Clinical Images: “Be Photo Safe”

The availability of clinical imagery has changed the way healthcare professionals document, discuss and deliver modern healthcare. A clinical image may be a photograph, video or audio recording.

There are many benefits in taking clinical images, for example:

• They are important in the management and follow-up of medical conditions, especially in visually oriented specialities such as dermatology and plastic surgery. They can capture the state of an initial clinical condition and accurately track its progression over time.
• With the availability of mobile devices and the widespread use of digital and social media, a clinical image can be taken immediately and sent to a colleague in another location for a second opinion and advice on diagnosis, treatment and management.
• They may prove to be a useful tool in medical training and patient education.

Notwithstanding the benefits outlined above, clinical photography can be problematic. Whilst good quality images have the power to enhance patient care, poor quality images can negatively impact care and may result in a missed diagnosis or delayed treatment. The risks associated with using personal mobile phones in a clinical setting include:

• poor security (both physical and digital)
• the ease with which images may be inadvertently shared with the wrong person, constituting a breach of patient privacy
• quality limitations.

As PMP regularly receives queries from clients related to the taking and receiving of clinical images, we have developed some guidance that we hope you will find helpful:

1. Data privacy

The Information Commissioner’s Office states that all public and private organisations are legally obliged to protect any personal information they hold. Any individual who takes a photograph of another individual using the camera on their mobile phone, subject to limited exemptions, will be processing personal data. In this regard, ‘processing’ includes receiving, storing, accessing and using the image. Clinicians must therefore comply with the Data Protection Act 2018 (DPA) in relation to the circumstances in which the photograph is taken and its use.

The use of camera phones and other photographic devices can result in the creation of sensitive personal data such as the racial or ethnic origin of the individual or information about their mental or physical health. Where an image contains sensitive personal data, it is generally necessary for the individual photographed to give their explicit consent to the image being taken. In addition, they should be notified of all the intended uses of the image.

2. Consent

Patients have the right to consent or withhold their consent to the collection, use, and disclosure of clinical images. You should discuss the following information with the patient to ensure they can make an informed decision:

• The purpose(s) of the clinical image, ie, why the clinical image is being taken.
• How the clinical image may be used, eg, an image could be used in a de-identified form for training, education and research purposes.
• Who will have access to the image?
• Whether it may be shared and disclosed to others, if so, for what purposes.
• Whether it will be anonymised.
• How and where it will be stored.

You should record the key elements of the discussion in the patient’s medical record.

If during the discussion with the patient you believe that the patient lacks capacity to consent, you should follow GMC guidance Decision making and consent (2020). In such cases, you should have regard to where the patient’s best interests lie and whether clinical imaging is necessary in the context of their clinical care.

Those under 16 who have the capacity and understanding to give consent for a recording may do so. Where a child or young person is not able to understand the nature, purpose and possible consequences of the recording, consent must be sought from a person with parental responsibility. See GMC guidance para 34.

Please note, consent to make the recordings listed below will be implicit in the consent given to the investigation or treatment and does not need to be obtained separately:

• images of internal organs or structures
• images of pathology slides
• laparoscopic and endoscopic images
• recordings of organ functions
• ultrasound images
• x-rays.

3. Remote consultations

If clinical imagery is provided or requested in order to determine appropriate care or reach a diagnosis in the absence of a face-to-face consultation, consider the following:

• Would it be in the patient’s best interests to wait until they can attend for a consultation in person? If this is not feasible and/or delaying could potentially cause further harm, you may decide the use of clinical imaging and a remote examination is appropriate. Your records should clearly reflect your decision making in this regard.
• Decide on the most appropriate modality for the imaging. A video consultation may provide a better overview, whereas a photograph typically provides better resolution.
• Discuss with the patient the limitations of relying on imaging and conducting examinations remotely. Explain that ultimately, a physical examination may still be necessary.
• Consider the patient’s need for privacy and comfort with their environment and ensure that you are not interrupted. Please refer to PMP’s fact sheet, Bridging the digital divide: creating a personalised telehealth experience, 2021.
• Obtain the patient’s informed consent to proceed.
• Be particularly cautious when requesting and storing images of patients’ intimate areas. The GMC states in Remote consultations, “Patients may find it embarrassing or distressing to share images of their body. They may need additional reassurance about how their images will be kept secure before providing consent for storage and processing”. The RCGP Key principles for intimate clinical assessments undertaken remotely in response to COVID-19, 2020, provides guidance on how to safely manage the receipt, storage and use of intimate images taken by patients for clinical purposes.

4. IT considerations

Doctors should use a secure platform for processing clinical images rather than relying on freeware apps or personal devices. Where possible, use a camera connected to the hospital computer system so that the patient’s image can be stored in the patient’s electronic file, which typically has a better security system than a smartphone.

• You should let the patient know that any personal device they may be using to take and send an image may not be secure and that the transmission from them to you of the latter may not be secure/encrypted either.
• Any device on which you take or receive clinical images should be properly secured. Seek specialist IT advice on appropriate measures.
• Clinical images should be transferred securely from photographic devices to the correct patient’s records at the earliest opportunity. All images should be properly and securely deleted from the device as soon as possible after download.

5. Storage

If photographs form part of a patients’ medical record, the Data Protection Act 2018 requires organisations to take “appropriate technical and organisational measures” to prevent the unauthorised/unlawful processing or disclosure of personal data.

• Recordings must be stored within an institutional repository or other secure server (never on a personal computer, laptop, USB or other peripheral mobile device).
• Just like medical records, clinical images should be protected with back-up (disaster recovery), robust security, encrypted data transmission and appropriate user access controls.
• Clinical images should not be shared through social media sites such as Facebook, YouTube, etc., as these sites often hold the copyright of information stored on their servers.

Clinicians must:

• only collect information for a specific purpose
• keep it secure
• ensure it is relevant and up-to-date
• only hold as much as you need, and only for as long as you need it
• allow the patient to see it on request.

6. Ethical obligations

Clinicians should adhere to GMC guidance, Making and using visual and audio recordings of patients, 2013.

The guidance includes eight key principles to practice and explains when specific patient consent is needed and what to do if the patient lacks capacity.

Key tips to reduce your risk

• Before taking a clinical image, consider the purpose for which the image is required and obtain appropriate consent.
• Ensure the patient understands the reasons for taking the image; how it will be used, transmitted, stored and disposed of.
• Be cautious when taking clinical images of patients’ intimate areas. They could be considered obscene or pornographic without a medical context. Exposure of the patient’s body parts should be limited to where the disease/condition appears and the photograph should be shown to the patient for final approval.
• Make detailed notes of the consent process in the patient’s medical record.
• The patient’s consent will usually be required before disclosing recordings from which the patient can be identified. Disclosures may be made without the patient’s consent, where they are required by law, directed by the judge or other presiding officer of a court, or can be justified in the public interest. Please see paras 15 – 17 of the GMC guidance.
• Clinical images are an efficient way of sharing information to assist with patient care. However, you should be mindful of the risk of serious consequences for patients if images are inadvertently shared. If a clinical image is sent to the wrong person, it is a breach of patient privacy. In these circumstances, please do not hesitate to call the PMP medicolegal helpline, provided by Clyde & Co, to seek advice.
• Clinical images sent to a doctor form part of the patient’s medical records and should be stored securely.
• Doctors must take reasonable steps to keep images secure, including security settings, password and cloud access on devices.
• Any medical information, including images, should be stored and retained in accordance with data retention policies. Please refer to PMP’s fact sheet Storage and retention of medical Records, 2021.

If you have any queries or concerns surrounding the issues raised in this article, please do not hesitate to call the PMP medicolegal helpline, provided by our legal partners, Clyde & Co. The helpline is open 24/7, and contact details can be found on your policy documents or customer card.