Confidentiality and photographs as part of the medical record

The creation, use, and protection of medical records have a long complex history. “Whatsoever things I see or hear concerning the life of men, in my attendance, on the sick or even a part there from, which ought not be noised abroad, I will keep silent thereon, counting such things to be as sacred secrets.” This oath of Hippocrates dates to fourth century bce and indirectly addresses the confidential nature of a patient’s medical records and information.

Medical records or health records should be thought of as a systemic documentation of an individual’s medical history and medical care. Further, medical or health record should be thought of in two different ways. One, it is the physical chart, documents, papers, and photographs for an individual patient that is created by a medical provider. The term also should be viewed in the broader sense as the information represented within the recording medium. That is to say that the data contained on the written paper or on the computer chip or magnetic tape is also the medical record separate from its physical embodiment.

While it may seem academic to distinguish the physical document from the information that it contains, the distinction is important and relates directly to ownership. In the United States, patients own the information about their medical past and treatment contained in the physical form. However, the medical provider owns the physical or electronic structure that houses that information. Therefore, when discussing photographs in the patient’s chart, it should be remembered that the patient actually controls the data contained in the images unless there is a legal agreement to the contrary.

The use and protection of medical records has a complex and fragmented legal history. The foremost Federal law in this area is the Health Insurance Portability and Accountability Act (HIPAA) as set forth at 45 C.F.R. §160 et. seq. This Act, which came into law in 1996, set a Federal floor of privacy protection for health information in the United States. Individual states are allowed to require more stringent or additional protection to medical records, but may not weaken or remove obligations as set forth under HIPAA. Protected health information under HIPAA is broadly defined. This information includes individual identifiable health information. Full facial photographic images and comparable images are specifically referenced in HIPAA. Therefore, photographs taken either by the medical provider or photograph furnished to the medical provider that document the patient’s medical history or impact on the patient’s future medical care are covered by the privacy regulations under HIPAA.

As previously mentioned, rules and regulations regarding privacy and protection of medical records are fragmented and complex. Recently, the Federal government again spoke on this topic by passing the American Recovery and Reinvestment Act of 2009. Many states have unique and stringent patient privacy laws, and medical providers are encouraged to check with a licensed attorney in the state in which they practice for the most up-to-date and proper procedures for handling and protecting medical records.

Copyright issues related to medical photographs

The physical embodiment of the medical record is owned by the physician. The data within (to the extent it is considered protected health information) are controlled by the patient. Physicians are obligated to provide patients with copies or summaries of their medical records. Such obligations are mandated either by state law or by policy articulated by medical licensing boards.

Physicians are also required by law to keep medical records for specific time periods. This interval varies from state to state and from institution to institution. For example, under the Board of Medical Examiners Rules of General Practice, physicians must maintain treatment records for a period of 7 years from the date of the most recent entry in the medical record. Under New Jersey State law, institutions must retain medical records for a period of 10 years following the most recent discharge of the patient or until the individual reaches the age of 23 years, whichever is a longer period of time.

Who owns medical photographs? Ownership of pictures is, in some sense, a creature of copyright. Copyright gives the creator of an original work exclusive right for a certain time period in relation to that work, including its publication, distribution, and adaptation; after which time the work is said to enter the public domain. Whoever snaps the photograph owns the copyright. While copyright is often registered with the Library of Congress, it is not a requirement for ownership rights to be created.

In the context of medical photographs, ownership of copyright means that if a physician uses such images to promote his or her practice, the subject of the photos does not have a commercial stake in any benefit that accrues because such pictures were used. This premise is tempered by two caveats. First, that the doctor has the patient’s consent to use the photographs, as the images are considered protected health information. Next, if the subject is a famous person, it must be clear to the patient that the image will be used to promote the doctor’s practice. There is a tort called “misappropriation of likeness,” whereby a picture of a famous individual is used to promote a product or service without explicit permission. An example would be a movie star pictured eating Ben and Jerry’s ice cream, with the ad stating this movie star only eats Ben and Jerry’s. This tort rarely appears as an isolated issue in the context of medical photographs, because it is generally mitigated by seeking permission. That said, if a famous person’s pictures appear on a physician’s Web site and no consent was obtained, the doctor will be liable for the standard privacy violations as well as misappropriation of likeness.

In sum, copyright is owned by the “photographer.” But with medical photographs, a physician cannot capitalize on use of the photos without the patient’s explicit permission.

Copyright issues related to medical photographs

The physical embodiment of the medical record is owned by the physician. The data within (to the extent it is considered protected health information) are controlled by the patient. Physicians are obligated to provide patients with copies or summaries of their medical records. Such obligations are mandated either by state law or by policy articulated by medical licensing boards.

Physicians are also required by law to keep medical records for specific time periods. This interval varies from state to state and from institution to institution. For example, under the Board of Medical Examiners Rules of General Practice, physicians must maintain treatment records for a period of 7 years from the date of the most recent entry in the medical record. Under New Jersey State law, institutions must retain medical records for a period of 10 years following the most recent discharge of the patient or until the individual reaches the age of 23 years, whichever is a longer period of time.

Who owns medical photographs? Ownership of pictures is, in some sense, a creature of copyright. Copyright gives the creator of an original work exclusive right for a certain time period in relation to that work, including its publication, distribution, and adaptation; after which time the work is said to enter the public domain. Whoever snaps the photograph owns the copyright. While copyright is often registered with the Library of Congress, it is not a requirement for ownership rights to be created.

In the context of medical photographs, ownership of copyright means that if a physician uses such images to promote his or her practice, the subject of the photos does not have a commercial stake in any benefit that accrues because such pictures were used. This premise is tempered by two caveats. First, that the doctor has the patient’s consent to use the photographs, as the images are considered protected health information. Next, if the subject is a famous person, it must be clear to the patient that the image will be used to promote the doctor’s practice. There is a tort called “misappropriation of likeness,” whereby a picture of a famous individual is used to promote a product or service without explicit permission. An example would be a movie star pictured eating Ben and Jerry’s ice cream, with the ad stating this movie star only eats Ben and Jerry’s. This tort rarely appears as an isolated issue in the context of medical photographs, because it is generally mitigated by seeking permission. That said, if a famous person’s pictures appear on a physician’s Web site and no consent was obtained, the doctor will be liable for the standard privacy violations as well as misappropriation of likeness.

In sum, copyright is owned by the “photographer.” But with medical photographs, a physician cannot capitalize on use of the photos without the patient’s explicit permission.

Creating or using photographs without a patient’s knowledge for nonmedical reasons

Physicians in medical practices find themselves with surprising frequency in difficulty for creating and using photographs without the patient’s knowledge; this is most often done for nonmedical reasons. Whether for misdirected purposes of marketing or humor, liability can arise when images of patients are taken without their knowledge. Several recent cases highlighted here show what can happen when health care providers take or use photographs without their patient’s knowledge.

Sometimes practical jokes go horribly wrong. Dr Robert C. Woo, a dentist practicing in Washington State, agreed to perform a dental procedure on his employee, Tina Alberts. The specific procedure intended by Dr Woo was the replacement of 2 of Alberts’ teeth with implants.

“The procedure required Woo to install temporary partial bridges called “flippers” as spacers until permanent implants could be installed. When he ordered the flippers for Alberts’ procedure, Woo also ordered a second set of flippers shaped like boar tusks to play a practical joke on Alberts. While Alberts was under anesthesia, Woo and his staff removed Alberts’ oxygen mask, inserted the boar tusk flippers in her mouth and took photographs of her, some with her eyes pried open. After taking the photographs, Woo completed the planned procedure and inserted the normal flippers.”

Woo and his staff did not immediately show the boar tusk photos to Alberts. In fact, Woo did not reveal these photos to Alberts until approximately a month later. Woo’s staff gave Alberts the photos at a gathering to celebrate her birthday. Shocked by the photos, Alberts left work later that day never to return to her job. She did, however, later make contact with Dr Woo via the lawsuit that she filed alleging “outrage, battery, invasion of privacy, false light, public disclosure private acts, nonpayment of overtime wages, retaliation for request of payment of overtime wages, medical negligence, lack of informed consent and negligent infliction of emotional distress” (Id. at 50).

Dr Woo’s professional liability carrier refused to pay to defend against Alberts’ claim on grounds that the alleged practical joke was intentional and not considered a “business activity” (Id. at 51). Woo privately retained counsel to defend him in the suit and after some litigation, the matter was ultimately settled before trial for $250,000.00 (Id. at 51). Woo ultimately initiated litigation against his professional liability carrier for a breach of duty to defend and bad faith. The significant amount of time, effort, and money spent litigating this matter should serve as ample warning to any medical provider with a camera and misdirected sense of humor.

Dr Woo is not alone in the unauthorized taking of photos of a patient. In December of 2008, a patient filed a complaint against the Mayo Clinic of Arizona and Dr Adam Hansen. Dr Hansen was a surgical resident at Mayo Clinic of Arizona when he allegedly took photographs of a patient while under general anesthesia. Hansen was prepping to perform a gallbladder surgery when he allegedly used his cellphone camera to take photos of the patient’s tattooed penis.

Dr Hansen allegedly shared the photos with a Mayo Clinic nurse. The nurse in turn contacted a local newspaper about the incident and disclosed the patient’s name to the media. The patient first learned of the situation when he was contacted by a newspaper reporter approximately a week after surgery to solicit comments about the incident. Unfortunately, the media attention did not end there. The patient, whose full name is not disclosed in pleadings filed in Arizona, was “deluged with interview requests from local, national and international media, including network television stations, the BBC and radio ‘shock jock’ Howard Stern.” Much of this attention seems to relate to the nurse’s allegation that the patient’s penis was tattooed with the phrase “hot rod.”

As a result of Hansen and Mayo Clinic of Arizona, the patient claimed he suffered from anxiety, mental anguish, embarrassment, and humiliation. Further, the patient alleged battery, negligence, intentional infliction of emotional distress, and invasion of privacy. In addition to general damages, the patient sought punitive damages against the defendants.

Still other medical practices have encountered problems when they allegedly used images for promotional purposes of individuals who were not even patients of the medical practice. Mr Rodriguez brought an action against Vea Magazine, a weekly fashion and entertainment publication in Puerto Rico, and Dr Torres Martir who operates a clinic in Puerto Rico. The basis of the suit is that an article was published in Vea Magazine showing an image of Mr Rodriguez with the allegation that he was a patient of Dr Torres Martir’s cosmetic practice in Puerto Rico. In fact, Mr Rodriguez was a well-known media personality who hosted and appeared on television programs broadcast in Puerto Rico. He had never been a patient of Dr Martir or his clinic. The matter ultimately made its way to the United States District Court D. Puerto Rico in 2005, 394F.Supp.2d 389 on claims of libel and slander. While Dr Martir admitted to being interviewed for the article appearing in Vea Magazine, he denied ever stating that Mr Rodriguez was his patient. Although defendants attempted to have the case dismissed on a Motion for Summary Judgment, ultimately these efforts failed and the US District Court denied their motion, thus allowing prolonged litigation of Mr Rodriguez’s claims against the defendants.

These cases illustrate the potential liability when an individual’s image is secured and used without knowledge or authorization. We live in a time where many people carry digital cameras embedded in their cell phone at all times. What may seem like a harmless prank or photograph at the time can turn into a harmful situation resulting in significant expense and litigation. In an effort to raise awareness on the issue, some practices mandate its employees sign an agreement not to take any photographs in the medical practice without both the physician’s and patient’s consent. Appendix 2 shows an example of such an agreement. Whether the agreement is used or not, medical providers need to be sensitive to this potential area of liability.