Dermatology Mohs Photo Retention Policy Checklist (HIPAA-Compliant)

This checklist helps you build a clear, defensible policy for capturing, retaining, and securing Mohs surgical and dermatology clinical photographs in a HIPAA-compliant way. It covers Protected Health Information, consent, storage, encryption, personal device controls, de-identification, retention, and vendor governance.

HIPAA Requirements for Clinical Photography

Any clinical image that can identify a patient—alone or in combination with other data—is Protected Health Information (PHI). When stored or transmitted digitally, it is ePHI and must meet HIPAA Privacy, Security, and Breach Notification requirements. Treat Mohs lesion, margin, and reconstruction photos as part of the medical record and link them to the correct encounter in your Electronic Health Record.

Checklist

• Define photos as PHI/ePHI in policy; apply minimum-necessary use and disclosure standards for all workflows.
• Capture images in private settings; avoid unnecessary identifiers (full face, jewelry, name bands) when not clinically required.
• Standardize labeling: patient, date/time, body site, laterality, and Mohs stage; link images to the Electronic Health Record immediately.
• Establish Access Control Policies: role-based access, unique IDs, multi-factor authentication, automatic logoff, and routine audit-log review.
• Perform security risk analysis annually and after major changes; harden endpoints used for imaging and block unsanctioned apps.
• Train all workforce members on photo handling, incident reporting, and sanctions; document completion.
• Maintain breach response procedures, including assessment, mitigation, patient notification (when required), and six-year documentation retention.

Consent Guidelines for Surgical Margin Photos

Photography for treatment, payment, or healthcare operations is generally permitted under HIPAA, but you should obtain specific, written consent for photography whenever feasible—especially for Mohs margin documentation where anatomy can be uniquely identifying. Separate, explicit authorization is required for non-treatment uses such as education, publication, or marketing.

Checklist

• Use a dedicated photo consent form that describes purpose, scope (e.g., margins, defect, repair), and revocation rights.
• Clarify whether images may include identifiable features (e.g., eyes, tattoos, unique lesions) and whether masking will be applied.
• For non-treatment use, obtain HIPAA-compliant authorization naming specific purposes; no bundled “all uses” language.
• Record consent status in the Electronic Health Record and tie it to each image set; honor patient restrictions.
• Define a process to re-consent if images are repurposed beyond the original scope.

Secure Storage and Encryption Practices

Secure storage relies on strong Data Encryption Standards, rigorous key management, and controlled image flows that avoid consumer apps. Route all images directly into your Electronic Health Record or a HIPAA-compliant image repository with continuous monitoring and auditing.

Checklist

• Encrypt in transit with modern TLS and at rest with strong algorithms (e.g., AES‑256); prefer FIPS-validated cryptographic modules where applicable.
• Store originals in a secure repository integrated with the EHR; disable local camera roll storage for clinical apps.
• Implement the 3-2-1 Backup Strategy: three copies, on two different media, with one offline/offsite; test restores regularly.
• Harden access with least privilege, just-in-time elevation (when needed), and quarterly access recertification.
• Use tamper-evident audit logs for view/export/delete events; alert on anomalies and excessive downloads.
• Manage encryption keys centrally with rotation and separation of duties; document break-glass procedures.
• Define secure transfer options for referrals and tumor boards (e.g., secure messaging portals) and prohibit unencrypted email.

Use of Personal Devices and Risk Mitigation

Personal devices can rapidly leak PHI through auto-uploads, messaging apps, and lost phones. If you permit BYOD, enforce technical controls that isolate ePHI and ensure rapid containment if a device is lost or compromised.

Checklist

• Require mobile device management (MDM): device encryption, strong passcodes, biometric lock, remote wipe, and jailbreak/root detection.
• Use approved clinical camera apps that bypass the camera roll and auto-upload directly to the Electronic Health Record.
• Block consumer cloud backups and messaging; use only secure clinical messaging with audit trails and a Business Associate Agreement.
• Disable geotagging and strip EXIF metadata on capture; prevent screenshots within clinical imaging apps when feasible.
• Auto-delete local copies after successful upload; set retention for temporary caches to hours, not days.
• Obtain user attestation to the policy at onboarding and annually; enforce sanctions for violations.

De-Identification Procedures for Non-Treatment Use

When photos are used beyond treatment—education, quality improvement, or publication—apply documented De-Identification Protocols. Use safe-harbor style removal of identifiers and expert-determination methods when risk remains.

Checklist

• Remove or obscure direct identifiers: face/eyes, tattoos, birthmarks, room signage, and background items that can reveal identity.
• Crop images to the smallest necessary field; mask periocular structures and distinctive features when not clinically essential.
• Strip all metadata (EXIF, GPS, device IDs); rename files with non-identifying codes linked to the record only inside the EHR.
• Maintain a written De-Identification Protocols document with quality checks and two-person verification before release.
• For publications or marketing, obtain specific authorization even when de-identified if recognition risk persists.

Retention Periods and State Law Compliance

Retain clinical photos as part of the medical record for at least the longest period required by applicable state laws, payer contracts, and your organization’s policy. For minors, keep records through the age of majority plus the state-specified period. HIPAA also requires you to retain related documentation—policies, procedures, consents, logs, and BAAs—for six years.

Checklist

• Create a state-by-state retention matrix for adults, minors, and special cases (e.g., research, workers’ compensation).
• Apply legal holds immediately when litigation or investigations are reasonably anticipated; suspend routine deletion.
• Align deletion with your backup cycles so “expired” images are purged from primary storage and backups on schedule.
• Document destruction using secure wipe or cryptographic erasure methods and obtain vendor certificates when applicable.
• Ensure retention rules are enforced within the Electronic Health Record and any imaging repositories.

Business Associate Agreements and Vendor Management

Any vendor that handles, transmits, or stores your clinical photos must sign a Business Associate Agreement. Vet platforms for security, reliability, and alignment with your Data Encryption Standards and Access Control Policies, and monitor them over time.

Checklist

• Inventory all vendors touching photos: EHR, secure camera app, cloud storage, teledermatology, secure messaging, analytics.
• Execute a Business Associate Agreement covering permitted uses, breach notice timelines, subcontractor flow-down, and data return/deletion.
• Assess vendors annually: security questionnaires, SOC 2/ISO attestations, penetration testing summaries, uptime SLAs, and support responsiveness.
• Validate technical controls: encryption at rest/in transit, key management, audit logging, MFA, and segregation of customer data.
• Require evidence of the 3-2-1 Backup Strategy (or equivalent) and tested disaster recovery objectives.
• Establish exit plans for data portability, secure deletion, and certificate of destruction at contract termination.

In summary, a strong Dermatology Mohs Photo Retention Policy Checklist (HIPAA-Compliant) unites clear consent practices, rigorous encryption and access controls, disciplined retention, and vigilant vendor oversight—implemented within your Electronic Health Record and daily workflows.

FAQs.

What does HIPAA require for dermatology photo retention?

HIPAA requires you to treat identifiable photos as PHI/ePHI, protect them with administrative, physical, and technical safeguards, and retain related compliance documentation for six years. It defers clinical record retention durations to state law and other applicable requirements, so align your photo retention with your state’s medical record rules and your organizational policy.

How long must Mohs surgical photos be retained?

Retain Mohs surgical photos for at least the same period you keep the patient’s medical record under your state’s rules, with longer timelines for minors where required. If payer contracts, accreditation, or legal holds demand more time, follow the longest applicable requirement before securely destroying the images.

Can clinical photos be stored on personal devices?

Only if your policy expressly permits BYOD with strong controls. Use MDM-enforced encryption and passcodes, approved clinical camera apps that avoid the camera roll, automatic upload to the Electronic Health Record, blocked consumer cloud backups, remote wipe, and rapid removal of local copies after upload.

What safeguards ensure photo security during teledermatology?

Use a platform covered by a Business Associate Agreement with end-to-end encryption, modern TLS, and strict Access Control Policies. Require MFA, log all access, disable downloads where feasible, restrict screenshots, and route images into the Electronic Health Record promptly. Train staff on minimum-necessary sharing and verify patient identity before transmitting images.