REVIEW ARTICLE
Medical photography: current technology, evolving issues and legal perspectives M. T. Harting,1 J. M. DeWees,2,3 K. M. Vela,2 R. T. Khirallah2
1
SUMMARY
Review criteria
Medical photographic image capture and data management has undergone a rapid and compelling change in complexity over the last 20 years. This is because of multiple factors, including significant advances in ease of photograph capture, alongside an evolution of mechanisms of data portability/dissemination, combined with governmental focus on health information privacy. Literature to guide medical, legal, governmental and business professionals when dealing with issues related to medical photography is virtually nonexistent. Herein, we will address the breadth of uses of medical photography, device properties/specific devices utilised for image capture, methods of data transfer and dissemination and patient perceptions and attitudes regarding photography in a medical setting. In addition, we will address the legal implications, including legal precedent, copyright and privacy law, informed consent, protected health information and the Health Insurance Portability and Accountability Act (HIPAA), as they pertain to medical photography.
Brief history of medical photography Photography, or ‘drawing with light’, was originally developed in the early nineteenth century (1). In 1825, Joseph Niepce produced the oldest surviving permanent photograph using asphalt varnish on a polished pewter plate and eight hours of exposure (2). When Niepce died of a stroke, continued advancement of the field was left to Louis Daguerre, who further developed a process that came to be known as ‘Daguerreotypy’ and used this method to photograph people for the first time in 1838 (Figure 1) (2). The sciences, and medicine in particular, quickly realized the potential of photography. The first documented application of photography in medicine was in 1840 when Alfred Francois Donne of the Charite Hospital in Paris photographed sections of bones, teeth, cells from body fluids and cellular debris. Donne was already engaged in visual aid, having championed the utility of the microscope, when he met Louis Daguerre. They met when Daguerre presented his work to the Academy of Sciences, Paris and Donne was further inspired, feeling that photography and microscopy were ‘method[s] so fit to support the zeal and talent of the teacher, to win the attention of the audience, to develop the propensity for studies and to spread new ideas’ (3). His vision was far beyond his time. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409. doi: 10.1111/ijcp.12627
Data used in this review was obtained from PubMed, Westlaw (Thomson Reuters), the world wide web (via search engines including Google and Yahoo) and widely accessible, publically available information.
Message for the clinic The take-home message is that clinicians must understand the opportunities, perceptions and actual legal issues/implications of medical photography. Medical photography is protected health information that should be de-identified. Administrative, physical and technical safeguards are the foundation of safe photographic capture, management and storage.
Photography has advanced substantial discourse in medical scholarship and clinical practice alike. The first appearance of photographs (daguerreotypes) in medical journals occurred in 1849 (4) and by 1870, The Photographic Review of Medicine and Surgery, a journal dedicated to photographic case studies, was published in Philadelphia. Advances in camera production in the early 1900s diversified the application of photography to many medical specialties, particularly pathology, dermatology, psychiatry and radiology. Three additional advances comprise the cornerstones of modern photography: color photography, the portable camera and the digital camera. Although the first ‘color’ photographs were taken in the late 1800s, color photography did not gain widespread accessibility until the early 1900s. Portability of photography changed with the ‘point and shoot’ or compact cameras developed by Kodak in the 1920s and, subsequently, the instant cameras developed by Edwin Land and the Polaroid corporation between 1940 and 1960. The digital camera, an electronic camera that uses a charge-coupled device image sensor, was designed by Steven Sasson in the 1970s and gained widespread popularity by the late 1990s. The integration of digital photography and the cellular phone (between 2000 and 2010) dramatically advanced photography to its current state of instantaneous accessibility.
Department of Pediatric Surgery, University of Texas Medical School at Houston, Houston, TX, USA 2 Vela Keller P.C., Dallas, TX, USA 3 Southern Methodist University Dedman School of Law, Dallas, TX, USA Correspondence to: Matthew T. Harting, MD, MS, Department of Pediatric Surgery, University of Texas Medical School at Houston, 6431 Fannin St, MSB 5.220, Houston, TX 77030, USA Tel.: + 713 500 7300 Fax: + 713 500 7296 Email: matthew.t.harting@uth. tmc.edu
Disclosure All authors have no relevant financial conflicts of interest to disclose.
401
402
Medical photography
Figure 1 Boulevard du temple. The first known image of a human (getting a shoe shine on a French street), created by Louis Daguerre in 1838.
Breadth of medical photography use Photography of the patient has changed the way care providers document, discuss and deliver modern medical care. There are four broad-based, though closely associated, areas where medical photography is frequently used: (i) medical consultation and documentation, (ii) medical education, (iii) patient and family education and (iv) medical publications. Medical documentation is a critical part of patient care. Photography has changed healthcare providers’ ability to describe an initial clinical condition and accurately track progression over time. Highly visual fields such as dermatology have integrated photography into routine practice: rash and lesion appearance and progression can be precisely documented and patients can now self-document their skin examination for early detection of skin cancer (5). Dermatoscopy or dermoscopy, the use of magnification and a non-polarised light source to view the skin and skin lesions, improves diagnostic capability and enhances the quality of cutaneous photography (6). Such documentation is particularly critical in our evolving healthcare system where a team-based approach often necessitates interactions with different providers over subsequent visits. Photographic documentation is widespread, encompassing nearly every specialty in medicine. It is important in wound management, allowing wound care teams to track the progression of wound healing (7). Mobile retinal imaging is changing opthamologic evaluation (8). Pre and postoperative imaging in plastic and reconstructive surgery is critical for documentation and identification of subtle contour changes (9). Intra-operative photography using digital cameras (10), smartphones and laparoscopic/endoscopic image capture (11) is ubiquitous. Documentation of physical abuse mandates use of
photography and is often key evidence for legal proceedings (12). Technological evolutions of medicine have led to frequent long-distance consultations or ‘telemedicine’. The ability to gain expert advice from one’s own home or through physician-to-physician discussion/consultation can make the patient experience more comfortable and efficient with less expense. Furthermore, rural or community hospitals are utilising telemedicine to provide rapid, costeffective subspecialty consultation, expanding their capabilities and enabling previously inaccessible expertise to benefit patients. Currently there are numerous, undocumented, physician-to-physician informal consultations that utilize photography as an aid for discussion. Institutions around the world have been incorporating the use of smart phone photography into their daily rounding, consultations and intra-operative evaluations with significant impact on improving communication between and within medical teams (13). Smartphone applications such as Epic Haiku (Epic Systems Corporation, Verona, Wisconsin, USA) facilitate clinical image capture and integration into the medical record. With ease of capture, portability and image quality, photography has been elevated to a requisite part of relaying accurate and complete information. If the importance of reading is accepted as a tenet in the education of the healthcare provider, then the importance of the photograph cannot be overstated. Medical education requires profound understanding of an inordinate volume of information as well as the ability to think critically, often under the pressure of time constraint. Despite lengthy training, however, rare diseases may escape the trainee – the photograph can bridge those gaps. Al-Hadithy and coauthors noted that the current climate of reduced work hours and reduced clinical/operative experience, combined with increased patient demand for quality improvement and optimising outcomes, requires that educators and trainees maximise training opportunities and seek alternative avenues for furthering medical knowledge (14). Photography is used in didactic material in every field in medicine – and its use is increasing. Photography is used to educate both the trainee and the patient. Part of a physician’s task is to help patients understand their diseases, and photography plays a major role in that endeavour. Intra-operative images are shared with patients to better illustrate the findings and future course of an operation while pre- and postoperative images document patient progress. Furthermore, there are mobile applications that enable patients to capture and upload photographs, increasing personal interactivity in health care. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
For as long as the photograph has existed, images have been used in textbooks, atlases, meeting presentations and case reports. Images are used to publish newly identified diseases, very rare diseases, or unique presentations of common diseases. Images are often the foundation of education, idea dissemination and documentation, among infinite possibilities.
Range of devices being used for image capture With numerous advances over the last century or so, digital photography has come of age. After the 20th century explosion of analogue photography, peaking at 2500 photographs per second in the year 2000 (15), analogue photography now represents far less than 1% of all photographic image capture. Digital photography is primarily captured in the medical setting using one of three devices: digital cameras, smartphones (with embedded digital cameras) or the laparoscope/endoscope. Current cameras capture high-quality images that can be transferred via USB or disc, while smartphones capture images that are easy to transfer via email, text or directly to a universally accessible data repository, cloud service or file hosting service [i.e. Dropbox (Dropbox, Inc., San Francisco, CA, USA), SugarSync (SugarSync, Inc., San Mateo, CA, USA), etc.]. Despite specific feature variability, the all-purpose quality of smartphone photography is quite good. In fact, the quality of most smartphone photography, combined with the portability, has positioned the smartphone as the most common way to obtain a digital photograph. Smartphones also offer the benefit (and potential drawback) of metadata through their ability to identify the location, date and time where/when the photograph was captured, a functionality that can be disabled to avoid potential breaches of confidentiality. Some hospitals have tried to minimise the portability issue by maintaining a ‘secure’ camera to be used only within the hospital by its staff. Patients have remarked that the idea of a ‘hospital camera’ seems more acceptable (16). While an ordinary digital camera may require an additional step to reach widespread dissemination (i.e. first downloading the pictures to a computer or disc before distributing online), most cameras are not usually password protected, making the photographs on a lost or stolen camera easy to access. Smartphones, on the other hand, are highly portable and can rapidly distribute a captured image, but their password protection and/ or encryption abilities can better secure the data, making unwanted access significantly more challenging. With either device, access to digital images can be compromised. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Mediums available for transportation and dissemination Despite emerging controversy around image capture, image portability and dissemination may ultimately define the line between appropriate, professional image use and unacceptable public access, the expectation of privacy and informed consent. Once captured, an image may be disseminated in many ways. The most traditional way of image transportation and dissemination is hard copy. The electronic file of an image may remain on the device used to capture it, but typically an image is transferred to a personal desktop/laptop computer or a more portable, smaller device [i.e. a compact disc (CD), digital video disc (DVD), universal serial bus (USB) flash drive or a memory card]. Given the ease of transferring images and their metadata to portable storage devices, device security poses an enormous challenge. Electronic transmission offers an exponential increase in dissemination capability, with an inversely proportional time requirement. Electronic mail (email) is the most common way of transmitting images electronically from portable devices, though text messaging with attached files is increasing in popularity. Online filesharing enables instant disbursement to numerous people through platforms that include digital photo sharing websites (SmugMug, Shutterfly, Snapfish, etc.), electronic data repositories (DropBox, SugarSync, etc.) and social networking services (Facebook, Twitter, Instagram, etc.). Despite password protection, encryption and other technical safeguards, any storage, transport or dissemination method can be compromised, potentially exposing images considered protected health information.
Patient perceptions and attitude regarding medical photography A study published in 2005 in the Emergency Medicine Journal investigated patient attitudes towards medical photography in the emergency department (17). They surveyed 100 patients and asked them three questions: (i) Would you consent to a photograph being taken in the Emergency Department of you/part of your body for the purposes of medical education? (ii) Would you consent the following body part(s) to be photographed (head, chest, abdomen, limbs and/or genitalia)? (iii) Would you consent to your photo being published in a medical journal, book, or an Internet site? The vast majority (84%) would consent to a photograph for medical education. In addition, the vast majority would give consent for photographing non-genitalia body parts and publication in a medical journal/book. Patients
403
404
Medical photography
became less likely to consent to images of genitalia and/or publication on the Internet. Another study, published in 2010, examined patients’ perception of medical photography through anonymous questionnaires distributed by a plastic surgery clinic (16). They found that patients prefer non-identifiable photographs for all purposes. The use of non-identifiable medical photography for teaching, journals and presentations had very high acceptance rates (88%), while posting medical photographs on the Internet was generally less acceptable (~75%). If those photographs were identifiable, the acceptance rate for Internet posting plummeted to 40–50%. Patient perception of informed consent, including how frequently and for what specific purposes it should be obtained, was highly varied. It was nearly unanimous (98%) that it is acceptable for patients’ physicians to access and use their medical photographs. These articles highlight commonly expressed patient sentiments about medical photography. Patients generally find it unacceptable to photograph their genitalia, to use a photograph where they are identifiable or to distribute an identifiable photograph via the Internet. On the other hand, patients generally find it acceptable to capture non-identifiable photographs, to have their physicians use the photographs and to use the images for academic scholarship.
Legal discussion General photography implications in copyright law Technology is outpacing legislative and legal systems. To explore the current legal implications of medical photography, it is important to first address copyright and privacy law. A significant amount of photographic legal discussion revolves around the impact of copyright law; therefore, we will begin with the basic nuances of the law as it relates to the copyright of photographic images. For photographic copyrights, the ownership rights include: (i) the right to reproduce the photograph; (ii) to prepare derivative works based upon the photograph; (iii) to distribute copies of the photograph to the public by sale or other transfer of ownership, or by rental, lease, or lending and (iv) to display the photograph publicly (18). In general, when the shutter of a camera is released, the photographer who pressed the button owns the copyright (19). An exception to this general rule is when an image is taken in a ‘work-made-for-hire’ context whereby the photographer is an employee hired specifically under written agreement to take the photograph for a designated purpose.
A photographer is subject to certain restrictions concerning privacy before taking photographic images. Typically, if property, people or things are visible and can be photographed from a public place, then no privacy release is needed to take and use an image depicting the property, person or thing. Under certain circumstances, a court may still find a photographer to have violated an individual’s privacy rights even when a photograph is taken in public – these instances would include a photographer’s harassment of an individual in public or the use of hidden cameras. Where privacy is normally expected, consent to privacy release for the photograph is generally required (19). Entry into a private domain may be accompanied by some form of privacy release request; although a formal written release may not be required under some circumstances if express authorisation is given. This discussion relates to the role of informed consent for photography, which will be discussed in detail in the next section. In the context of hospitals, physicians’ offices or other healthcare facilities that are held open to the public, the expectation of privacy may exist and could be subject to a general privacy release regarding photography taken while inside quasi-private locations. After privacy releases are secured, if needed, and a photograph is taken, the photographer must then address an individual’s rights to publicity of the image. There are two broad classifications for photography use in publications: (i) editorial use and (ii) commercial use (19). The nuances between these classifications are often subtle and unclear, so it is important to understand the differences in assessing the legal rights held in the image itself. Editorial use of photography occurs most often when an image is ‘newsworthy’; in such instances, the use of the photo is not considered for the benefit of any single individual (19). The newsworthiness of an image is evaluated against the constitutional protections of the First Amendment, including the freedom of press interest, and is broadly and liberally construed for the sake of public interest and access to new information. Photographs may continue to be ‘newsworthy’ even if they do not relate to current events. Courts have likewise defined public interest in liberal and far-reaching terms to include all types of factual, educational and historical information, which can also encompass entertainment value, amusement and interesting phases of human activity in general within the editorial use of photography. With few limited exceptions aimed to protect minor children from sexual exploit, it is legal for any photographer to publish and circulate any photographic image used for editorial purposes without any ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
consent at all, including without parental consent for minor children (20). Commercial use of a photograph usually occurs when the image is used purely for ‘advertising purposes’. Although a photograph may be used in something sold for profit – such as for use in a textbook or a scholarly journal – the critical enquiry is NOT whether the image is sold or is profited upon. Instead, the analysis of a commercial use should focus on whether a person viewing the photograph would reasonably believe that the image is meant to promote or endorse a product affiliated with the image. In this manner, the commercial use of photography requires consent from the appropriate person or authority before publishing the image (19). Once additional consent for publicity is obtained, after first securing consent to take the picture, the image may be used commercially. As this relates to a photograph of an individual person – if the person’s physical body or face is incorporated into a product such as a t-shirt or billboard, it may constitute commercial use. If the photograph of a person is used for an instructional or education purpose, even if such publication is sold for profit, its publication likely qualifies as an editorial use. Because it is sometimes difficult to appropriately classify a photograph’s use, a conservative approach may be to obtain consent for publicity, particularly if the image shows a recognisable aspect of the person – this can be coupled with the original consent obtained to take the image in the first place. Without the protection from infringement on a person’s publicity rights, a photographer may violate and injure the person’s economic interests because of commercial exploitation of an image if ultimately deemed to be for commercial use (19). Medical photography is generally classified as an editorial use, regardless of any profits derived from its publication (21). If a physician uses a medical image of a patient to promote his or her practice, the subject of the photos (a person) does not have any commercial stake in any profits derived from the images, though consent should be obtained if there is a recognisable aspect of the patient in the image (22). One caveat to this general rule is that a physician must obtain consent to use photographs for non-treatment purposes, to the extent that the images are ‘protected health information’ if they reveal the identity of the patient. A second exception is triggered when the subject of the photograph is a famous person whose identity can be recognised from the photograph; in this instance, the physician must expressly confirm with the famous subject that he or she has obtained consent to use the image to promote his or her practice (22). ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Informed consent The law of informed consent in the practice of medicine has been historically rooted in tort law – that is, abiding by the applicable professional standard of care by providing informed consent. No other medico-legal doctrine has received as much attention from scholars in the past several decades as informed consent; it plays a central, defining role in the legal context of the patient-provider treatment relationship (23). With patient autonomy as the ultimate goal, informed consent requires a physician to disclose information to a patient that is meant to enable him or her to make an educated decision about appropriate treatment or alternatives. This common law rule is founded in principles of agency law and fiduciary duty – the physician is the agent tasked with a fiduciary duty to supply information and advice to its principal, the patient, according to the patient’s best interests (23). A physician must typically discuss with a patient the benefits of any potential treatment option, the risks associated with that treatment and any available reasonable alternative to a treatment option and its corresponding benefits and risks (23). With a physician’s explanation of how a particular treatment procedure will operate, what the expected outcome will be and what risks or complications could arise as a result of choosing that treatment, a patient can thereby make an informed decision for his or her treatment options based on the disclosure of information that would most aptly guide such a decision (23). The assumption is that these disclosures by the physician will enable the patient to act appropriately on the information and make an informed decision in his or her own best interests; the patient is ultimately the final decision-maker on his or her available treatment options. The practical implications of informed consent can be troubling, however, because the theoretical aspirations of informed consent do not always consider real-world limitations (23). It is questionable whether patients have the ability or capacity to absorb the highly technical or specialised information about their diagnoses, or even whether the patients’ desire to make their own medical decisions outweighs their inherent trust in physicians that implement the treatment resulting from those decisions (23). Informed consent for medical photography may not necessarily operate in the same way that traditional medical informed consent for treatment does. Generally, informed consent requires disclosure of the diagnosis, the proposed treatment’s probable success, other alternative treatments and their respective
405
406
Medical photography
success rates, and the possible risks and complications that accompany each option (23). Although informed consent for treatment is more stringently subject to an appropriate professional standard of care and thorough disclosure of information, the requirement of informed consent for photography of a medical image may be subject to much less scrutiny. However, a physician can be subject to liability for breach of privacy if the physician takes images of patients without their knowledge and such images contain identifiable features of the patient (22). To date, courts in civil actions have only addressed issues of physicians’ use of photography for practical joking or inappropriate humour that resulted in defamation and slander, but no cases have raised issues concerning less egregious practices such as taking medical images for educational or research purposes (22). The requirement of informed consent for medical photography – whatever its purpose may be – may sometimes turn upon the regulations set forth in HIPAA, discussed below. As it has traditionally operated in the law, informed consent is an appropriate legal standard for the discussion and treatment of illnesses. However, courts have not formally extended the doctrine to require informed consent for medical photography of patients. Informed consent is most often (if not always) associated with (and necessarily required for) treatment options that have inherent risks, such as use of an experimental drug or performing a procedure. By requiring disclosure of pertinent risks and benefits weighed against other treatment alternatives, informed consent operates to protect a physician from liability after his or her consenting patient does in fact experience any of the risks that the physician disclosed when obtaining consent. Under this analysis of informed consent, it leaves one struggling with the question of ‘what’s the risk associated with taking a photograph?’ What risks, if any, would a physician surmise in his or her analysis of a particular photograph, particularly if the person cannot be identified in the image? The risk of revealing the person’s identity from the photograph is the most readily ascertainable ‘risk’ that medical photography poses, especially if no copyright or privacy issue exists or if informed consent does not operate to prevent this risk. When a person’s identity may be ascertained from a medical photograph, the image is then subject to HIPAA and the protections afforded to individually identified personal health information.
The role of HIPAA and protected health information (PHI) The Health Insurance Portability and Accountability Act (HIPAA) (24) is federal law that sets a national
baseline standard for protecting the privacy of medical records of individuals; states and ‘covered entities’ subject to HIPAA may increase their efforts for protection above the federal standard but they are required to comply with its minimum appropriations for protecting individually identifiable protected health information (PHI) (22). The definition of PHI under HIPAA is broad and sweeping, and it does specifically address ‘full facial photographic images’ and images that reveal the identity of the patient (22). Although privacy was not the primary intended focus when HIPAA was enacted, the development of safeguards for privacy and increased patient access to their own PHI ended up being two of HIPAA’s salient features. Under the HIPAA Privacy Rule (25), covered entities – health plans, healthcare clearinghouses and healthcare providers – and their business associations that receive, process or use PHI of individual patients – must comply with procedures for safely protecting the PHI from misuse. The Privacy Rule applies exclusively to electronic health records, although other provisions of HIPAA require adequate physical safeguards of tangible medical records and images (26). The protection of PHI under the Privacy Rule is, by definition, limited to such electronic records that make the patient individually identifiable, such as their name, contact information, birth date and medical record or social security number (26). As it is written, the HIPAA statute reflects an interesting tension about whether all medical photography is subject to HIPAA’s Privacy Rule requiring disclosures of PHI to patients; as it appears in the rule’s language, it is likely that such disclosures apply only to medical photography that individually identifies a patient and not to all medical photography in general. If the image identifies the patient, it is PHI and the Rule requires the physician or hospital to obtain the individual’s written authorisation for any use or disclosure of the PHI if it is not to be used for treatment purposes, payment for services, or healthcare operations (26). A physician is obligated to disclose PHI of patients under two circumstances: (i) when individuals request access to their PHI or to accounting of disclosures of their PHI and (ii) to the Department of Health and Human Services for compliance review or enforcement action (26). These written consent and disclosure requirements, however, may not necessarily be triggered solely by a medical image that exists in electronic form if the subject of those images is not PHI that reveals the identity of a patient. The Center for Medicare and Medicaid Services (CMS) and the Office of Civil Rights for the Department of Health and Human ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
Services (OCR of HHS) are the regulatory agencies responsible for enforcing both HIPAA’s Privacy Rule and the related security provisions, and they have not explicitly addressed medical photography that is not classified as PHI for use for research and educational purposes. The OCR of HHS website (27) publishes reported breaches of unsecured protected health information affecting 500 or more individuals. Searching ‘camera’, ‘image’ or ‘photograph’ yields 12, 12 and 3 breaches respectively; the majority of these were a result of theft of a computer or other portable electronic device. Specific enforcement of penalties for HIPAA violations is not detailed (an example is provided in the next section), though guidelines exist under the Enforcement Rule. Physicians may be subject to other state-specific regulations of privacy and security, such as for licensure and accreditation standards, which may be more restrictive than what HIPAA imposes.
computer server that had access to the entities’ shared data network (29). As a result of the physician’s willful compromise of the shared data network, PHI of patients from the hospital and the university’s medical centre was made available publically on Internet search engines. Upon further investigation, the OCR ultimately determined that the healthcare organisations themselves should be held accountable for their failure to conduct a thorough risk analysis for its shared data network and for failure to implement adequate technical safeguards of electronic PHI. Compliance materials from the HHS suggest that data security must be central to the way that healthcare organisations manage their information systems, and access to searchable databases that contain individually identifiable patient information must be marshaled with utmost care.
Protecting & maintaining access to photography
Some healthcare facilities have rationalized that smartphone cameras pose potentially serious implications on the health privacy of its patients and have implemented stringent smartphone policies for their employees (30,31). In addition to the constraints that HIPAA places on photographs that are considered PHI, hospitals have begun implementing facility-wide smartphone bans to curb concerns regarding the potential for inappropriate use of smartphone cameras to take images that identify individual patients (30). Hospitals prohibiting smartphone usage cite a multitude of reasons behind the bans: that mass distribution can occur instantaneously, that digital photos on a camera phone are forever captured on that device, and that smartphones enable discrete and sometimes unknowing capture of images (30). Each of these concerns is plausible to the extent that the photographs identify the patient; but where a photographic image is not classified as ‘individually identifiable health information’, it may not necessarily be worth such micro-management of smartphone privileges. Proponents of the smartphone bans recommend that hospitals provide digital cameras to employees that are exclusively designated for photographing patients for their medical records, thus discouraging and diminishing the need to use a smartphone camera (30). This solution, however, misses the mark in two significant ways. First, the digital camera device typically cannot be password protected or encrypted within a network because of the limitations in this technology. The HIPAA Security Rule governs technology such as this, and it would require additional safeguards such as keeping the digital camera in a locked, secure area safe from misuse or
The HIPAA concomitantly addressed privacy, protection, as well as security for both electronic and physically stored medical records, presumably, although not explicitly, including photography. The HIPAA Security Rule (28) establishes three categories for standardisation of medical record protection – administrative, physical and technical (26). Covered entities or their business associations who receive and process patient’s PHI as a third party must implement administrative procedures and policies that ensure a system of checks and balances for providers and administrators who access, use, or disclose PHI. In addition, physical safeguards such as locked filing cabinets and keyed file rooms and technical safeguards like electronic access cards, password protection devices and encrypted networks must also be integrated into the hospital or physician’s office to comply with HIPAA security (26). Just as with the other baseline provisions of HIPAA, a hospital or provider may exceed the minimum protections required by the security rule but may not fall below them. When HIPAA’s Privacy and Security Rules are violated and patients’ individually identifiable PHI is inappropriately made available electronically, the result can be catastrophic for the healthcare organisation as a whole, even if the breach results from unilateral actions of one physician. As reported in a recent Department of Health and Human Services press release, New York and Presbyterian Hospital and Columbia University agreed to settle HIPAA compliance issues for a staggering $4.8 million after a physician employed by Columbia deactivated a ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
The device difference – using a smartphone camera vs. a digital camera
407
408
Medical photography
misappropriation. Unlike a smartphone that is password protected, encrypted and kept within close physical proximity of its user, a digital camera would actually require heightened safety measures and may be subject to the same if not more risk than a smartphone camera poses. Second, and more fundamentally, physicians taking photographs of their patients may not necessarily trigger these supposed harmful consequences at all if the images do not reveal the patients’ identities. As previously discussed, non-identifiable images are not subject to HIPAA privacy or security scrutiny, and therefore additional obstacles imposed by a hospital should be considered carefully. Regardless of the manner in which images are captured or the location/type of storage of images utilised, the possibility for data compromise exists. There is no evidence that one device is more secure than another, for either capture or storage, except to recommend that the device be protected with technical safeguards, appropriately secured utilising adequate physical safeguards, and, for storage devices, encrypted.
The finite issue – recognition of the patient’s identity Decisions regarding the need for informed consent to use a photograph for research or teaching, regarding compliance with HIPAA security and privacy, and/or mandates requiring specific type of device for capturing images of patients, revolve around one central theme – the recognition of the patient’s individual identity in the image. An image may be identifiable if the patient’s face is included or if there are any identifiable features included such as jewellery, tattoos, skin lesions, scars or other unique anatomic or personal notabilities (16). If the image of the patient is in no way identifiable, the image is as de-identified as any other data that is also properly de-identified as defined by HIPAA. The existing literature within medical scholarly journals, federal regulation, state law and common law doctrine addresses this issue in a fragmented and disjointed way. Confusion over what HIPAA actually requires vs. what hospitals believe they should implement to comply with professional accreditation standards weighs heavy on the ultimate purposes of medical
References 1 Clarke G. The Photograph (Oxford History of Art). Oxford, UK: Oxford University Press, 1997. 2 Stannard T. The history of medical photography. Soc Soc Hist Med Bull 1980; 27: 33–43. 3 Thorburn AL. Alfred Francois Donne, 1801-1878, discoverer of Trichomonas vaginalis and of leukaemia. Br J Vener Dis 1974; 50: 377–80.
photography to provide enhanced treatment evaluation, to enable research and to educate.
Final thoughts on issues and policies moving forward Medical photography will continue to evolve, likely becoming ubiquitous, if not already. Our challenge is to continue to utilize the strengths of medical photography without compromising patient privacy. How should physicians and hospitals proceed with this information? First, though strong potential exists, there is no record of legal action stemming from medical photography. Second, there is no direct guidance from the government/lawmakers (via HIPAA) on the issues of obtaining, managing, storing or disseminating non-identifiable medical photography. Third, the ability to identify the patient in a medical image has emerged as a central theme as one considers policy moving forward. Fourth, medical photography has become widespread with an incredible increase in image incidence and prevalence. A concomitant revolution in patient privacy, a dramatic shift in resident education and an increased focus on healthcare quality improvement, have altered the medical landscape, creating an environment where photography has the potential to transform medicine. In order for this transformational technology to be overwhelmingly positive for, and fully recognised by, patients, healthcare providers, institutions and governmental entities, regulation must be built on a foundation of open dialogue and thorough understanding of the issues and opportunity.
Author contributions MTH: idea conception, information collection, manuscript drafting, manuscript revision and review, and final manuscript approval. JMD: information collection, manuscript drafting, manuscript revision and review and final manuscript approval. KMV: idea conception, manuscript revision and review and final manuscript approval. RTK: manuscript revision and review, and final manuscript approval.
4 Burns SB. Early medical photography in America (1839-1883): III. The daguerrean era. N Y State J Med 1979; 79: 1256–68. 5 Shenoy R, Molenda MA, Mostow EN. The introduction of skin self-photography as a supplement to skin self-examination for the detection of skin cancer. J Am Acad Dermatol 2014; 70: e15. 6 Carli P, De Giorgi V, Soyer HP, Stante M, Mannone F, Giannotti B. Dermatoscopy in the diagnosis of pigmented skin lesions: a new semiology for
the dermatologist. J Eur Acad Dermatol Venereol 2000; 14: 353–69. 7 Bradshaw LM, Gergar ME, Holko GA. Collaboration in wound photography competency development: a unique approach. Adv Skin Wound Care 2011; 24: 85–92; quiz 93-84. 8 Maamari RN, Keenan JD, Fletcher DA, Margolis TP. A mobile phone-based retinal camera for portable wide field imaging. Br J Ophthalmol 2014; 98(4): 438–41.
ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
9 Swamy RS, Most SP. Pre- and postoperative portrait photography: standardized photos for various procedures. Facial Plast Surg Clin North Am 2010; 18: 245–52; Table of Contents. 10 Tsai J, Liao HT, Wang WK et al. A safe and efficient method for intra-operative digital photography using a waterproof case. J Plast Reconstr Aesthet Surg 2011; 64: e253–8. 11 Emous M, Westerterp M, Wind J, Eerenberg JP, van Geloven AA. Registering the critical view of safety: photo or video? Surg Endosc 2010; 24: 2527– 30. 12 Santucci KA, Hsiao AL. Advances in clinical forensic medicine. Curr Opin Pediatr 2003; 15: 304–8. 13 Rodriguez-Feliz JR, Roth MZ. The mobile technology era: potential benefits and the challenging quest to ensure patient privacy and confidentiality. Plast Reconstr Surg 2012; 130: 1395–7. 14 Al-Hadithy N, Gikas PD, Al-Nammari SS. Smartphones in orthopaedics. Int Orthop 2012; 36: 1543– 7. 15 Good J. How many photo’s have ever been taken? 2011. http://blog.1000memories.com/94-number -of-photos-ever-taken-digital-and-analog-in-shoebox (accessed 1 October 2013). 16 Lau CK, Schumacher HH, Irwin MS. Patients’ perception of medical photography. J Plast Reconstr Aesthet Surg 2010; 63: e507–11. 17 Cheung A, Al-Ausi M, Hathorn I, Hyam J, Jaye P. Patients’ attitudes toward medical photography in
ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
18 19
20
21
22
23
24
25
the emergency department. Emerg Med J 2005; 22: 609. US Copyright Act at 17 U.S.C 106 – Exclusive rights in copyrighted works. Wright CE. An interview with Carolyn Wright of www.photoattorney.com, Photography and Copyright Law (Part I). In: Kaminesky K, ed. http://blog. kenkaminesky.com/photography-copyright-and-thelaw/. (accessed 3 February 2015). Child photography or videotaping consent laws are changing. 2012. http://communications-media.lawyers.com/privacy-law/Child-Photography-or-Videotaping-Consent-Laws-Are-Changing.html (accessed 7 January 2014). Mahar PD, Foley PA, Sheed-Finck A, Baker CS. Legal considerations of consent and privacy in the context of clinical photography in Australian medical practice. Med J Aust 2013; 198: 48–9. Segal J, Sacopulos MJ. Photography consent and related legal issues. Facial Plast Surg Clin North Am 2010; 18: 237–44, Table of Contents. Hall MA, Orentlicher D. Health Care Law and Ethics in a Nut Shell. Thomson Reuters, Eagan, MN: West Thompson Reuters, 2011. The Health Insurance Portability and Accountability Act of 1996 (HIPAA). Chapter 42 of the United States Code (USC), USA, 2010. HIPAA Privacy Rule, Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act (HITECH
26
27
28
29
30
31
409
Act). Chapter 76 of the Federal Registrar, 2011. Stevens GM. CRS Report for Congress: Enforcement of the HIPAA Privacy and Security Rules, 2008. US Department of Health and Human Services. http://www.hhs.gov/ocr/privacy/hipaa/administrative/ breachnotificationrule/breachtool.html (accessed 21 May 2014). HIPAA Security Rule, Health Insurance Reform: Security Standards. Chapter 45 of the Code of Federal Regulations (CFR), 2003. Data breach results in $4.8 million HIPAA settlements, 2014 http://www.hhs.gov/news/press/ 2014pres/05/20140507b.html (accessed 15 July 2014 and 22 December 2014). Kimberly R. Silas. Camera Phones, Patient Privacy, and HIPPA: The Growing Problem of Camera Phone Abuse in Healthcare Facilities. 59 La Bar J 2011; 180. Markus PA, Zuiker ES. Cell Phone Camera Use in Healthcare Facilities: Shutter It. Raleigh, NC: Health Information and Technology (HIT) News, 2009, p. 3.
Paper received December 2014, accepted January 2015
Medical photography: current technology, evolving issues and legal perspectives M. T. Harting,1 J. M. DeWees,2,3 K. M. Vela,2 R. T. Khirallah2
1
SUMMARY
Review criteria
Medical photographic image capture and data management has undergone a rapid and compelling change in complexity over the last 20 years. This is because of multiple factors, including significant advances in ease of photograph capture, alongside an evolution of mechanisms of data portability/dissemination, combined with governmental focus on health information privacy. Literature to guide medical, legal, governmental and business professionals when dealing with issues related to medical photography is virtually nonexistent. Herein, we will address the breadth of uses of medical photography, device properties/specific devices utilised for image capture, methods of data transfer and dissemination and patient perceptions and attitudes regarding photography in a medical setting. In addition, we will address the legal implications, including legal precedent, copyright and privacy law, informed consent, protected health information and the Health Insurance Portability and Accountability Act (HIPAA), as they pertain to medical photography.
Brief history of medical photography Photography, or ‘drawing with light’, was originally developed in the early nineteenth century (1). In 1825, Joseph Niepce produced the oldest surviving permanent photograph using asphalt varnish on a polished pewter plate and eight hours of exposure (2). When Niepce died of a stroke, continued advancement of the field was left to Louis Daguerre, who further developed a process that came to be known as ‘Daguerreotypy’ and used this method to photograph people for the first time in 1838 (Figure 1) (2). The sciences, and medicine in particular, quickly realized the potential of photography. The first documented application of photography in medicine was in 1840 when Alfred Francois Donne of the Charite Hospital in Paris photographed sections of bones, teeth, cells from body fluids and cellular debris. Donne was already engaged in visual aid, having championed the utility of the microscope, when he met Louis Daguerre. They met when Daguerre presented his work to the Academy of Sciences, Paris and Donne was further inspired, feeling that photography and microscopy were ‘method[s] so fit to support the zeal and talent of the teacher, to win the attention of the audience, to develop the propensity for studies and to spread new ideas’ (3). His vision was far beyond his time. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409. doi: 10.1111/ijcp.12627
Data used in this review was obtained from PubMed, Westlaw (Thomson Reuters), the world wide web (via search engines including Google and Yahoo) and widely accessible, publically available information.
Message for the clinic The take-home message is that clinicians must understand the opportunities, perceptions and actual legal issues/implications of medical photography. Medical photography is protected health information that should be de-identified. Administrative, physical and technical safeguards are the foundation of safe photographic capture, management and storage.
Photography has advanced substantial discourse in medical scholarship and clinical practice alike. The first appearance of photographs (daguerreotypes) in medical journals occurred in 1849 (4) and by 1870, The Photographic Review of Medicine and Surgery, a journal dedicated to photographic case studies, was published in Philadelphia. Advances in camera production in the early 1900s diversified the application of photography to many medical specialties, particularly pathology, dermatology, psychiatry and radiology. Three additional advances comprise the cornerstones of modern photography: color photography, the portable camera and the digital camera. Although the first ‘color’ photographs were taken in the late 1800s, color photography did not gain widespread accessibility until the early 1900s. Portability of photography changed with the ‘point and shoot’ or compact cameras developed by Kodak in the 1920s and, subsequently, the instant cameras developed by Edwin Land and the Polaroid corporation between 1940 and 1960. The digital camera, an electronic camera that uses a charge-coupled device image sensor, was designed by Steven Sasson in the 1970s and gained widespread popularity by the late 1990s. The integration of digital photography and the cellular phone (between 2000 and 2010) dramatically advanced photography to its current state of instantaneous accessibility.
Department of Pediatric Surgery, University of Texas Medical School at Houston, Houston, TX, USA 2 Vela Keller P.C., Dallas, TX, USA 3 Southern Methodist University Dedman School of Law, Dallas, TX, USA Correspondence to: Matthew T. Harting, MD, MS, Department of Pediatric Surgery, University of Texas Medical School at Houston, 6431 Fannin St, MSB 5.220, Houston, TX 77030, USA Tel.: + 713 500 7300 Fax: + 713 500 7296 Email: matthew.t.harting@uth. tmc.edu
Disclosure All authors have no relevant financial conflicts of interest to disclose.
401
402
Medical photography
Figure 1 Boulevard du temple. The first known image of a human (getting a shoe shine on a French street), created by Louis Daguerre in 1838.
Breadth of medical photography use Photography of the patient has changed the way care providers document, discuss and deliver modern medical care. There are four broad-based, though closely associated, areas where medical photography is frequently used: (i) medical consultation and documentation, (ii) medical education, (iii) patient and family education and (iv) medical publications. Medical documentation is a critical part of patient care. Photography has changed healthcare providers’ ability to describe an initial clinical condition and accurately track progression over time. Highly visual fields such as dermatology have integrated photography into routine practice: rash and lesion appearance and progression can be precisely documented and patients can now self-document their skin examination for early detection of skin cancer (5). Dermatoscopy or dermoscopy, the use of magnification and a non-polarised light source to view the skin and skin lesions, improves diagnostic capability and enhances the quality of cutaneous photography (6). Such documentation is particularly critical in our evolving healthcare system where a team-based approach often necessitates interactions with different providers over subsequent visits. Photographic documentation is widespread, encompassing nearly every specialty in medicine. It is important in wound management, allowing wound care teams to track the progression of wound healing (7). Mobile retinal imaging is changing opthamologic evaluation (8). Pre and postoperative imaging in plastic and reconstructive surgery is critical for documentation and identification of subtle contour changes (9). Intra-operative photography using digital cameras (10), smartphones and laparoscopic/endoscopic image capture (11) is ubiquitous. Documentation of physical abuse mandates use of
photography and is often key evidence for legal proceedings (12). Technological evolutions of medicine have led to frequent long-distance consultations or ‘telemedicine’. The ability to gain expert advice from one’s own home or through physician-to-physician discussion/consultation can make the patient experience more comfortable and efficient with less expense. Furthermore, rural or community hospitals are utilising telemedicine to provide rapid, costeffective subspecialty consultation, expanding their capabilities and enabling previously inaccessible expertise to benefit patients. Currently there are numerous, undocumented, physician-to-physician informal consultations that utilize photography as an aid for discussion. Institutions around the world have been incorporating the use of smart phone photography into their daily rounding, consultations and intra-operative evaluations with significant impact on improving communication between and within medical teams (13). Smartphone applications such as Epic Haiku (Epic Systems Corporation, Verona, Wisconsin, USA) facilitate clinical image capture and integration into the medical record. With ease of capture, portability and image quality, photography has been elevated to a requisite part of relaying accurate and complete information. If the importance of reading is accepted as a tenet in the education of the healthcare provider, then the importance of the photograph cannot be overstated. Medical education requires profound understanding of an inordinate volume of information as well as the ability to think critically, often under the pressure of time constraint. Despite lengthy training, however, rare diseases may escape the trainee – the photograph can bridge those gaps. Al-Hadithy and coauthors noted that the current climate of reduced work hours and reduced clinical/operative experience, combined with increased patient demand for quality improvement and optimising outcomes, requires that educators and trainees maximise training opportunities and seek alternative avenues for furthering medical knowledge (14). Photography is used in didactic material in every field in medicine – and its use is increasing. Photography is used to educate both the trainee and the patient. Part of a physician’s task is to help patients understand their diseases, and photography plays a major role in that endeavour. Intra-operative images are shared with patients to better illustrate the findings and future course of an operation while pre- and postoperative images document patient progress. Furthermore, there are mobile applications that enable patients to capture and upload photographs, increasing personal interactivity in health care. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
For as long as the photograph has existed, images have been used in textbooks, atlases, meeting presentations and case reports. Images are used to publish newly identified diseases, very rare diseases, or unique presentations of common diseases. Images are often the foundation of education, idea dissemination and documentation, among infinite possibilities.
Range of devices being used for image capture With numerous advances over the last century or so, digital photography has come of age. After the 20th century explosion of analogue photography, peaking at 2500 photographs per second in the year 2000 (15), analogue photography now represents far less than 1% of all photographic image capture. Digital photography is primarily captured in the medical setting using one of three devices: digital cameras, smartphones (with embedded digital cameras) or the laparoscope/endoscope. Current cameras capture high-quality images that can be transferred via USB or disc, while smartphones capture images that are easy to transfer via email, text or directly to a universally accessible data repository, cloud service or file hosting service [i.e. Dropbox (Dropbox, Inc., San Francisco, CA, USA), SugarSync (SugarSync, Inc., San Mateo, CA, USA), etc.]. Despite specific feature variability, the all-purpose quality of smartphone photography is quite good. In fact, the quality of most smartphone photography, combined with the portability, has positioned the smartphone as the most common way to obtain a digital photograph. Smartphones also offer the benefit (and potential drawback) of metadata through their ability to identify the location, date and time where/when the photograph was captured, a functionality that can be disabled to avoid potential breaches of confidentiality. Some hospitals have tried to minimise the portability issue by maintaining a ‘secure’ camera to be used only within the hospital by its staff. Patients have remarked that the idea of a ‘hospital camera’ seems more acceptable (16). While an ordinary digital camera may require an additional step to reach widespread dissemination (i.e. first downloading the pictures to a computer or disc before distributing online), most cameras are not usually password protected, making the photographs on a lost or stolen camera easy to access. Smartphones, on the other hand, are highly portable and can rapidly distribute a captured image, but their password protection and/ or encryption abilities can better secure the data, making unwanted access significantly more challenging. With either device, access to digital images can be compromised. ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Mediums available for transportation and dissemination Despite emerging controversy around image capture, image portability and dissemination may ultimately define the line between appropriate, professional image use and unacceptable public access, the expectation of privacy and informed consent. Once captured, an image may be disseminated in many ways. The most traditional way of image transportation and dissemination is hard copy. The electronic file of an image may remain on the device used to capture it, but typically an image is transferred to a personal desktop/laptop computer or a more portable, smaller device [i.e. a compact disc (CD), digital video disc (DVD), universal serial bus (USB) flash drive or a memory card]. Given the ease of transferring images and their metadata to portable storage devices, device security poses an enormous challenge. Electronic transmission offers an exponential increase in dissemination capability, with an inversely proportional time requirement. Electronic mail (email) is the most common way of transmitting images electronically from portable devices, though text messaging with attached files is increasing in popularity. Online filesharing enables instant disbursement to numerous people through platforms that include digital photo sharing websites (SmugMug, Shutterfly, Snapfish, etc.), electronic data repositories (DropBox, SugarSync, etc.) and social networking services (Facebook, Twitter, Instagram, etc.). Despite password protection, encryption and other technical safeguards, any storage, transport or dissemination method can be compromised, potentially exposing images considered protected health information.
Patient perceptions and attitude regarding medical photography A study published in 2005 in the Emergency Medicine Journal investigated patient attitudes towards medical photography in the emergency department (17). They surveyed 100 patients and asked them three questions: (i) Would you consent to a photograph being taken in the Emergency Department of you/part of your body for the purposes of medical education? (ii) Would you consent the following body part(s) to be photographed (head, chest, abdomen, limbs and/or genitalia)? (iii) Would you consent to your photo being published in a medical journal, book, or an Internet site? The vast majority (84%) would consent to a photograph for medical education. In addition, the vast majority would give consent for photographing non-genitalia body parts and publication in a medical journal/book. Patients
403
404
Medical photography
became less likely to consent to images of genitalia and/or publication on the Internet. Another study, published in 2010, examined patients’ perception of medical photography through anonymous questionnaires distributed by a plastic surgery clinic (16). They found that patients prefer non-identifiable photographs for all purposes. The use of non-identifiable medical photography for teaching, journals and presentations had very high acceptance rates (88%), while posting medical photographs on the Internet was generally less acceptable (~75%). If those photographs were identifiable, the acceptance rate for Internet posting plummeted to 40–50%. Patient perception of informed consent, including how frequently and for what specific purposes it should be obtained, was highly varied. It was nearly unanimous (98%) that it is acceptable for patients’ physicians to access and use their medical photographs. These articles highlight commonly expressed patient sentiments about medical photography. Patients generally find it unacceptable to photograph their genitalia, to use a photograph where they are identifiable or to distribute an identifiable photograph via the Internet. On the other hand, patients generally find it acceptable to capture non-identifiable photographs, to have their physicians use the photographs and to use the images for academic scholarship.
Legal discussion General photography implications in copyright law Technology is outpacing legislative and legal systems. To explore the current legal implications of medical photography, it is important to first address copyright and privacy law. A significant amount of photographic legal discussion revolves around the impact of copyright law; therefore, we will begin with the basic nuances of the law as it relates to the copyright of photographic images. For photographic copyrights, the ownership rights include: (i) the right to reproduce the photograph; (ii) to prepare derivative works based upon the photograph; (iii) to distribute copies of the photograph to the public by sale or other transfer of ownership, or by rental, lease, or lending and (iv) to display the photograph publicly (18). In general, when the shutter of a camera is released, the photographer who pressed the button owns the copyright (19). An exception to this general rule is when an image is taken in a ‘work-made-for-hire’ context whereby the photographer is an employee hired specifically under written agreement to take the photograph for a designated purpose.
A photographer is subject to certain restrictions concerning privacy before taking photographic images. Typically, if property, people or things are visible and can be photographed from a public place, then no privacy release is needed to take and use an image depicting the property, person or thing. Under certain circumstances, a court may still find a photographer to have violated an individual’s privacy rights even when a photograph is taken in public – these instances would include a photographer’s harassment of an individual in public or the use of hidden cameras. Where privacy is normally expected, consent to privacy release for the photograph is generally required (19). Entry into a private domain may be accompanied by some form of privacy release request; although a formal written release may not be required under some circumstances if express authorisation is given. This discussion relates to the role of informed consent for photography, which will be discussed in detail in the next section. In the context of hospitals, physicians’ offices or other healthcare facilities that are held open to the public, the expectation of privacy may exist and could be subject to a general privacy release regarding photography taken while inside quasi-private locations. After privacy releases are secured, if needed, and a photograph is taken, the photographer must then address an individual’s rights to publicity of the image. There are two broad classifications for photography use in publications: (i) editorial use and (ii) commercial use (19). The nuances between these classifications are often subtle and unclear, so it is important to understand the differences in assessing the legal rights held in the image itself. Editorial use of photography occurs most often when an image is ‘newsworthy’; in such instances, the use of the photo is not considered for the benefit of any single individual (19). The newsworthiness of an image is evaluated against the constitutional protections of the First Amendment, including the freedom of press interest, and is broadly and liberally construed for the sake of public interest and access to new information. Photographs may continue to be ‘newsworthy’ even if they do not relate to current events. Courts have likewise defined public interest in liberal and far-reaching terms to include all types of factual, educational and historical information, which can also encompass entertainment value, amusement and interesting phases of human activity in general within the editorial use of photography. With few limited exceptions aimed to protect minor children from sexual exploit, it is legal for any photographer to publish and circulate any photographic image used for editorial purposes without any ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
consent at all, including without parental consent for minor children (20). Commercial use of a photograph usually occurs when the image is used purely for ‘advertising purposes’. Although a photograph may be used in something sold for profit – such as for use in a textbook or a scholarly journal – the critical enquiry is NOT whether the image is sold or is profited upon. Instead, the analysis of a commercial use should focus on whether a person viewing the photograph would reasonably believe that the image is meant to promote or endorse a product affiliated with the image. In this manner, the commercial use of photography requires consent from the appropriate person or authority before publishing the image (19). Once additional consent for publicity is obtained, after first securing consent to take the picture, the image may be used commercially. As this relates to a photograph of an individual person – if the person’s physical body or face is incorporated into a product such as a t-shirt or billboard, it may constitute commercial use. If the photograph of a person is used for an instructional or education purpose, even if such publication is sold for profit, its publication likely qualifies as an editorial use. Because it is sometimes difficult to appropriately classify a photograph’s use, a conservative approach may be to obtain consent for publicity, particularly if the image shows a recognisable aspect of the person – this can be coupled with the original consent obtained to take the image in the first place. Without the protection from infringement on a person’s publicity rights, a photographer may violate and injure the person’s economic interests because of commercial exploitation of an image if ultimately deemed to be for commercial use (19). Medical photography is generally classified as an editorial use, regardless of any profits derived from its publication (21). If a physician uses a medical image of a patient to promote his or her practice, the subject of the photos (a person) does not have any commercial stake in any profits derived from the images, though consent should be obtained if there is a recognisable aspect of the patient in the image (22). One caveat to this general rule is that a physician must obtain consent to use photographs for non-treatment purposes, to the extent that the images are ‘protected health information’ if they reveal the identity of the patient. A second exception is triggered when the subject of the photograph is a famous person whose identity can be recognised from the photograph; in this instance, the physician must expressly confirm with the famous subject that he or she has obtained consent to use the image to promote his or her practice (22). ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Informed consent The law of informed consent in the practice of medicine has been historically rooted in tort law – that is, abiding by the applicable professional standard of care by providing informed consent. No other medico-legal doctrine has received as much attention from scholars in the past several decades as informed consent; it plays a central, defining role in the legal context of the patient-provider treatment relationship (23). With patient autonomy as the ultimate goal, informed consent requires a physician to disclose information to a patient that is meant to enable him or her to make an educated decision about appropriate treatment or alternatives. This common law rule is founded in principles of agency law and fiduciary duty – the physician is the agent tasked with a fiduciary duty to supply information and advice to its principal, the patient, according to the patient’s best interests (23). A physician must typically discuss with a patient the benefits of any potential treatment option, the risks associated with that treatment and any available reasonable alternative to a treatment option and its corresponding benefits and risks (23). With a physician’s explanation of how a particular treatment procedure will operate, what the expected outcome will be and what risks or complications could arise as a result of choosing that treatment, a patient can thereby make an informed decision for his or her treatment options based on the disclosure of information that would most aptly guide such a decision (23). The assumption is that these disclosures by the physician will enable the patient to act appropriately on the information and make an informed decision in his or her own best interests; the patient is ultimately the final decision-maker on his or her available treatment options. The practical implications of informed consent can be troubling, however, because the theoretical aspirations of informed consent do not always consider real-world limitations (23). It is questionable whether patients have the ability or capacity to absorb the highly technical or specialised information about their diagnoses, or even whether the patients’ desire to make their own medical decisions outweighs their inherent trust in physicians that implement the treatment resulting from those decisions (23). Informed consent for medical photography may not necessarily operate in the same way that traditional medical informed consent for treatment does. Generally, informed consent requires disclosure of the diagnosis, the proposed treatment’s probable success, other alternative treatments and their respective
405
406
Medical photography
success rates, and the possible risks and complications that accompany each option (23). Although informed consent for treatment is more stringently subject to an appropriate professional standard of care and thorough disclosure of information, the requirement of informed consent for photography of a medical image may be subject to much less scrutiny. However, a physician can be subject to liability for breach of privacy if the physician takes images of patients without their knowledge and such images contain identifiable features of the patient (22). To date, courts in civil actions have only addressed issues of physicians’ use of photography for practical joking or inappropriate humour that resulted in defamation and slander, but no cases have raised issues concerning less egregious practices such as taking medical images for educational or research purposes (22). The requirement of informed consent for medical photography – whatever its purpose may be – may sometimes turn upon the regulations set forth in HIPAA, discussed below. As it has traditionally operated in the law, informed consent is an appropriate legal standard for the discussion and treatment of illnesses. However, courts have not formally extended the doctrine to require informed consent for medical photography of patients. Informed consent is most often (if not always) associated with (and necessarily required for) treatment options that have inherent risks, such as use of an experimental drug or performing a procedure. By requiring disclosure of pertinent risks and benefits weighed against other treatment alternatives, informed consent operates to protect a physician from liability after his or her consenting patient does in fact experience any of the risks that the physician disclosed when obtaining consent. Under this analysis of informed consent, it leaves one struggling with the question of ‘what’s the risk associated with taking a photograph?’ What risks, if any, would a physician surmise in his or her analysis of a particular photograph, particularly if the person cannot be identified in the image? The risk of revealing the person’s identity from the photograph is the most readily ascertainable ‘risk’ that medical photography poses, especially if no copyright or privacy issue exists or if informed consent does not operate to prevent this risk. When a person’s identity may be ascertained from a medical photograph, the image is then subject to HIPAA and the protections afforded to individually identified personal health information.
The role of HIPAA and protected health information (PHI) The Health Insurance Portability and Accountability Act (HIPAA) (24) is federal law that sets a national
baseline standard for protecting the privacy of medical records of individuals; states and ‘covered entities’ subject to HIPAA may increase their efforts for protection above the federal standard but they are required to comply with its minimum appropriations for protecting individually identifiable protected health information (PHI) (22). The definition of PHI under HIPAA is broad and sweeping, and it does specifically address ‘full facial photographic images’ and images that reveal the identity of the patient (22). Although privacy was not the primary intended focus when HIPAA was enacted, the development of safeguards for privacy and increased patient access to their own PHI ended up being two of HIPAA’s salient features. Under the HIPAA Privacy Rule (25), covered entities – health plans, healthcare clearinghouses and healthcare providers – and their business associations that receive, process or use PHI of individual patients – must comply with procedures for safely protecting the PHI from misuse. The Privacy Rule applies exclusively to electronic health records, although other provisions of HIPAA require adequate physical safeguards of tangible medical records and images (26). The protection of PHI under the Privacy Rule is, by definition, limited to such electronic records that make the patient individually identifiable, such as their name, contact information, birth date and medical record or social security number (26). As it is written, the HIPAA statute reflects an interesting tension about whether all medical photography is subject to HIPAA’s Privacy Rule requiring disclosures of PHI to patients; as it appears in the rule’s language, it is likely that such disclosures apply only to medical photography that individually identifies a patient and not to all medical photography in general. If the image identifies the patient, it is PHI and the Rule requires the physician or hospital to obtain the individual’s written authorisation for any use or disclosure of the PHI if it is not to be used for treatment purposes, payment for services, or healthcare operations (26). A physician is obligated to disclose PHI of patients under two circumstances: (i) when individuals request access to their PHI or to accounting of disclosures of their PHI and (ii) to the Department of Health and Human Services for compliance review or enforcement action (26). These written consent and disclosure requirements, however, may not necessarily be triggered solely by a medical image that exists in electronic form if the subject of those images is not PHI that reveals the identity of a patient. The Center for Medicare and Medicaid Services (CMS) and the Office of Civil Rights for the Department of Health and Human ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
Services (OCR of HHS) are the regulatory agencies responsible for enforcing both HIPAA’s Privacy Rule and the related security provisions, and they have not explicitly addressed medical photography that is not classified as PHI for use for research and educational purposes. The OCR of HHS website (27) publishes reported breaches of unsecured protected health information affecting 500 or more individuals. Searching ‘camera’, ‘image’ or ‘photograph’ yields 12, 12 and 3 breaches respectively; the majority of these were a result of theft of a computer or other portable electronic device. Specific enforcement of penalties for HIPAA violations is not detailed (an example is provided in the next section), though guidelines exist under the Enforcement Rule. Physicians may be subject to other state-specific regulations of privacy and security, such as for licensure and accreditation standards, which may be more restrictive than what HIPAA imposes.
computer server that had access to the entities’ shared data network (29). As a result of the physician’s willful compromise of the shared data network, PHI of patients from the hospital and the university’s medical centre was made available publically on Internet search engines. Upon further investigation, the OCR ultimately determined that the healthcare organisations themselves should be held accountable for their failure to conduct a thorough risk analysis for its shared data network and for failure to implement adequate technical safeguards of electronic PHI. Compliance materials from the HHS suggest that data security must be central to the way that healthcare organisations manage their information systems, and access to searchable databases that contain individually identifiable patient information must be marshaled with utmost care.
Protecting & maintaining access to photography
Some healthcare facilities have rationalized that smartphone cameras pose potentially serious implications on the health privacy of its patients and have implemented stringent smartphone policies for their employees (30,31). In addition to the constraints that HIPAA places on photographs that are considered PHI, hospitals have begun implementing facility-wide smartphone bans to curb concerns regarding the potential for inappropriate use of smartphone cameras to take images that identify individual patients (30). Hospitals prohibiting smartphone usage cite a multitude of reasons behind the bans: that mass distribution can occur instantaneously, that digital photos on a camera phone are forever captured on that device, and that smartphones enable discrete and sometimes unknowing capture of images (30). Each of these concerns is plausible to the extent that the photographs identify the patient; but where a photographic image is not classified as ‘individually identifiable health information’, it may not necessarily be worth such micro-management of smartphone privileges. Proponents of the smartphone bans recommend that hospitals provide digital cameras to employees that are exclusively designated for photographing patients for their medical records, thus discouraging and diminishing the need to use a smartphone camera (30). This solution, however, misses the mark in two significant ways. First, the digital camera device typically cannot be password protected or encrypted within a network because of the limitations in this technology. The HIPAA Security Rule governs technology such as this, and it would require additional safeguards such as keeping the digital camera in a locked, secure area safe from misuse or
The HIPAA concomitantly addressed privacy, protection, as well as security for both electronic and physically stored medical records, presumably, although not explicitly, including photography. The HIPAA Security Rule (28) establishes three categories for standardisation of medical record protection – administrative, physical and technical (26). Covered entities or their business associations who receive and process patient’s PHI as a third party must implement administrative procedures and policies that ensure a system of checks and balances for providers and administrators who access, use, or disclose PHI. In addition, physical safeguards such as locked filing cabinets and keyed file rooms and technical safeguards like electronic access cards, password protection devices and encrypted networks must also be integrated into the hospital or physician’s office to comply with HIPAA security (26). Just as with the other baseline provisions of HIPAA, a hospital or provider may exceed the minimum protections required by the security rule but may not fall below them. When HIPAA’s Privacy and Security Rules are violated and patients’ individually identifiable PHI is inappropriately made available electronically, the result can be catastrophic for the healthcare organisation as a whole, even if the breach results from unilateral actions of one physician. As reported in a recent Department of Health and Human Services press release, New York and Presbyterian Hospital and Columbia University agreed to settle HIPAA compliance issues for a staggering $4.8 million after a physician employed by Columbia deactivated a ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
The device difference – using a smartphone camera vs. a digital camera
407
408
Medical photography
misappropriation. Unlike a smartphone that is password protected, encrypted and kept within close physical proximity of its user, a digital camera would actually require heightened safety measures and may be subject to the same if not more risk than a smartphone camera poses. Second, and more fundamentally, physicians taking photographs of their patients may not necessarily trigger these supposed harmful consequences at all if the images do not reveal the patients’ identities. As previously discussed, non-identifiable images are not subject to HIPAA privacy or security scrutiny, and therefore additional obstacles imposed by a hospital should be considered carefully. Regardless of the manner in which images are captured or the location/type of storage of images utilised, the possibility for data compromise exists. There is no evidence that one device is more secure than another, for either capture or storage, except to recommend that the device be protected with technical safeguards, appropriately secured utilising adequate physical safeguards, and, for storage devices, encrypted.
The finite issue – recognition of the patient’s identity Decisions regarding the need for informed consent to use a photograph for research or teaching, regarding compliance with HIPAA security and privacy, and/or mandates requiring specific type of device for capturing images of patients, revolve around one central theme – the recognition of the patient’s individual identity in the image. An image may be identifiable if the patient’s face is included or if there are any identifiable features included such as jewellery, tattoos, skin lesions, scars or other unique anatomic or personal notabilities (16). If the image of the patient is in no way identifiable, the image is as de-identified as any other data that is also properly de-identified as defined by HIPAA. The existing literature within medical scholarly journals, federal regulation, state law and common law doctrine addresses this issue in a fragmented and disjointed way. Confusion over what HIPAA actually requires vs. what hospitals believe they should implement to comply with professional accreditation standards weighs heavy on the ultimate purposes of medical
References 1 Clarke G. The Photograph (Oxford History of Art). Oxford, UK: Oxford University Press, 1997. 2 Stannard T. The history of medical photography. Soc Soc Hist Med Bull 1980; 27: 33–43. 3 Thorburn AL. Alfred Francois Donne, 1801-1878, discoverer of Trichomonas vaginalis and of leukaemia. Br J Vener Dis 1974; 50: 377–80.
photography to provide enhanced treatment evaluation, to enable research and to educate.
Final thoughts on issues and policies moving forward Medical photography will continue to evolve, likely becoming ubiquitous, if not already. Our challenge is to continue to utilize the strengths of medical photography without compromising patient privacy. How should physicians and hospitals proceed with this information? First, though strong potential exists, there is no record of legal action stemming from medical photography. Second, there is no direct guidance from the government/lawmakers (via HIPAA) on the issues of obtaining, managing, storing or disseminating non-identifiable medical photography. Third, the ability to identify the patient in a medical image has emerged as a central theme as one considers policy moving forward. Fourth, medical photography has become widespread with an incredible increase in image incidence and prevalence. A concomitant revolution in patient privacy, a dramatic shift in resident education and an increased focus on healthcare quality improvement, have altered the medical landscape, creating an environment where photography has the potential to transform medicine. In order for this transformational technology to be overwhelmingly positive for, and fully recognised by, patients, healthcare providers, institutions and governmental entities, regulation must be built on a foundation of open dialogue and thorough understanding of the issues and opportunity.
Author contributions MTH: idea conception, information collection, manuscript drafting, manuscript revision and review, and final manuscript approval. JMD: information collection, manuscript drafting, manuscript revision and review and final manuscript approval. KMV: idea conception, manuscript revision and review and final manuscript approval. RTK: manuscript revision and review, and final manuscript approval.
4 Burns SB. Early medical photography in America (1839-1883): III. The daguerrean era. N Y State J Med 1979; 79: 1256–68. 5 Shenoy R, Molenda MA, Mostow EN. The introduction of skin self-photography as a supplement to skin self-examination for the detection of skin cancer. J Am Acad Dermatol 2014; 70: e15. 6 Carli P, De Giorgi V, Soyer HP, Stante M, Mannone F, Giannotti B. Dermatoscopy in the diagnosis of pigmented skin lesions: a new semiology for
the dermatologist. J Eur Acad Dermatol Venereol 2000; 14: 353–69. 7 Bradshaw LM, Gergar ME, Holko GA. Collaboration in wound photography competency development: a unique approach. Adv Skin Wound Care 2011; 24: 85–92; quiz 93-84. 8 Maamari RN, Keenan JD, Fletcher DA, Margolis TP. A mobile phone-based retinal camera for portable wide field imaging. Br J Ophthalmol 2014; 98(4): 438–41.
ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
Medical photography
9 Swamy RS, Most SP. Pre- and postoperative portrait photography: standardized photos for various procedures. Facial Plast Surg Clin North Am 2010; 18: 245–52; Table of Contents. 10 Tsai J, Liao HT, Wang WK et al. A safe and efficient method for intra-operative digital photography using a waterproof case. J Plast Reconstr Aesthet Surg 2011; 64: e253–8. 11 Emous M, Westerterp M, Wind J, Eerenberg JP, van Geloven AA. Registering the critical view of safety: photo or video? Surg Endosc 2010; 24: 2527– 30. 12 Santucci KA, Hsiao AL. Advances in clinical forensic medicine. Curr Opin Pediatr 2003; 15: 304–8. 13 Rodriguez-Feliz JR, Roth MZ. The mobile technology era: potential benefits and the challenging quest to ensure patient privacy and confidentiality. Plast Reconstr Surg 2012; 130: 1395–7. 14 Al-Hadithy N, Gikas PD, Al-Nammari SS. Smartphones in orthopaedics. Int Orthop 2012; 36: 1543– 7. 15 Good J. How many photo’s have ever been taken? 2011. http://blog.1000memories.com/94-number -of-photos-ever-taken-digital-and-analog-in-shoebox (accessed 1 October 2013). 16 Lau CK, Schumacher HH, Irwin MS. Patients’ perception of medical photography. J Plast Reconstr Aesthet Surg 2010; 63: e507–11. 17 Cheung A, Al-Ausi M, Hathorn I, Hyam J, Jaye P. Patients’ attitudes toward medical photography in
ª 2015 John Wiley & Sons Ltd Int J Clin Pract, April 2015, 69, 4, 401–409
18 19
20
21
22
23
24
25
the emergency department. Emerg Med J 2005; 22: 609. US Copyright Act at 17 U.S.C 106 – Exclusive rights in copyrighted works. Wright CE. An interview with Carolyn Wright of www.photoattorney.com, Photography and Copyright Law (Part I). In: Kaminesky K, ed. http://blog. kenkaminesky.com/photography-copyright-and-thelaw/. (accessed 3 February 2015). Child photography or videotaping consent laws are changing. 2012. http://communications-media.lawyers.com/privacy-law/Child-Photography-or-Videotaping-Consent-Laws-Are-Changing.html (accessed 7 January 2014). Mahar PD, Foley PA, Sheed-Finck A, Baker CS. Legal considerations of consent and privacy in the context of clinical photography in Australian medical practice. Med J Aust 2013; 198: 48–9. Segal J, Sacopulos MJ. Photography consent and related legal issues. Facial Plast Surg Clin North Am 2010; 18: 237–44, Table of Contents. Hall MA, Orentlicher D. Health Care Law and Ethics in a Nut Shell. Thomson Reuters, Eagan, MN: West Thompson Reuters, 2011. The Health Insurance Portability and Accountability Act of 1996 (HIPAA). Chapter 42 of the United States Code (USC), USA, 2010. HIPAA Privacy Rule, Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act (HITECH
26
27
28
29
30
31
409
Act). Chapter 76 of the Federal Registrar, 2011. Stevens GM. CRS Report for Congress: Enforcement of the HIPAA Privacy and Security Rules, 2008. US Department of Health and Human Services. http://www.hhs.gov/ocr/privacy/hipaa/administrative/ breachnotificationrule/breachtool.html (accessed 21 May 2014). HIPAA Security Rule, Health Insurance Reform: Security Standards. Chapter 45 of the Code of Federal Regulations (CFR), 2003. Data breach results in $4.8 million HIPAA settlements, 2014 http://www.hhs.gov/news/press/ 2014pres/05/20140507b.html (accessed 15 July 2014 and 22 December 2014). Kimberly R. Silas. Camera Phones, Patient Privacy, and HIPPA: The Growing Problem of Camera Phone Abuse in Healthcare Facilities. 59 La Bar J 2011; 180. Markus PA, Zuiker ES. Cell Phone Camera Use in Healthcare Facilities: Shutter It. Raleigh, NC: Health Information and Technology (HIT) News, 2009, p. 3.
Paper received December 2014, accepted January 2015
