PHOTOGRAPHS, VIDEO/AUDIO RECORDINGS
and HIPAA AUTHORIZATIONS – General Reference Tool [1]
The following is general reference tool for determining when you need a HIPAA Authorization. The best practice is - when in doubt, obtain a HIPAA Authorization!
Please refer to the UAMS policies, 3.1.31 regarding de-identification and 3.1.28 regarding use and disclosures of PHI, for more detailed information. As always, you can use the “HIPAA Authorization for Release of Information to UAMS” form. A form that is more specific to photographs is available as well – “HIPAA Authorization for Disclosure of Patient Photographs or Video/Audio Recordings” form. Please call the HIPAA Office at 603-1379 with any questions.
1. Photographs/Recordings Taken for Medical Record Documentation – Not Required.
A HIPAA Authorization signed by the patient is not required if the photographs are being taken, and will be used, for the purpose of medical record/treatment documentation – regardless of whether the patient is “identified” in the photograph. (See Paragraph 2 below regarding identifiers). The same HIPAA/confidentiality requirements apply as with any other part of the medical record.
2. Photographs/Recordings That Do Not Identify the Patient – Not Required.
For photographs/recordings that do not in any way identify the patient or include any identifying characteristics of the patient, such as a photograph that excludes (1) the patient’s name, (2) medical record number, (3) patient’s face or any part of the face that would identify the patient, and (4) all other “identifiers,” these photographs do not require a HIPAA Authorization signed by the patient. In other words, the photographs are completely de-identified. See the UAMS De-Identification Policy 3.1.31 to confirm whether the photograph is truly “de-identified” according to HIPAA standards and requirements.
3. Photographs/Recordings Taken for Teaching Purposes Within UAMS – Not Required, but Recommended.
A HIPAA Authorization signed by the patient is not required if the photographs/recordings are being taken, and will be used, for healthcare teaching purposes within UAMS. However, if identifiable, the best practice is to obtain authorization for (a) a future use/disclosure requiring authorization; and (2) to meet JCAHO requirements if consent for internal use not previously obtained. Photos/recordings taken for this purpose must be treated with the same confidentiality and HIPAA standards as any other PHI.
4. Photographs/Recordings To Be Used for Publications, Presentations Outside of UAMS, or Any Other Disclosures Outside UAMS – Always Required.
For photographs that are not de-identified and which are taken for a purpose other than medical record documentation or teaching purposes within UAMS, a HIPAA Authorization signed by the patient is required. Remember that the HIPAA Authorization must state to whom the disclosures will be made, as specifically as you can, such as “to ABC Company,” or “to the public via a UAMS Website” See the UAMS Uses and Disclosures of Protected Health Information Policy 3.1.28.
[1] In addition to HIPAA, there are JCAHO Standards for all patient photographs/recordings:
· Remember that patients have right to request cessation of recording or filming.
· Remember that patients have right to rescind consent up until a reasonable time before the recording or film is used.
· Anyone who engages in recording or filming on behalf of UAMS (who is not already bound by UAMS’ confidentiality policy) must sign a confidentiality statement.
JCAHO Standards RI.2.50 are incorporated into HIPAA Authorization forms referenced above.