Legal Ramifications of Publishing Patient Photographs: A Review of Legal Cases

Background:

The use of photography in plastic surgery has become standard of practice in recent years. Patient photographs have diverse utility and can be used to visualize medical progression, and as an educational and marketing tool. With increased publication of patient photographs outside the healthcare records, it is important to understand patient privacy rights and how they pertain to images. Additionally, it is valuable to understand the legal consequences associated with dissemination of patient photographs without proper consent.

Methods:

A retrospective analysis of the Lexis+ legal database was conducted to obtain cases that involved the improper dissemination of patient photographs or videos by surgeons. Inclusion criteria included civil cases in which the defendant was a surgeon being sued for the improper use of patient photographs. Criminal cases were excluded from analysis.

Results:

A total of 23 cases met the inclusion criteria for our study. On average, 2.13 defendants were listed per case, often including the accused surgeon and their employer. Prior photographic consent was obtained in 69.57% (n = 16) of cases. In the remaining seven cases, the defendant did not obtain consent. In all seven of these cases, either the court ruled in favor of the plaintiff or both parties reached a settlement outside court.

Conclusions:

To mitigate risk, surgeons should maintain two separate photographic consent forms for internal and external use. Additionally, a formal audit process should be established to ensure proper consent has been established before publishing patient photographs external to the electronic medical records.

Takeaways

Question: What are the legal ramifications for publishing patient photographs without obtaining proper consent?

Findings: Through a retrospective analysis of the Lexis+ legal database, we conclude that lack of written consent places plastic surgeons at increased risk of litigation and financial liability. Additionally, it is imperative to understand the scope of one’s photographic consent forms. Publishing patient photographs outside the scope of consent further a surgeon’s risk of litigation.

Meaning: In addition to consulting with legal counsel, plastic surgeons should establish standardized processes for obtaining and retrieving photographic consent for all patients before publication.

INTRODUCTION

Testimonials from patients can be one of the most compelling marketing tools for a plastic and reconstructive surgeon’s practice. Before and after photographs can help reassure potential patients of a surgeon’s skillset and demonstrate experience with specific procedures.

Advances in technology have diversified the application of photography to many medical specialties. Photographs can be helpful during medical consultations, documentation, patient education, medical education, and for research purposes. Highly visual fields such as plastic and reconstructive surgery have integrated photography into routine practice. Preoperative and postoperative photographic imaging can considerably enhance a providers’ ability to track subtle changes over time.

In photography, ownership of images generally resides with the person taking the photograph, not with the subject. However, in the medical setting, the person taking the photograph does not necessarily own the copyright. Use of patient clinical photographs requires specific attention to confidentiality and privacy.¹ Health Insurance Portability and Accountability Act (HIPAA) rules and patient privacy must also be considered.² Therefore, obtaining proper consent is paramount.

The importance of consent and proper ways to obtain consent for photography have been studied in the medical setting.³ However, to our knowledge, litigation cases for improper utilization of patient images have not been analyzed. Understanding commonalities among cases will allow surgeons to take necessary steps to mitigate the risk of litigation. With an incomplete understanding of the nuances and details of privacy and HIPPA rules, surgeons are at continued risk of financial liability.

Our project sought to examine cases that involved the dissemination of patient photographs or videos by surgeons. Specifically, we focused on civil cases against surgeons for improper use of patient photographs to develop a better understanding of how litigation could have been avoided. Through this work, we aimed to provide new insights for plastic surgeons that may help them avoid litigation, while protecting the privacy and rights of their patients.

METHODS

Study Design

This retrospective study was designed to review the Lexis+ legal database for cases that involved the dissemination of patient photographs or videos by surgeons.

Data Collection

Inclusion criteria included civil cases in which the defendant was a surgeon being sued for the improper use of patient photographs. Criminal cases were excluded.

Data Analysis

Cases were analyzed for number of plaintiffs, medium with which the photograph/video was disseminated (eg, website, billboard, news channel, magazine), description of the incident, defendants involved (eg, surgeons, office, hospital), whether consent was obtained, the claim(s) made by the plaintiff (Fig. 1), and the final ruling or outcome of the case.

Fig. 1.

Claims.

RESULTS

Twenty-three cases met our inclusion criteria. Twenty-one of these cases involved plastic surgeons. The remaining two cases involved an otolaryngologist and an anesthesiologist. Nearly all cases included a single plaintiff (n = 19). On average, 2.13 defendants were listed per case. This often included the accused surgeon and their employer. Additional defendants included media companies and other individuals or entities that were involved in the dissemination of the patient photographs.

Patient photographs were published on a variety of platforms. The mediums (Fig. 2) included print (n = 9), professional websites (n = 8), personal devices (n = 3), television (n = 2), and social media (n = 1). In 69.57% (n = 16) of cases, the defendants obtained consent before photographing and/or videotaping the plaintiff. In 20 of the 23 cases, the court ruled in favor, or partially in favor, of the plaintiff. In seven of the 23 cases, the defendant did not obtain consent. In all seven of these cases, either the court ruled in favor of the plaintiff or both parties reached a settlement of an undisclosed amount.

Fig. 2.

Medium photography/videography was disseminated.

SELECT CASE DISCUSSIONS

Case 1: Unintended Consequences

Although consent was obtained for preoperative and postoperative photographs for informational, educational, and limited commercial purposes, the surgeon’s office posted naked photographs on their website with the patient’s name. Photographs were downloaded by a third party and subsequently used to harass the patient and her family by sending them the photographs. Although the physician did not partake in the harassment, the patient brought a civil suit against the surgeon claiming invasion of privacy, intrusion upon seclusion, breach of confidentiality, breach of fiduciary duty, negligence, professional negligence, and intentional infliction of emotional distress. The case ultimately reached a settlement outside court.

This case highlights the importance of maintaining a patient’s anonymity when publishing their photographs online, and the unintended consequences that may transpire when anonymity is violated. Although posting the patient’s photographs was within the surgeon’s rights after obtaining written consent, attaching identifiable information to the photographs is what ultimately led to the patient’s harassment. Without this information, it is unlikely the patient’s perpetrator would have been able to carry out their harassment.

Case 2: The Need for Written Consent

Before and after photographs were taken of the patient’s face and used in a department store and on television promoting the practice. The patient’s name was excluded; however, a former coworker present at the department store promotional event recognized the patient. Although verbal consent was taken on two separate occasions, the patient claimed invasion of privacy, punitive damages, breach of fiduciary duty, and portrayal of the patient in a false light. The case went to trial, and the jury ruled in favor of the patient granting a total of $350,000. The defendants were ultimately granted a new trial.

This case highlights two important principles: the need for written consent and the maintenance of anonymity in facial photography. Except in exceeding rare cases, verbal agreements do not maintain merit in a court of law, and written consent forms are the current standard of practice. To complicate matters in this case, the surgeon utilized photographs of the patient’s face in their presentation. Studies have demonstrated that people are able to easily identify familiar faces despite changes to facial features, using geometric and blur distortion.⁴ Therefore, publishing photographs featuring a patient’s face poses increased liability to the surgeon. It is important to consult with a lawyer to ensure the consent form being utilized contains language that will cover the surgeon if the patient’s identity becomes known to the public despite the surgeon’s best efforts to maintain privacy.

Case #3: Partnering with Third Parties

In this case, the surgeon and patient agreed to participate in a news story regarding the dangers of cosmetic surgery and the importance of surgeon selection. Before and after photographs as well as video footage of the physician performing a physical examination on the patient were provided to the news station. These were aired online, which the patient did not consent to. The news reporter also stated the patient’s name on live television. The patient gave consent “to be photographed or televised before, during, and after the operation(s) or procedure(s) to be performed, including appropriate portions of my body, for medical, scientific or educational purposes, provided my identity is not revealed by the pictures.” In the civil suit, the patient claimed false light, publicity of private facts, intrusion upon seclusion, breach of fiduciary duty, and negligent employment and supervision. The ruling was ultimately in favor of the defendant surgeon.

Partnering with third parties when publishing patient photographs increases the risk of improper disclosure of patient information. Although this surgeon obtained proper consent, the reporter accidently disclosed the patient’s name during the news story. When partnering with outside entities, it is imperative to educate them on the current standard of patient privacy. It may be useful for them to review the HIPAA Privacy Rule and be included in the imaging consent process. If the reporter and news channel had reviewed the consent document, they would have known the patient did not consent to her name being disclosed.

Case #4: Human Error

During the process of obtaining a prior authorization for surgery, a patient’s photographs were accidentally mailed to her employer instead of her insurance company. Several coworkers of the plaintiff, including her boss, saw her naked photographs. Although the patient had provided imaging consent to her surgeon, she had not provided consent to share the images with others. The patient claimed breach of the duty of confidentiality, invasion of privacy, negligent infliction of emotional distress, and negligence. Summary judgment was granted in favor of the defendant.

Human error is likely the most common reason for improper dissemination of patient photographs. Although eliminating human error is not feasible, various steps can be taken to help reduce their occurrences. In this case, it appears an employee confused the patient’s employer’s address with their insurer’s address. To eliminate this and similar events from occurring, surgeons should send protected health information, including patient photographs, to other business associates via fax. Now, this is often performed electronically through electronic healthcare records, further reducing the risk of improper dissemination.

Case #5: Exceeding the Scope of Consent

In a promotional newsletter containing gift cards to their clinic, a plastic surgeon mailed out a patient’s before and after photographs to over 4000 community members. The original consent obtained from the patient permitted the surgeon to disclose the photographs for educational purposes only. Upon discovery of the consent violation, the patient sued for violation of Civil Rights Law and punitive damages. Partial summary judgment in favor of the plaintiff on the issue of liability was granted.

Perhaps as important as obtaining the consent is its scope. While consent answers if photographs of a patient can be captured and published, scope outlines how it can be done. During this case analysis, it is important to understand the intended purpose of the surgeon’s action. The surgeon obtained consent for taking and distributing the patient’s photographs. However, the consent’s scope limited distribution for educational purposes only. Although some promotional newsletters may contain educational material, the inclusion of gift cards makes the primary purpose of this newsletter promotional instead of educational.

Case #6: Understanding Metadata

After meeting with a new acquaintance, a patient was informed that nude photographs of her could be easily found by Googling her name. The photographs in question were before and after pictures of her breasts taken by her surgeon. Although consent for photographs to be taken was obtained, she never consented to have her name be associated with the photographs. The plaintiff claimed breach of contract, public disclosure of private facts, appropriation of name or likeness, general negligence, breach of fiduciary duty, and negligent infliction of emotional distress. Ruling was in favor of the plaintiff in the amount of $18,000.

Here we see another example of human error. It is likely that when the photograph was being uploaded to the surgeon’s website, it had metadata attached to it, which included the patient’s name. In a basic sense, metadata are data that provide information about other data. In this scenario, the metadata containing the patient’s name was probably the image’s file name. When uploading images to public forums such as professional websites, it is important to ensure no identifying metadata are associated with the image. One way to ensure this is by adopting a standardized file naming process void of patient identifiers.

Case #7: Opt-in Consent Forms

Consent was obtained for taking photographs of the patient. However, in the consent form, the patient specifically opted out of having patient pictures published in print. The photographs were subsequently published in a magazine article featuring the defendant surgeon. Upon discovery, the patient sought claims of invasion of privacy, breach of an express warranty under the DTPA, and violations of the Medical Practices Act. The court ruled in favor of the plaintiff for a total of $37,500.

Giving multiple options in a single consent form complicates the record keeping process and increases liability. It requires the surgeon to manually review each consent form before publication to ensure they are upholding the scope of the agreement. To minimize this risk and reduce manual labor, surgeons should adopt two separate consent forms: one for internal use (ie, medical record keeping) and the other for external use (ie, educational and promotional purposes). Both forms should be all-inclusive, minimizing the need for retrospective review after completion. Finally, a formalized record keeping process that is easily accessible should be implemented to allow for quick and accurate reassurance of photograph consent. This can often be done as a workflow process for new patients in the electronic medical records.

Case #8: Quid Pro Quo

A surgeon used the plaintiff’s photographs for printed promotional material. It is alleged the patient verbally consented to having their photographs disseminated in exchange for reduced cost of her second surgery. No formal consent or exchange of services agreement was executed. The patient sued, claiming invasion of privacy and violation of her right to publicity. The initial ruling was in partial favor of the plaintiff.

Exchanging professional services with a patient requires various legal and ethical considerations, and should not be done without consulting with a lawyer. It must be recognized that plastic surgeons have significant power and leverage over their patients, as patients are entrusting their surgeons with information not privileged to the public. Additionally, because cosmetic procedures are costly and not covered by insurance, patients may be willing to agree to exchange services out of financial desperation. In general, we discourage this practice because it has the potential to harm the patient–physician relationship, as this case demonstrates.

DISCUSSION

Patient Perceptions of Clinical Photography

Photographs of patients were first used in the medical literature in 1849, and their use in modern medical journals has become commonplace.³ The ease at which data can be disseminated, combined with increased governmental focus on privacy of health information, has resulted in significant discourse surrounding the use of photography in medical practices. Literature to guide medical professionals when dealing with photography is limited, resulting in the potential for significant legal implications and confusion as to who owns the rights to patient photographs. One survey study found that 48.3% of surgeons and 40.2% of patients believed the rights to patient photographs belonged to the patient. Although the question of ownership is ambiguous and varies by state, it is often recognized that the patient owns the information contained within their medical record but the provider owns the record itself.⁵

Because patients often own their medical information, including photographs, it is important to understand patient preferences surrounding photography. A 2015 study found that only approximately one in 20 patients refuse photography in the clinical setting.⁵ Another study found that 84% of patients would consent to photography for medical education.⁶ Additionally, photograph consent was more likely if pictures were nonidentifiable and did not feature genitalia.^6,7 These sentiments were mirrored in our present study, as most patients provided initial consent to photography and brought civil suits against their surgeons only after their identity had been discovered by others.

Minimum Legal Standards for Consent

Although laws pertaining to patient privacy and photographic consent vary by state, the HIPAA of 1996 provides the main federal regulating guidelines addressing patient privacy.² Under the HIPAA Privacy Rule, providers must comply with procedures for safely protecting the healthcare information from misuse.⁸ Although the rule applies exclusively to electronic medical records, other provisions of HIPAA require adequate safeguards of patient images.⁹ This includes any information that makes the patient identifiable. If the image identifies the patient, it is PHI, and the surgeon is required to obtain the patient’s written authorization.¹⁰ Despite this, a recent study found that only 17.2% of the surgeons obtained written consent, 41.4% obtained oral consent, and 38.5% did not obtain any consent before taking a patient’s picture.

Similar to acquiring consent for treatment, surgeons should obtain written consent before medical photography. Consent to privacy release for the photograph is generally required where privacy is normally expected.⁵ For example, in a surgeon’s office or other healthcare facility, the expectation of privacy may exist and could be subject to a general privacy release regarding photography. In addition to a privacy release, publication of photography must be addressed. Not doing so places individuals and practices at increased risk of litigation. In all seven cases in our present study, where written consent was not obtained, the court ruled in favor of the plaintiff.

Best Practices for Consent

Medical practices should maintain two photograph consent forms: one for internal use and the other for external use. Consent forms for external use should be all-inclusive and outline the various mediums and purposes for external publication. Eliminating opt-in consent forms where the patient can select the medium and purpose for external publication reduces the risk of assumptions of consent being made. The American Society of Plastic Surgeons (ASPS) recently published their videotape and photographs release and authorization form, which should be viewed as industry standard.¹¹ In their consent form, ASPS ensures that all possible channels for publication are covered and that they maintain the sole rights to any imagery produced. ASPS goes as far as including the right to include the patient’s name in connection to any publications, further minimizing their risk of litigation.

Additionally, patients should be educated on the process of externally publishing their photographs. Patients should understand that although best efforts will be taken to maintain anonymity, there is always a risk that their identity is revealed. If the publication is in a journal, book, or the internet, the patient should have the understanding that once published, consent cannot be withdrawn. This is especially important for publication on the internet, in which images are in public domain.¹²

Perhaps most importantly, surgeons should implement a standardized process of both obtaining photographic consent at the initial encounter and confirming consent before external publication. Such processes can be easily integrated into most electronic medical record workflows.

CONCLUSIONS

Our analysis of litigation cases regarding improper utilization of patient images revealed commonalities amongst cases, allowing us to provide recommendations and propose best practice guidelines when publishing patient photographs. The most frequent commonalities among cases included opt-in consent forms and human error. Given the associated financial liability involved with litigation cases, several steps can be taken to mitigate risk, including establishing separate photographic consent forms for internal and external use, and establishing an auditing process whenever publishing patient photographs external to the electronic medical records.

DISCLOSURE

The authors have no financial interest to declare in relation to the content of this article.