Picture Perfect: Standardizing and Safekeeping Clinical Photography in Plastic Surgery

Abstract

 

Plastic surgery relies heavily on clinical photography to document preoperative and postoperative changes, visualize surgical approaches, and evaluate outcomes. However, the contemporary landscape of plastic surgery photography faces challenges, including a lapse in standards due to the prevalence of smartphones, social media platforms, and security concerns related to data storage and cyberattacks. In this comprehensive review, the authors aim to provide plastic surgeons with practical guidelines for achieving standardized, high-quality clinical photography while navigating the evolving landscape of technology, security, and ethical considerations. We explore the security challenges associated with storing clinical photographs, emphasizing the legal obligations under the Health Insurance Portability and Accountability Act (HIPAA). We also discuss various storage options, including HIPAA-compliant cloud services, electronic medical records, and emerging technologies like blockchain and artificial intelligence.

Level of Evidence: 5

Plastic surgery has long depended on clinical photographs to compare preoperative and postoperative changes. Before-and-after photographs have been a cornerstone of plastic surgery publications since the 1800s.¹ The importance of photography in this field cannot be overstated. Quality photography improves patient care by allowing surgeons to assess comprehensively and counsel patients, visualize surgical approaches, and evaluate postoperative outcomes. Further, these images can benefit surgeons by allowing them to analyze their work and expand their practices through marketing critically. Photographs can also be educational and are commonly used to teach and demonstrate novel surgical techniques to peers and learners in the peer-reviewed literature. Finally, these images can serve as documentation for insurance and legal purposes. However, quality photography in plastic surgery requires time and attention to detail and can be hindered by a lack of standardization.

Proper approaches require specific equipment, including a quality camera with an appropriate lens, suitable lighting, an uncluttered and monotone background, and a dedicated space.¹ In the current age of social media, photography standards have lapsed. The ease of capturing an image with an iPhone, posting on Instagram, and receiving countless “likes” has encroached on the standards of photography. An author in a recent study investigating plastic surgery photography bias on social media found that 70.8% of included images showed bias toward the postoperative photograph, most commonly because of using a more flattering background postoperatively.² An emphasis on strict photography standards in the field is required to diminish this bias and maintain a standard by which we evaluate and communicate surgical outcomes.

Another concern that plagues modern plastic surgery photography is security and storage. Patient photographs are protected health information (PHI). Unfortunately, the most commonly used photo-sharing and storage technologies are not Health Insurance Portability and Accountability Act (HIPAA) compliant and are susceptible to data theft. Data leaks of this nature are made worse by the intimate nature of many plastic surgery photographs.³ Surgeons must learn which technology will protect patient photographs to serve patients best.

The aims of the authors of this review are 3-fold: to describe optimal 2D photography standards for face, body, and breast imaging, to discuss various security concerns and storage systems that are currently in use, and to investigate how to prevent breaches of security and optimize patient confidentiality.

CAMERAS

Digital single-lens reflex (DSLR) cameras are the gold clinical photography standard.^4,5 These cameras contain a mirror, which allows the photographer to visualize an accurate representation of the photograph they are capturing. Contrarily, mirrorless cameras, such as the Sony A7 IV (Sony, Tokyo, Japan) and the Canon EOS 57 (Canon, Tokyo, Japan), show photographers a digitally reconstructed image. Mirrorless cameras do have the advantage of being lighter and smaller.⁴

High-quality clinical images need to have appropriate resolution. Plastic surgery journals often require a minimum resolution of 5 megapixels for publication. Most iPhones offer a resolution of 12 megapixels, with the recent iPhone 15 Pro (Apple, Cupertino, California) having an impressive 48-megapixel resolution.⁶ Samsung smartphone cameras also meet this requirement, with the newest Samsung Galaxy S23 Ultra (Samsung, Suwon-si, South Korea) offering an unprecedented 200-megapixel primary lens.⁷ Higher resolution offers the benefit of maintaining high-quality photography even when using digital zoom. However, smartphone megapixels are not equivalent to DSLR pixels, because smartphones have smaller camera sensors.⁸

When comparing smartphone and professional photography, images are often less consistent across time. The ease and speed associated with smartphone photography can result in inadequate setup. For example, although DSLRs are placed on a tripod to ensure appropriate positioning, smartphones are often supported solely by the photographer, resulting in variability.

Smartphone cameras offer increased portability and the ability to upload a patient's electronic medical record (EMR) using a mobile app. Further, a smartphone with a detachable telephoto lens setup costs approximately half the cost of a DSLR.⁵ Researchers comparing a DSLR to the iPhone 11 (Apple, Cupertino, California) with a 58 mm telephoto lens demonstrated that plastic surgeons could not appreciate the difference between photographs taken with the 2 cameras.⁵ Telephoto lenses allow photographers to zoom-in without sacrificing image resolution—these lenses extend the focal length instead of simply cropping and enlarging a portion of the photograph. All models of the iPhone 11 Pro and beyond include a telephoto lens.⁶

3D photography is a recent development in clinical photography. 3D imaging provides clinicians with additional information, including contour and shape. It relies on stereophotogrammetry, the practice of combining photographs from many angles.⁴ The Vectra System (Canfield Scientific, Parsippany, NJ) is a popular method of facial 3D photography that combines 3 stereoscopic images. Other 3D imaging options include LifeViz Infinity models (QuantifiCare, Biot, France), Mini, Micro, or Body QuantifiCare, XT (for body and face), or the Canfield WB360 3D (for body) (Canfield Scientific, Parsippany, NJ).⁸

3D photography can improve preoperative counseling and ensure that patients and surgeons agree on surgical goals. Patients with rhinoplasty who underwent preoperative 3D simulation with the Vectra System had a statistically significant increase in postoperative satisfaction compared with those who were counseled using 2D imaging.⁹ Further, in a study, Lekakis et al compared rhinoplasty consultation experiences with 2D and 3D imaging. The overwhelming majority of patients reported the added value of 3D imaging, whereas surgeons stated that 3D imaging during rhinoplasty consultation added value to two-thirds of patients.¹⁰

PHOTOGRAPHY LOGISTICS

Setup

All photography should be conducted in a room without windows. This is important for patient privacy and ensuring consistent lighting throughout the day. “Studio lighting” provides ideal illumination and requires 3 light sources.¹¹

Consistency is equally valuable when considering photographic backdrops. A plain, light blue background is popular because it complements all skin tones and minimizes glare (Figure 1).¹¹

Figure 1.

An appropriate photography setup includes a windowless room, studio lighting, and a consistent background.

Optimally, all patients would agree to be photographed without undergarments in the frame. If this is not preferred, wearing black, inconspicuous undergarments consistently before-and-after images is recommended.¹² All makeup and jewelry should be removed.¹³

Aspect Ratio

Aspect ratios describe the ratio of a photograph's width to its height. This ratio should be consistent across photographs of the same anatomical region. Most clinical photographs utilize an aspect ratio between 1:3 and 1:10.¹³ For example, the recommended aspect ratio for rhinoplasty patients is 1:3, cleft lip repair is 1:4, and facelift is 1:7.¹³

Camera Position

The camera should be placed on a tripod stand to level with the photographed area, approximately 1.5 m from the patient.¹²

Media Consent

Clinical photographs that have not been deidentified are a form of PHI and, therefore, require consent at the initial encounter. Ideally, media consent should inform patients about how their data will be stored. If photographs are used for nonclinical purposes, such as education and publication, an additional written authorization is required. However, deidentified patient photographs that cannot be linked to a specific patient are exempt from this additional step.¹⁴

PHOTOGRAPHY STANDARDS

Face

Facial photography can be divided into full face, close-up face, nose, eyelid, and ear photography. Full face photography should be framed with the patient's ears at the vertical midline. Classically, the lower frame of the photograph is bordered by the clavicle. The entire head should be centered on the horizontal plane. For oblique and lateral views, patients should rotate their entire body and not only the head and neck.¹⁵ Hair should be pulled back with clips in order to capture an unobstructed view of the entirety of the face and ears. Views specific to facial photography include the worm’s eye view, used to photograph the nose, and the down and across view, used to photograph the hairline.¹³

Abdomen

There are 4 standard views required for appropriate photography of the abdomen. Firstly, frontal abdominal photographs provide a comprehensive view of the upper front body, encompassing the chest, groin, and anterior thighs. The groin should always be included to evaluate for mons pubis ptosis. It is crucial for the photographer to pay close attention to the patient's upright and aligned posture. This can be confirmed by mentally drawing a horizontal line across the patient's shoulders, along with a straight axial line connecting the top of the head, middle of the head, nose, belly button, and mid-pubic area. Some patients will demonstrate anatomical asymmetries in spite of appropriate posture. To prevent any distortion of the abdominal region, the arms should be positioned perpendicular to each side of the body. A detailed frontal photograph should also be recorded, zoomed-in to only include the smaller frame between the inframammary fold and the anterior thighs. This image can better capture skin laxity, striae, and skin integrity.¹⁶

Secondly, the posterior abdominal photograph utilizes the same positioning and framing as the frontal images. This view can be particularly helpful for preoperative counseling for circumferential body contouring surgery, because patients rarely observe their bodies from the posterior view.

Thirdly, the lateral view should be photographed twice, once for each side of the body. This view allows the surgeon to appreciate any abdominal overhang and skin folding. Patients should position their arms perpendicular to the side of their body with a 90° elbow flexion. Once again, the area from the upper pole of the breast to the mid-thigh should be included.

Lastly, the detailed view or “divers” view is an anterior–posterior photograph captured by instructing the patient to place the dorsum of each hand on the ipsilateral buttock while performing a 20° to 30° hip flexion. The patient should look straight ahead, although the face itself should not be included in the photograph. This view is essential for assessing abdominal adiposity, muscular diastasis, and skin laxity.¹⁶

Other views that may be helpful include frontal photographs with arms raised over the head, lateral divers view, and frontal and lateral views during Valsalva.¹⁷

Breast

For clinical breast photography, the included frame should be bordered by the clavicle superiorly and between the anterosuperior iliac spines inferiorly. A complete clinical breast photograph series should include 10 images—an anterior photograph, two 90° lateral photographs, and two 45° oblique photographs with the patients’ hands on their hips and the same 5 images captured with the patients’ hands on their head.¹⁸ This series is time-intensive and can therefore often be substituted by an anterior photograph and bilateral oblique and lateral photographs with the patients’ hands behind the back with one hand holding the contralateral wrist. Patients should be instructed to externally rotate their shoulders so that their upper arms do not obstruct the view of the lateral breast tissue. Some surgeons also utilize a frontal view with the patients’ hands on their flanks while contracting the pectoralis muscle. This view can assess the dynamic change in position of submuscular breast implants.¹⁷

STORAGE SYSTEMS

Storing clinical photographs securely is of paramount importance. These images are often intimate and can leave patients feeling vulnerable. Under the HIPAA, clinical photographs are legally required to be protected. In essence, this means that plastic surgeons have a legal duty to store patient images electronically and physically in a secure manner.¹⁹

Unfortunately, cyberattacks can target PHI, including clinical photographs. In 2020, a plastic surgery practice in Great Britain was hacked, resulting in 900 GB of patient photographs being leveraged to secure a ransom.²⁰ For this reason, deidentification should be sought whenever possible—this includes avoiding capturing the face with body images. It is also important for plastic surgeons to exclude identifiable tattoos and other body art from clinical photographs whenever possible. This can often prove a challenge in the pursuit of deidentification.

Plastic surgeons, particularly those in private practices, are appealing targets to data hackers because they house valuable patient data, while employing lower tier security measures. Given the expected risk of theft, adherence to federal law is imperative. Compliance with the HIPAA provides legal protection for practices in the event of data theft. However, noncompliant systems expose practices and their management to potential financial and criminal consequences. In the initial 5 months of 2017, the HIPAA enforcement agency imposed over $17 million in penalties on healthcare providers.^21,22

Surgeons can be sued for negligence, invasion of privacy, breach of fiduciary duty, breach of confidentiality, and more if PHI in the form of clinical photographs becomes public. In a recent study, Patmon et al analyzed civil cases in which surgeons were sued for improper use of patient photographs. In 20 of the 23 included cases, the court ruled at least partially in favor of the plaintiff.²³ HIPAA breaches are often prosecuted as civil violations, resulting in significant fines. Unknowingly violating the HIPAA is associated with a $100 fine per violation, with an annual maximum of $25,000 for repeat violations. Willful neglect has a much steeper penalty of $50,000 per violation, a yearly maximum of $1.5 million.²¹

Plastic surgeons commonly use cloud services to email clinical photographs to colleagues and document complications for later presentations, for example. These services store data remotely on a third-party service and allow it to be accessed by multiple devices. Examples of “cloud” services include Google Drive (Google, Mountain View, CA), Dropbox (San Francisco, California), Microsoft OneDrive (Redmond, WA), and more.³ As per Market Data Forecast, the healthcare cloud computing market attained a valuation of $5.22 billion in 2022, with a projected escalation to $201.1 billion by 2032. Approximately 90% of healthcare organizations have either adopted or are poised to embrace cloud-based services by the year 2025.²⁴

Anecdotally, clinical photographs are commonly shared among providers through text messaging. Although this approach is efficient, these messages do not have end-to-end encryption, and third-party applications can inadvertently give outside parties access to these photographs.³ Commonly used text messaging applications noncompliant with the HIPAA are SMS, iMessage (Apple, Cupertino, California), Facebook Messenger (Meta Platforms, Inc., Menlo Park, CA), and WhatsApp (Meta Platforms, Inc., Menlo Park, CA).²¹ Only 9.4% of providers who text PHI use HIPAA-compliant software exclusively. Telegram (Dubai, United Arab Emirates) and Signal (Signal Foundation, Mountain View, California) are other text-based technologies that are often thought to be secure but are, in fact, not HIPAA compliant.^25,26

The “old-fashioned” method of storing clinical photographs on a password-protected hard drive without internet connectivity does offer complete security. Still, it is hindered by low accessibility and no backup in case of loss or theft.

EMRs are another HIPAA-compliant and popular method of clinical photograph storage and sharing. This modality is provided by hospital systems and often allows patients to view their own health information. Concerningly, these records are a vulnerable target for data theft. In 2012, 90% of healthcare organizations reported security breaches in their EMRs.³ Experts have noted a pattern of ignoring software flaws and security measures in order to prioritize convenience.²⁷ Another flaw associated with this method of storage is that it is not specific to plastic surgery providers, meaning all providers with access to a patient's EMR can view their clinical photographs. This leaves the potential for intimate photographs to be seen by providers treating unrelated conditions. In large health systems’ EMRs, photographs stored in the Picture Archiving and Communication System or other systems could be accessible to tens of thousands of system employees.

There are multiple modern methods to ensure secure storage. Chandawarkar and Nadkarni provide various recommendations for secure digital photography infrastructure, including end-to-end encryption, 2-factor authentication, remote wipe function, and regular data audits.²⁸ To be HIPAA-compliant, software companies must obtain a Business Associate Agreement (BAA). Most hospital email vendors have a BAA that allows for secure patient photograph storage. Unfortunately, these email accounts often have limited storage space. EMRs also offer HIPAA-compliant photograph storage but can frequently be accessed through mobile phones.³

Examples of HIPAA-compliant cloud storage options with BAAs include Microsoft Office 365 (Redmond, WA), Google Apps for Work (Google, Mountain View, CA), and Box (Redwood City, California). AppWoRx (Bellevue, WA), another cloud storage option, offers the benefits of being designed for images to be taken, sent, and viewed through a secure mobile app.³ Of note, DropBox and Apple iCloud (Apple, Cupertino, California) are not HIPAA compliant.³

Mayo Clinic uses PhotoExam (Mayo Clinic, Rochester, MN), an app for iPhones and iPads, to ensure patient privacy. Once photographs are taken, they can be uploaded to PhotoExam for secure storage. All associated metadata is automatically deleted from the smart device after the data are uploaded to the EMR.²⁹

Blockchain technology also offers a promising solution to data theft. It is a shared database in which data are stored in a distributed fashion. This approach offers the benefit of making data easily accessible, while protecting it from hackers.³⁰ Each separate block is encrypted, so changes to 1 block will not be accepted by the rest.

Dual authentication is another technology that offers additional security measures. Single authentication approaches require 1 credential to access stored data. Dual authentication doubles the effect of identity authentication by requiring users to provide 2 separate credentials. Although this process can become tedious, it undoubtedly improves security.³¹

Canfield's Mirror Suite (Parsippany, NJ) is a popular clinical photograph storage option for aesthetic practices. In addition to photo-editing software, its PhotoFile technology offers a HIPAA-compliant environment for secure storage.³²

Finally, artificial intelligence (AI) is becoming more prevalent in clinical photography. Although it is currently unclear how this may impact clinical photograph security, AI cameras and software can contribute to image processing and image analysis. For example, AI-powered cameras can automatically optimize lighting and resize and rotate images. AI-powered editing software can also utilize human-acquired knowledge to edit photographs with precision and consistency.³³ Although this technology is currently imperfect, as AI improves, it is likely to become vital to clinical image analysis, including taking measurements, making classifications, and assisting with preoperative planning.⁴ It is important for both plastic surgeons and the public to stay vigilant; however, because generative AI can be used to alter preoperative and postoperative images, potentially resulting in unethical publishing or marketing.

Risk Mitigation Strategies

The authors offer a checklist of strategies used to minimize risk (Table 1).

Table 1.

Risk Mitigation Strategies to Improve Photograph Storage Security

Risk mitigation strategies
1. Deidentify clinical photographs whenever possible. Unless necessary, do not include identifying tattoos, scars, or birthmarks
2. Avoid using PHI when naming files containing clinical photographs, including patient names and medical record numbers
3. Ensure that all text messaging incorporating clinical photographs is done through HIPAA-compliant apps, such as TigerText, Vocera, and Imprivata17
4. When storing patient photographs on cloud services, confirm whether there is a signed BAA. This will protect against litigation in case of data theft
5. Plan accordingly to ensure that media consents for journal submissions will be obtained at the time of patient encounter

BAA, Business Associate Agreement; HIPAA, Health Insurance Portability and Accountability Act; PHI, protected health information.

Although the authors in this review offer a comprehensive approach to understanding clinical photograph security and storage in plastic surgery, this paper is not exhaustive and is subject to changing technology. Plastic surgeons must stay up to date on this topic to ensure compliance with industry standards.

CONCLUSIONS

The critical role of photography in plastic surgery cannot be overstated. However, the advent of social media and the ease of smartphone photography have introduced challenges, including biases in postoperative image representation. The need for strict standardization in plastic surgery photography is evident to ensure uniformity and mitigate potential biases.

Moreover, the authors in this paper highlight a significant concern in the form of security issues associated with storing and sharing plastic surgery clinical photographs. The sensitive nature of these images as PHI calls for a heightened awareness of potential data breaches and compliance with health regulations, such as the HIPAA. Surgeons must actively choose secure technologies to safeguard patient confidentiality and privacy.

Disclosures

The authors declared no potential conflicts of interest with respect to the research, authorship, and publication of this article.

Funding

The authors received no financial support for the research, authorship, and publication of this article, including payment of the article processing charge.