Before-and-after photographs: what consent has to cover

Clinical photographs are protected health information

A photograph that could identify a patient, taken in the course of care, is protected health information under HIPAA when held by a covered entity. Using it for marketing is not treatment, payment or healthcare operations, so it requires a valid written authorisation from the patient.

What an authorisation generally has to contain

• A specific description of the information being used, the photographs themselves.
• Who may disclose it, and who may receive it.
• The purpose of the use.
• An expiration date or event.
• A statement of the patient’s right to revoke, and how.
• The patient’s signature and date.

Cropping a face out does not automatically make an image non-identifying. Tattoos, scars and distinctive features can all identify a person.

The practical failure, and what it costs

Most companies do not lack photographs. They lack photographs they can prove they are allowed to publish. An image arrives by text from a rep, the release is a verbal yes, and two years later nobody can say what the patient actually agreed to.

That is why consent is inseparable from the image in this platform rather than filed next to it. An image cannot exist in the library without a signed release attached, recording who signed it, what it covers, and what the permitted uses are.