Health Information Compliance Alert

Published on Tue Jan 26, 2010 PDF

Question: For demonstration purposes in a sales context, if a picture or video of a patient were used with no identifying information, would this violate Health Insurance Portability and Accountability Act (HIPAA)?

Answer: A photo is an identifier, explains Kristen Rosati, a partner at Coppersmith Gordon Schermer Owens & Nelson.

She says the Department of Health and Human Services lists photos as identifiers, "and therefore any photos where you can tell an individual's identity are treated as protected health information." That means any disclosure of that photo has to be viewed under HIPAA, but the legality of that disclosure depends on how you're using the information, she notes.

There are a lot of issues that need to be evaluated to determine whether that disclosure would count as a violation, but what you do need to know is that disclosure of a photo is a disclosure of protected health information (PHI), Rosati asserts.

If you're making a disclosure for marketing purposes, you have to follow the HIPAA marketing rules. There's a definition of what marketing is, so take a look at whether the communication that you're making with the photo even constitutes marketing, and if it does, there are a couple of exceptions where you don't need authorization to do the marketing.

This is a pretty complicated issue, and Rosati advises entities to take a closer look both at the definition of marketing and also the exemptions from authorization for the marketing rule.