Smartphone Photos in OR Not So Smart, Says Privacy Expert

Alicia Ault

September 21, 2017

(CORRECTION) September 26, 2017 — Editor's note: The original article identified two employees of the Jacksonville Naval Hospital as nurses. The article has been corrected to identify the employees as corpsmen, not nurses. 

Physicians, nurses, and other healthcare providers should resist the urge to snap pictures or stream videos of patients using their personal smartphones, no matter how interesting their condition or injury may be, said an attorney who specializes in privacy issues.

That seems to be common sense, but a spate of recent cases shows that clinicians and others often are not using good judgment.

At the University of Pittsburgh Medical Center's (UPMC's) Bedford hospital in Everett, Pennsylvania, a patient who required surgery to remove a foreign object lodged in his genitals became the subject of cellphone pictures by numerous doctors and nurses, who then shared the photos with others, according to a report in PennLive.

At the Jacksonville Naval Hospital in Florida, two corpsmen were caught posting videos on Snapchat that showed them manipulating newborns to music and calling them "mini-Satans," the Wahington Post reported.

Eric Cheung, an attorney with Ervin Cohen & Jessup in Beverly Hills, California, said that, anecdotally, this type of information sharing about patients seems to happen quite often. The disclosures — which may go viral on social media — can be a violation of the Health Insurance Portability and Accountability Act (HIPAA), but not necessarily.

To violate the statute, a disclosure — such as a photo — would have to have identifiable patient information and be tied together with a condition. A photo of a body part is not necessarily a violation, and neither is a description of a patient's condition, if it does not include any identifying information, Cheung told Medscape Medical News.

And, he said, it's often understandable that a physician would want to take a photo of a condition to share with a colleague or get a quick consult, especially as many camera systems and electronic medical records make it difficult to take pictures or upload them.

But that doesn't mean full steam ahead with smartphone photos.

"The danger of taking pictures with your personal cellphone is that you might capture identifying information, and by posting it or showing to somebody else you might inadvertently cause a HIPAA breach," he said.

HIPAA violations are of great concern to hospitals because they can result in investigations by the Department of Health and Human Services' Office of Civil Rights — which could turn up other problems and result in fines, said Cheung.

Even if there is no direct HIPAA violation, the sharing of patient photos can violate state, federal, or common privacy laws. "You expect a certain level of privacy when you're seeking medical treatment," Cheung said, noting that a patient who felt wronged could file a civil suit against the hospital and the clinicians.

Another consideration is the dampening effect of sharing photos or videos of patients who may have unusual injuries, he said. Hospitals should not be in the business of discouraging people from seeking emergency care for a potentially embarrassing accident or injury, he said. Patients who are hurt are already vulnerable. "Even if my name wasn't attached to [a photo], it would make me feel my privacy had been violated," said Cheung.

"Abhorrent" Behavior

In the Pennsylvania case, UPMC Bedford reported the photo sharing to the state Department of Health (DOH) as soon as it became aware of it, said Susan Manko, a spokeswoman for the UPMC system.

A DOH investigation found that the surgeon requested that another operating room staff member take a photo of the injury. That employee told the DOH that while attending to the patient, they noticed that there were more people in the OR than usual, and, "at one point when I looked up there were so many people it looked like a cheerleader type pyramid."

Cheung said that having unauthorized staff in the OR could in and of itself be a HIPAA breach.

The surgeon told the DOH that he often takes pictures of genitourinary anomalies "for teaching and documentation purposes" but that the OR's camera was broken. The investigation found the camera to be in working order. During the official inquiry, at least one OR staffer said the camera was just too complicated to use.

It was not unusual for others in the small hospital to be aware of incoming cases, said the surgeon, who was not surprised at the level of staff interest. "It was a medical curiosity," he told the DOH, adding that he did ask people to stop photographing as it was a HIPAA violation but told them to come back when the patient was anesthetized.

In the wake of the investigation, the surgical services staff was required to attend a talk by an attorney on privacy and confidentiality, and a new surgical services nursing director was appointed. Two attending physicians were summarily suspended for a brief period. They were reinstated during an investigation and review by a hospital committee, which ordered a 1-week further suspension for one attending and a 28-day suspension for another.

"We have a strict policy prohibiting photography of any patients with any device that is beyond the realm of patient care or appropriate education to benefit patient care, and only with the patient's signature on the general consent to medical treatment form," said Manko, the UPMC spokeswoman. "If an employee is discovered violating our policies, that employee is subject to disciplinary action, up to and including termination," she told Medscape Medical News.

"The behavior reported in this case is abhorrent and violates the mission of UPMC Bedford and the overall values of UPMC," she said.

For more news, join us on Facebook and Twitter


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.