In 2014, the Office for Civil Rights addressed the issue of posting patient photos in a medical or dental practice (most commonly of pediatric and orthodontic patients). In an article dated August 9, 2014, the New York Times quoted Rachel Seeger, from the Office for Civil Rights of the Department of Health and Human Services, as saying “A patient’s photograph that identifies him/her cannot be posted in public areas” unless there is “specific authorization from the patient or personal representative.” Under HIPAA’s Privacy Rule, sharing identifiable information without an authorization from the patient (or the patient’s parent, in the case of a minor) is a violation.
Rarely, if ever, does a parent know to include an authorization with a photo submission. It seemed to make perfect sense that submission of a patient photo was, by default, an authorization for its posting. However, since the OCR has specifically addressed the issue, we don’t recommend posting photos without a proper authorization form in place.
If your practice does not have the time or resources to track down authorizations for photos sent in by families, you are permitted to post photos in a private staff area, as workforce members are permitted to view patient information, and are responsible to hold it confidential under HIPAA regulations. Other practices may choose to circulate photos among staff before filing them in a patient chart or shredding them. However, if it has become an important custom in your practice to share patient photos, such as by posting them in the waiting area, you may use the following language and required elements to develop an appropriate authorization form.
- Include a space for the patient or personal representative to record the patient name, and an identifier, such as date of birth.
- Include the name of the practice, under a heading “Entity Requested to Release Information.”
- “Purpose of Request/Entity Authorized to Receive Information – I authorize the entity identified above to disclose the protected health information described below to the following individual(s):
- Patients and visitors to the practice.”
- “Description of Information to Be Disclosed – I authorize the practice to disclose the following protected health information to the entity, person or persons identified above.
- Images of myself, my children, and/or other family members as provided by myself, or my personal representative.”
- “Purpose of Disclosure:
- By submitting these images, I hereby grant full permission to the practice to use them in print publications, video and multimedia presentations, websites and/or for any purpose which may include, but not be limited to display, public relations, marketing or designs.”
- Required Statements:
Include an expiration date or meaningful event when the authorization will expire, a statement regarding the patient/personal representative’s right to terminate the authorization, a non-conditioning statement, a re-disclosure statement, and a statement of the patient/personal representative’s right to receive a copy of the authorization upon request. All of these statements are required on any HIPAA authorization form. Simply copy the required statements from your practice’s other authorization forms.
- Include a signature and date line.