likeness was used for non-commercial purposes, finding that even taking a picture without the patient's expressed consent was an invasion of privacy.

    Privacy, please

    Physicians may also be subject to liability for publishing photographs or other images under the type of invasion of privacy known as public disclosure of embarrassing private facts. In one case, the court ruled that a physician had invaded a patient's privacy by using "before" and "after" photographs of her face to demonstrate the effects of a facelift.

    The use of the photographs publicized the fact the patient had had a facelift, which she found embarrassing and distressing. Before allowing patient photography, it is important that a physician consider why it is being done and how the images will be used.

    The U.S. standards for privacy of individually identifiable health information, also known as the final privacy rule from the Health Insurance Portability and Accountability Act of 1996 (HIPAA), address photographs and similar images both directly and indirectly. Section 160.103 defines health information in a manner that implies inclusion of patient photography:

    "Health information means any information, whether oral or recorded in any form or medium, that

    "1. is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and

    "2. relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual."

    According to Section 164.514(b)(2), Implementation Specifications: Requirements for Identification of Protected Health Information, photographic and comparable images are explicitly noted as an item to be removed during de-identification in order for records to avoid the protected health information.

    Clear consent

    In offices where cosmetic fillers are given, patient photography is used routinely to document patient care. In such a setting, the practice of patient photography should be included in the United States HIPAA-mandated notice of information practices, as well as in the consent for treatment signed by all patients. It is advised that a consent paragraph, such as the one below, be routinely used.

    "I understand that photographs, videotapes, digital, or other images may be recorded to document my care, and I consent to this. I understand that (physician's name) will retain the ownership rights to these photographs, videotapes, digital, or other images, but that I will be allowed access to view them or obtain copies. I understand that these images will be stored in a secure manner that will protect my privacy and that they will be kept for the time period required by law or outlined in (physician's name)'s policy. Images that identify me will be released and/or used outside the office only upon written authorization from me or my legal representative."

    It should be noted that such a consent does not authorize the use of the images for other purposes, such as teaching or publicity. A separate consent for photography form should be used for such purposes.

    In addition, HIPAA regulations require patient authorization for the release of protected health information, which includes patient photography for purposes beyond treatment, payment and healthcare operations.

    Since photography is routinely undertaken when dermal fillers are injected, the above paragraph may be incorporated into the consent form for that procedure.

    Written authorization should be obtained before photographing patients for medical education, staff teaching, or publicity purposes. The patient or his/her legal representative should sign and date the authorization form. Anyone other than the patient who has the legal authority to sign should indicate his or her relationship to the patient. The signature should be witnessed, and the witness' signature should be included on the authorization form.

    Dr. Camera erred in not obtaining a HIPAA-compliant photography consent form before publishing the photos.

    David Goldberg, M.D., J.D., is director of Skin Laser & Surgery Specialists of New York and New Jersey; director of laser research, Mount Sinai School of Medicine; and adjunct professor of law, Fordham Law School.

    GoldbergDavid.jpg
    David J. Goldberg, M.D., J.D.
    Dr. Goldberg is Director of Skin Laser & Surgery Specialists of New York and New Jersey, Director of Mohs Surgery and laser research, ...

    Latest Tweets Follow