Kansas Guide to Privacy Laws for Meibography Images

Meibography images can document an eye-care examination, but their privacy status depends on whether they identify you, how they are kept, and how a provider uses or shares them. HIPAA rules and Kansas laws address different parts of that picture: protecting health information, giving patients access to records, regulating certain filming, and setting retention requirements.

When do meibography images count as protected health information?

A meibography image is protected health information (PHI) under HIPAA when it relates to your health or care and identifies you—or could reasonably be used to identify you—while held or transmitted by a HIPAA-covered provider or its business associate. A clinical image linked to your name, appointment, medical record number, or examination details will generally be PHI.

An image is not automatically identifiable just because it depicts part of your face. HIPAA’s Safe Harbor de-identification method specifically lists full-face photographs and comparable images among the identifiers that must be removed. A close-up image of the eyelid is not necessarily a full-face photograph, but the provider must still assess whether the image, its metadata, surrounding records, or other available information could identify you. HIPAA also allows de-identification through a qualified expert’s documented determination that the identification risk is very small. See HHS guidance on HIPAA de-identification standards and 45 C.F.R. § 164.514.

How HIPAA governs the use and disclosure of meibography images

HIPAA generally allows a covered eye-care provider to use or disclose PHI for treatment, payment, and health care operations without obtaining a separate HIPAA authorization. For example, sharing a clinically relevant image with another provider involved in your care may be permitted for treatment. The provider must still follow applicable safeguards and other HIPAA requirements. HHS explains when authorization is and is not required.

A provider generally needs a valid written HIPAA authorization for a use or disclosure that is not otherwise permitted or required by the Privacy Rule. This can include sharing an identifiable image for marketing, publication, or public social-media use. A general agreement to receive care is not automatically a HIPAA authorization for those purposes. A valid authorization identifies the information and recipient, states the purpose and expiration, and explains your right to revoke it. See HHS guidance on HIPAA consent and authorization and 45 C.F.R. § 164.508.

HIPAA authorization and Kansas informed voluntary consent for filming are not interchangeable. One concerns permitted uses and disclosures of PHI; the other is a specific filming right for certain patients in Kansas facilities, described below.

What consent is required to film patients in Kansas treatment facilities?

Kansas law gives a right not to be filmed or taped without informed and voluntary consent to a defined group of people in the custody of the Kansas Secretary for Aging and Disability Services, including certain people receiving mental-health services and people in the custody of the Secretary after being found a sexually violent predator. For this group, consent must specifically name the person or group authorized to film, the particular purpose or project, and the specified time period. The patient may identify periods or situations when filming is not allowed; a guardian consents for a legally incompetent patient, and security filming is an exception. See K.S.A. 59-29a22.

This statute does not establish that same filming rule for every patient in every Kansas hospital, clinic, or eye-care office. For other settings, providers must follow HIPAA and any other laws or facility policies that apply. If an image will be disclosed for a purpose that requires authorization, a patient’s agreement to have an image taken does not by itself authorize that later disclosure.

How patients can access and protect their medical records in Kansas

If your meibography image is part of a covered provider’s designated record set, you can generally request access to it. Submit a written request to the provider’s records department or privacy officer, identify the image or examination as clearly as possible, and specify whether you want to inspect it or receive a copy. HIPAA generally requires a response within 30 calendar days; in limited circumstances, the provider may take one additional 30-day period after giving you written notice of the delay. See HHS guidance on accessing medical records and HHS guidance on access-request deadlines.

Kansas law also requires covered entities to provide access to PHI consistent with HIPAA and maintain appropriate administrative, technical, and physical safeguards. Under K.S.A. 65-6836, providers within that statute’s definition generally must furnish copies of health care records within 30 days of receiving the required authorization, or notify the patient or representative why copies are unavailable. The exact procedure can depend on the provider and the records requested. See K.S.A. 65-6824 and K.S.A. 65-6836.

To help protect your records, use the provider’s secure portal or another approved delivery method, avoid posting identifiable clinical images publicly, and ask the provider how images are stored and shared. If you believe a covered provider improperly disclosed your image, contact the provider’s privacy officer; you may also submit a complaint to the HHS Office for Civil Rights.

Does Kansas regulate biometric data in meibography images?

Kansas has a specific written-consent rule for school districts: a district may not collect biometric data from a student, or use a device or mechanism to assess a student’s physiological or emotional state, unless the adult student or the minor student’s parent or legal guardian consents in writing. See K.S.A. 72-6315.

That provision is limited to school districts and students; it should not be treated as a general rule governing every clinical image or every eye-care provider. A meibography image used to examine the eyelid is not automatically biometric data merely because it depicts part of the eye area. Whether a particular technology or use involves biometric data depends on what is collected and how it is used, including whether it is used to identify or assess a person.

When does Kansas law restrict photographing patients without consent?

Kansas’s breach-of-privacy statute does not make every photograph taken without consent a crime. Its concealed-photography provision addresses knowingly recording an identifiable person under or through clothing, or a person who is nude or undressed, for the purpose of viewing the body or undergarments, without consent or knowledge, with intent to invade privacy and in circumstances where the person reasonably expects privacy. The statute also addresses dissemination of certain images obtained in violation of that provision and certain nonconsensual intimate images. See K.S.A. 21-6101.

Routine clinical imaging of an eyelid is not, by itself, the conduct described in that concealed-photography provision. That does not mean every recording or disclosure in a care setting is permissible: HIPAA, the specific filming protections for covered patients under K.S.A. 59-29a22, and facility rules may impose separate requirements.

Retention periods also depend on the provider and facility type. Kansas optometry regulations require covered patient records to be maintained for at least five years; the Board of Healing Arts states that records for M.D., D.O., and D.C. licensees must generally be kept for at least 10 years from the professional service; and hospital rules require retention for 10 years after the patient’s last discharge or one year beyond a minor patient’s age of majority, whichever is longer. See the Kansas Board of Examiners in Optometry rules, the Kansas Board of Healing Arts patient-record guidance, and KDHE medical-care-facility regulations. HIPAA itself does not set a general medical-record retention period; state and other applicable requirements determine how long records must be kept. See HHS guidance on HIPAA and record retention.

In short: Treat identifiable meibography images as sensitive clinical records, distinguish permission to take an image from authorization to disclose it, and check the rules that apply to the specific provider, facility, and purpose.

FAQs

Are meibography images protected by HIPAA?

They are protected when they relate to your health or care, identify you or could reasonably be used to identify you, and are held or transmitted by a HIPAA-covered entity or its business associate. A close-up image is not automatically identifiable, so context, linked records, and metadata matter.

Can a Kansas eye care provider share meibography images without patient authorization?

Sometimes. HIPAA generally permits covered providers to use or disclose PHI for treatment, payment, and health care operations without a separate authorization. A disclosure for a purpose not otherwise permitted or required—such as many marketing or public-posting uses—generally requires a valid HIPAA authorization.

Can patients refuse filming in Kansas treatment facilities?

Patients covered by K.S.A. 59-29a22 have a right not to be filmed or taped unless they provide informed and voluntary consent that specifies the authorized person or group, purpose or project, and time period. The statute applies to its defined group of people in the custody of the Secretary for Aging and Disability Services; it does not create the same specific rule for every patient in every Kansas health-care setting.

How long must Kansas health care facilities retain patient records?

There is not one retention period for every provider and facility. Kansas optometry rules generally require at least five years, Healing Arts licensees generally must retain records for at least 10 years from the service date, and hospitals generally must retain records for 10 years after the last discharge or until one year after a minor reaches the age of majority, whichever is longer. Check the rule for the provider and facility involved, since other requirements may apply.