HIPAA Regulatory Alert: Could photographing an ED patient get you sued?
May 1, 2009 5 minutes read
HIPAA Regulatory Alert
Could photographing an ED patient get you sued?
Without consent, you are asking for a lawsuit
Photographs of ED patients' clinical findings are being taken more frequently, due to the ubiquity of digital cameras, increasing use of electronic medical records, and their recognized value in medical education, according to Lawrence B. Stack, MD, associate professor of emergency medicine at Vanderbilt University in Nashville, TN, and co-editor of Handbook of Medical Photography.
However, patients who are to be photographed should be informed of the photography and given an opportunity for informed consent, says Matthew J. Walsh, MD, associate professor in the department of emergency medicine at the University of New Mexico in Albuquerque.
"Random photography with the ubiquitous cell phone camera is asking for a legal suit and should be forbidden," he says. Educational uses are of insufficient value to society to permit the violation of patient privacy without explicit informed consent, Walsh argues.
There are many issues surrounding consent for taking clinical photographs, says Stack, including purpose, privacy, confidentiality, trust, patient care, and identifiability.
What if your patient can't give consent because he or she is unconscious, incompetent, or deceased? Stack says that in these cases, photographs can be taken, but they should not be used without permission of the patient when he or she becomes competent, or from the family. If consent is denied by the patient or family at a later time, the images must be destroyed.
Stack says that clinical photographs should not be taken if a minor patient's guardian objects, though an exception to this is when photographs will be used in the record as evidence of a possible criminal act.
Consent generally serves as an agreement between the patient and all persons associated with the medical institution where the image is taken, which gives permission to take the photograph, defines the scope of its use, and releases institutional personnel from any liability related to the stated use of the photographs, says Stack.
"Most patients feel that use of images for medical education is a gallant purpose and will grant permission for taking and use of their photographs of clinical findings to 'help someone else,'" says Stack.
However, he adds that "medical education" is a concept not fully understood by patients. Case conferences, lectures both in and outside the medical institution, patient education, medical-legal education, web-based education, photography competitions, commercial educational products, and journal publication both print and electronic are all venues that could fall under the heading of "medical education."
"This should be carefully explained to the patient," says Stack.
While many hospitals have a "consent for photographs/video" form as part of their routine registration procedure, Stack says that the photographer should be sure the patient is "truly informed" as to the intended use of the photograph.
Patients also clearly should understand that their decision won't change their care in any way. "They should also be aware that placing their clinical photograph into their electronic medical record may enhance their care by allowing consultants to provide real-time input on their care a form of telemedicine and for follow-up," says Stack.
Consent serves as some protection for the photographer and institution from being sued for damages from violations of privacy, defamation, or anguish, says Stack.
"While written consent does not prevent a lawsuit, it may make it more difficult to prosecute," Stack says.
For this reason, Stack recommends that with any photograph where a patient is identified, particularly the face, written consent should be obtained and placed in the medical record, even if the photo is being used only for educational purposes.
Stack notes that photographs originally taken in or converted to a digital format can be manipulated to render a patient's features relatively unidentifiable. "This has been done traditionally by placing a black box over the eyes, a marginally effective method," he says. "Placing coarse pixilation over the eyes or a larger portion of face seems more effective, but may hide important clinical findings or may be distracting."
While the image shown for educational purposes may have this "mask" placed, the original image, if it demonstrates identifiable features, should be obtained with written consent when possible, notes Stack.
"I do not feel that consent is needed in the situation where the patient cannot be identified, such as the oral cavity, hand, or close-up of the skin," says Stack. "Publishers do not require consent where the patient is not identifiable."
Stack says that components of written consent should include:
The patient's name, medical record number, and date;
Purposes for which the photographs will be used; for example, entry in the medical record, legal evidence, educational/training purposes, publication in an electronic or printed medical journal, Internet, and/or advertisement for profit;
An agreement to hold harmless the person taking the photographs and any person associated with the facility where the photographs are taken or used for educational purposes; and
Patient signature, date, and witness signature.
Photographs are protected health information under the Health Insurance Portability and Accountability Act (HIPAA), which means that they should be treated just as any medical record would be treated, according to Erin McAlpin Eiselein, JD, a health care attorney with Denver-based Davis Graham & Stubbs.
HIPAA permits photographs of patients to be used for internal educational activities, such as onsite teaching and training programs. However, photographs cannot be used for external educational activities without first obtaining patient consent to do so.
Under HIPAA, verbal consent is not sufficient written consent is required. "The best practice is always to obtain a written consent or authorization from the patient specifically allowing the use of photographs for educational purposes," says Eiselein. "Such authorization provides the maximum protection to the physician and the hospital."
HIPAA also allows individually identifiable health information to be de-identified, which means removing all information that could identify the subject of the medical record in this case, the photograph.
"If individually identifiable health information is de-identified, then it falls outside of the HIPAA regulations," says Eiselein. "With respect to photographs, the regulations state that if the full face is removed and the individual cannot be identified from the remaining image, the photograph is not subject to the HIPAA regulations."
That said, however, Eiselein advises that the most prudent course of action, especially considering state laws that may be more stringent than HIPAA, is still to obtain patient consent for any use of a photograph.
As for what liability risks an ED physician or hospital would face if photographs were used in violation of HIPAA, Eiselein notes that there is no private right of action under HIPAA, which means that the individual could not sue the physician or hospital for a HIPAA violation. However, Eiselein adds that the patient could make a report to the United States Department of Health and Human Services' Office for Civil Rights (OCR), as that is the agency charged with enforcing HIPAA.
If the OCR concluded that use of the photograph violated HIPAA, it could impose civil or even criminal penalties, depending on the circumstances, on the physician or hospital.
"In addition, the patient could file a lawsuit against the physician or the hospital based upon state tort law, such as a claim for invasion of privacy," says Eiselein. "Some states may have more stringent laws addressing photographs, and those laws may create independent causes of action, as well."
Photographs of ED patients' clinical findings are being taken more frequently, due to the ubiquity of digital cameras, increasing use of electronic medical records, and their recognized value in medical education.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content