Confidentiality and photographs as part of the medical record

The creation, use, and protection of medical records have a long complex history. “Whatsoever things I see or hear concerning the life of men, in my attendance, on the sick or even a part there from, which ought not be noised abroad, I will keep silent thereon, counting such things to be as sacred secrets.” This oath of Hippocrates dates to fourth century bce and indirectly addresses the confidential nature of a patient’s medical records and information.

Medical records or health records should be thought of as a systemic documentation of an individual’s medical history and medical care. Further, medical or health record should be thought of in two different ways. One, it is the physical chart, documents, papers, and photographs for an individual patient that is created by a medical provider. The term also should be viewed in the broader sense as the information represented within the recording medium. That is to say that the data contained on the written paper or on the computer chip or magnetic tape is also the medical record separate from its physical embodiment.

While it may seem academic to distinguish the physical document from the information that it contains, the distinction is important and relates directly to ownership. In the United States, patients own the information about their medical past and treatment contained in the physical form. However, the medical provider owns the physical or electronic structure that houses that information. Therefore, when discussing photographs in the patient’s chart, it should be remembered that the patient actually controls the data contained in the images unless there is a legal agreement to the contrary.

The use and protection of medical records has a complex and fragmented legal history. The foremost Federal law in this area is the Health Insurance Portability and Accountability Act (HIPAA) as set forth at 45 C.F.R. §160 et. seq. This Act, which came into law in 1996, set a Federal floor of privacy protection for health information in the United States. Individual states are allowed to require more stringent or additional protection to medical records, but may not weaken or remove obligations as set forth under HIPAA. Protected health information under HIPAA is broadly defined. This information includes individual identifiable health information. Full facial photographic images and comparable images are specifically referenced in HIPAA. Therefore, photographs taken either by the medical provider or photograph furnished to the medical provider that document the patient’s medical history or impact on the patient’s future medical care are covered by the privacy regulations under HIPAA.

As previously mentioned, rules and regulations regarding privacy and protection of medical records are fragmented and complex. Recently, the Federal government again spoke on this topic by passing the American Recovery and Reinvestment Act of 2009. Many states have unique and stringent patient privacy laws, and medical providers are encouraged to check with a licensed attorney in the state in which they practice for the most up-to-date and proper procedures for handling and protecting medical records.