HIPAA and Your Privacy
I frequently receive calls from folks all upset about HIPAA (the Health Insurance Portability and Accountability Act) violations, and many of these are related to medical images. “I want to sue,” they announce. I respond “It is not quite that simple…”
While HIPAA offers protections, it does not provide the private cause of action many believe it does. Anyone suspecting a HIPAA violation should make a report to the US Department for Health & Human Services Office of Civil Rights. The OCR may sanction the violator, but HIPAA will not give a patient the right to sue their doctor or hospital.
Since HIPAA does not give a private right of action, we look to state law for a solution. State law privacy violations require a showing of certain types of harm. “Harm” generally requires more than simple embarrassment or hurt feelings. That is not as easy as all those folks calling me to represent them in their “sure-fire million dollar” cases realize. In truth, you can run up huge legal bills making these claims if you are not careful, and your attorney does not know when to say “No, but thanks for calling.”
The visual arts and medicine have had a long relationship. Since the written word cannot capture the subtleties of a condition or a disease, practitioners have been quick to adopt drawings, photographs and motion pictures to supplement their written descriptions. When I look back over my medical career, there were many times that I best learned about a particular syndrome when I found an image of a patient with that problem.
While HIPAA offers protections, it does not provide the private cause of action many believe it does. Anyone suspecting a HIPAA violation should make a report to the US Department for Health & Human Services Office of Civil Rights. The OCR may sanction the violator, but HIPAA will not give a patient the right to sue their doctor or hospital.
There is a compelling attraction of an image. Scientists easily relate this to the importance of our visual cortex. Seeing is part of believing. Medical amphitheaters flourished in the past, as students and laypersons watched surgeries or attended lectures featuring various patients with visually interesting conditions. Some hospitals even marketed these exhibitions, charging fees for attendance. Do you remember the Junior Mint episode from Seinfeld? (If not, I suggest a quick web search.) Throw in some open windows, don some street clothes, and grab some lunch; throw out anesthesia, forget antibiotics and never mind sterile technique or even air conditioning. Now you have an idea of the sideshow that grew along with medicine.
Since HIPAA does not give a private right of action, we look to state law for a solution. State law privacy violations require a showing of certain types of harm. “Harm” generally requires more than simple embarrassment or hurt feelings. That is not as easy as all those folks calling me to represent them in their “sure-fire million dollar” cases realize. In truth, you can run up huge legal bills making these claims if you are not careful, and your attorney does not know when to say “No, but thanks for calling.”
Today we watch differently. Photography, and then motion pictures, allowed more viewers to enter our operating rooms at their leisure, and study over and again in minute detail the imagery of an operation. Items missed on first glance could be analyzed later, recorded forever in our new, auxiliary visual memory. While the drama may have been lessened, these were useful new tools for education.
I know first-hand the visceral attraction of the surgical amphitheater. As a younger man, before an injury ended my operating days, I spent many hours operating beneath a gallery designed for medical spectators seeking to learn new techniques or master old ones. Sometimes, even were there to be no amphitheater, mid-operation a gentle tap on the shoulder would remind me to slide a bit to the left or right so a camera brought in to film the surgery could capture a better image. Viewers could watch from an adjacent room or even later in a lecture hall with the surgeon who had performed the procedure on-hand to narrate the procedure.
Want to see for yourself?
For those out there who wish to watch surgery today, I suggest you peruse the website ORLive. There you can see a variety of procedures performed at many different locations. The images are often graphic, but have great educational value.
Today our cameras are so advanced and our internet so fast we can watch operations thousands of miles away. We transport the viewer to the operating room. This is not without risk. I recall just a few years ago watching a groundbreaking surgery, coffee and croissant in hand, when the patient experienced a significant complication mid-procedure. To a room full of heart surgeons and cardiologists, it was a known risk, and punctuated the lesson we had debated over several days at the meeting and in our literature for months. To the kind lady serving coffee, it was more than a little distressing when she realized what she had witnessed.
Today most practitioners will have a library of x-rays, photographs, and videos collected over the years from many sources. We learn so much about new techniques, mastering concepts and procedures without shedding a drop of blood. Beyond the practitioner, patients themselves can learn about their diagnoses and proposed treatments by sampling the virtual world of medical images. A patient who needs a certain procedure can be shown certain elements of the operation to demonstrate what perhaps words cannot capture. Questions unformed in the patient’s mind are answered without ever being asked.
Images can be an important part of the consenting process it is oft repeated that patients tend to “hear what they want.” Having been a patient myself, I know that is often the case. When we show a video or photographic presentation of what the patient should expect from a procedure, they understand the vital concepts better.
Search the internet even casually and you will find a host of medical images and videos. Some are posted by patients, eager to share their maladies with family, friends, and strangers alike. Patients with unusual conditions may be diagnosed because someone notices they have a lesion that looked like one seen on the internet. I recall learning of a child with a rare ophthalmic disorder who would likely have perished were it not for a family member’s recollection of a photograph seen on the internet. Can anyone dispute the utility to that child, or that child’s family, of sharing medical imagery?
Medical Imaging and Copyright Protection?
Medical advertising, once considered taboo, also presents challenges. Before and after images of patients, when used in a commercial manner, can be a powerful tool. But what about patients who have had tattoos? Practitioners must be cognizant that many tattoo artists consider the body their canvas, and this inserts considerations of copyright and fair use into the discussion.
A scientific paper about tattoo removal, for example, would probably only require the thorough consent of the patient for use of an image with a tattoo. Use the same image in an advertisement? That could violate the tattoo artist’s copyrights. A similar argument can be made for distinctive body piercing if it could be identifiable as a particular artist’s work. You may need to obtain an artist’s permission to use his or her work in some circumstances.
The advent of the Health Insurance Portability and Accountability Act of 1996 dramatically changed how medical professionals shared information. Because the internet was growing by leaps and bounds, this sometimes cumbersome law was timely in its arrival. How we deal with it remains awkward. Those images of a disease process shared so readily in the past would quickly conflict with privacy regulations today. This punctuates the uneasy tension between science and privacy. In the past, a patient’s privacy concerns were secondary to needs of science and society. With privacy laws, our scientific willingness to share and our drive to document have collided with our need to protect and respect our patient’s privacy. Consent forms for “Medical Photography and Videography” were added to the ever-growing stack of authorizations patients were asked to sign in order to receive care. While these precautions and protections might lead one to believe it rare for an image to be used without permission, too often we learn of practitioners who failed to obtain consent for the use of a patient’s image.
Some patients expect to receive photographs or even a digital video of their operations. For physicians and surgeons, this can present a conundrum. Not only are there privacy concerns, but diagnoses and treatments can be subjected to scrutiny over and again. Hindsight, especially seen through the lens of a camera, from the comfort of an armchair, or over the internet, is always 20/20.
Errors in diagnosis are not the only hazard. Lurking in the background of many images are bits of data that will land a practitioner in hot water. Images in clinical settings may inadvertently capture other patients in the background. A high-resolution photograph of a patient properly consented for a photograph may also record images from an electronic medical record not shielded from the camera’s eye. Moreover, the metadata attached to our digital images will immortalize more than just the perfect image of the patient with the strange new syndrome we just discovered!
A new challenge is probably in your pocket right now – a cell phone, complete with camera. Patients, and staff, often take photographs without realizing that the images on their phones may represent HIPAA violations and potentially violate state privacy laws if shared. Publish that shot of yourself with some other patient in the background, and you may be in hot water.
No matter the pitfalls, medical imagery is an important tool. We can use images to track disease progression, monitor health, improve care, and teach the next generation of providers. Medical voyeurism is just as alive today as it ever has been, and with the growth of the internet, we have an ever-expanding menu with which to sate our appetite. My teen children explained the phenomenon to me one day when they showed me a video someone had posted on YouTube demonstrating some malady.
HIPAA: Medical Photography and Videography Checklist
1. HIPAA does not require perfection. You should have reasonable policies that are enforced, whether you are a solo practitioner or a giant health system. Remember to review and update the policies regularly. If you have questions, ask a professional.
2. If you think you have a HIPAA violation, seek guidance right away.
3. Always obtain patient consent for the image and clearly explain how the image will be used. Be prepared to give the patient a copy of the image and consent.
4. What is the purpose of the image? Why is it needed? Who will see it? Can a smaller field of view suffice? Is there another way to demonstrate the point? Can you adequately anonymize the image? If you do not have a good answer for each question, you may want to skip getting the image.
5. Control who accesses your medical imagery. This applies to your own staff as well as the world outside your practice. Do not forget your business associates.
6. If the image contains facial features, can it be anonymized? The ubiquitous black bar may not be enough – or a simple pair of sunglasses may do the trick.
7. Use a dedicated camera for medical imaging. Cellphones are not ideal for medical photography, and there is a potential for disastrous sharing.
8. Do not let staff take images in the office with their cellphones. You have to be firm.
9. Patients and their families will take photographs and videos – so make them aware that they must respect other patients and visitors’ privacy. Develop a policy and POST IT. Even if they do not mind having 10 million viewers see themselves in a hospital gown, someone else might.
10. Remember, having a policy is never enough – you must enforce it, revise it periodically, and address new threats as they arise.