These Docs Behaved Badly, but Should They Have Been Sued?

Jeffrey Segal, MD, JD


May 20, 2015

In This Article

Photos Taken of Patients Should Have Clinical Relevance

State privacy and Health Insurance Portability and Accountability Act (HIPAA) rules addressing protected health information have changed recently. Requirements are more stringent, penalties more severe. Taking digital images will always have a role in diagnosis and treatment. But such pictures should have a legitimate medical purpose. And they become part of the private medical record. To the extent that such images will be shared, the patient must provide explicit permission—or the reason for sharing must be covered by an explicit exception in the HIPAA/Health Information Technology for Economic and Clinical Health (HITECH) code.

A picture that one believes is "de-identified" may not be so. If the doctor had posted a de-identified picture of the penile tattoo in a medical blog, no patient name would need to be included, and no other body parts—particularly the patient's face—would need be added for the patient to still be identifiable. The tattoo artist, for example, might be able to connect the dots. The loser of the original bet might put two and two together. The standard for de-identification is whether re-identification is reasonably possible. As technology advances, re-identification becomes easier and easier.

More important, digital communication has made it easier to widely broadcast a "private" conversation. What previously might have been two doctors sharing a laugh over a patient's tattoo can quickly morph into front-page news, a letter of reprimand from the medical board, and a lawsuit. While HIPAA and HITECH do not allow a private cause of action—action is instead taken by the Office of Inspector General for the Department of Health and Human Services—state privacy laws do allow a private cause of action.

The moral: Watch what photos you email or post online. Someone may share your digital pictures.


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.
Post as: