Retinopathy of Prematurity Screening Program: Photography and Video Policy Guide

This guide outlines practical safeguards for retinopathy of prematurity imaging, including digital fundus photography and video. It is a general framework, not a substitute for your organization’s approved policy, clinical protocol, applicable state law, or advice from its privacy and security officers.

What photography and video does the policy permit?

Permit photography or video only when it serves an authorized clinical purpose, such as screening, documentation, remote review, or follow-up, and is consistent with the program’s clinical protocol. Use approved retinal imaging equipment and workflows; do not assume that personal devices or informal recordings are acceptable.

Image-based screening requires a defined process for retinal image acquisition, qualified capture and interpretation, timely follow-up, and escalation when images are inadequate or findings need further examination. The American Academy of Pediatrics guidance on ROP screening describes telemedicine images as a possible screening approach or adjunct when implemented properly, and recommends incorporating captured images and interpretations into the permanent medical record.

Because a still photograph and a video may capture different information, the policy should specify permitted recording types, clinical purposes, equipment, and circumstances. Do not record more than the clinical task requires.

Who may capture or access screening images and recordings?

Only staff members who are trained, authorized under the program’s protocol, and acting within their assigned roles should capture images. The protocol should identify who is responsible for image quality, clinical interpretation, documentation, communication of results, and arranging any required repeat imaging or examination.

Access should be limited to authorized workforce members and clinicians who need the images for their work. Use individual accounts and role-based permissions rather than shared credentials, and review access when staff responsibilities change. HHS describes role-based access as a way to limit access to protected health information (PHI) to workforce members who need it for their duties. See the HHS guidance on the HIPAA minimum necessary requirement and this overview of the HIPAA minimum necessary requirement; the rule does not apply to provider-to-provider disclosures for treatment, but role-based safeguards still matter.

Remote interpreters should have the appropriate clinical expertise and receive images through an approved workflow. The ROP screening guidance from the American Academy of Pediatrics emphasizes qualified image capture and interpretation and timely communication of findings.

How should images and videos be stored and transmitted?

Store screening images and recordings in the organization-approved imaging system or medical record, linked to the correct patient and encounter. Include the relevant image interpretation and clinical documentation in the record according to the program’s protocol. Avoid leaving files on camera memory cards, personal devices, removable media, or unapproved storage locations.

Use only approved secure image transmission methods for sending images to remote reviewers or other care providers. The HIPAA Security Rule requires appropriate safeguards for electronic PHI, including technical measures to protect it from unauthorized access during transmission. HHS explains that email is not categorically prohibited, but electronic PHI must be adequately protected; see HHS guidance on sending electronic PHI and its summary of the HIPAA Security Rule.

Before using an outside storage or transmission service, follow organizational vendor review and contracting procedures. A cloud service provider that creates, receives, maintains, or transmits PHI on behalf of a covered entity may be a business associate and may require a business associate agreement. See HHS guidance on HIPAA and cloud computing.

Follow the organization’s image retention schedule and applicable state law. HIPAA itself does not set a general medical-record retention period; HHS notes that state law generally governs retention periods, while safeguards must continue for as long as records are maintained. See HHS guidance on disposal and medical record retention.

What consent and privacy requirements apply?

For HIPAA-covered organizations, identifiable screening images may be PHI. HIPAA generally permits covered entities to use or disclose PHI for treatment without an individual’s authorization, but that does not override other applicable law, clinical consent requirements, or stricter organizational policy. HHS explains that providers may use or disclose PHI for treatment, payment, and health care operations under the Privacy Rule, while a covered entity may also choose to obtain consent for those purposes. See HHS guidance on treatment, payment, and health care operations.

For an infant, follow the organization’s process for obtaining permission from the parent or other legally authorized representative when the clinical procedure or local policy requires it. Explain the purpose of the imaging, how the images will be used in care, and whom to contact with questions. Do not represent HIPAA as requiring a separate authorization for every clinical photograph; the applicable requirement depends on the purpose, setting, other law, and organizational policy.

Use or disclosure for purposes outside permitted care or operations may require a valid HIPAA authorization or another applicable permission. Public release, publication, or sharing with people outside the care team should be reviewed in advance by the privacy office. HHS states that identifiable patient information generally cannot be shared with media without prior written authorization. See HHS guidance on media access to PHI.

How may images be used for clinical review or education?

Use screening images for clinical review, consultation, documentation, and follow-up in accordance with the program’s protocol. Record interpretations and communicate results through approved clinical channels so that repeat imaging, confirmatory examinations, or treatment decisions are not delayed. The AAP screening guidance recommends that captured images and interpretations be incorporated into the permanent medical record.

Educational use should be reviewed according to its audience and purpose. Supervised workforce training may fall within health care operations under HIPAA, but external presentations, publications, websites, and other public uses need separate privacy review. Use only images that are properly authorized or de-identified under an applicable method, and do not assume that removing a name or cropping an image alone makes it de-identified. HHS describes the HIPAA de-identification methods in its guidance on de-identification.

Keep educational copies within approved systems, limit access to the intended audience, and avoid unnecessary patient details. If an image remains identifiable, treat it as PHI and follow the organization’s authorization, access, storage, and disclosure requirements.

What restrictions apply to recording and sharing?

Do not make unauthorized recordings, take images with personal devices, or share images through personal email, messaging accounts, social media, or unapproved cloud services. Do not include other patients, family members, staff, screens, or documents in a recording unless the capture is authorized and necessary for the approved purpose.

Do not copy, export, alter, or disclose a clinical image except through an approved process. If an image must be transferred for clinical care, verify the recipient and patient identity, use the secure transmission method designated by the organization, and document the transfer when required by policy.

HIPAA requires safeguards for electronic PHI and restricts impermissible uses and disclosures. It does not prescribe one universal technical method for every transmission; the organization must use appropriate safeguards based on its security policies and risk management. See the HHS Security Rule summary.

What should staff do when policy requirements are unclear?

Pause any non-urgent capture, transfer, or secondary use that is not clearly permitted. Contact the program lead, privacy officer, or information security team for direction, and document the decision through the organization’s established process. Do not delay time-sensitive clinical care; use the approved escalation pathway to obtain clinical guidance and arrange a secure transfer.

If an image may have been lost, sent to the wrong person, accessed without authorization, or stored on an unapproved device, report it promptly through the organization’s privacy or security incident process. Preserve relevant information and follow instructions for containment and review.

In summary, a sound ROP imaging policy defines permitted clinical capture, assigns trained staff and role-based access, protects storage and transmission, separates care from secondary use, and provides a clear escalation route when requirements are uncertain.

FAQs

Is photography or video permitted during retinopathy of prematurity screening?

It may be permitted when it is part of the approved clinical protocol and performed using authorized equipment and workflows. Telemedicine retinal images may support preliminary screening or serve as an adjunct when implemented properly, according to the AAP guidance on ROP screening. Follow your organization’s policy for video, consent, documentation, and image handling.

Who can access screening photographs and videos?

Access should be limited to authorized staff and clinicians who need the images for their assigned duties or the infant’s care. Use the organization’s access-control rules and approved systems; do not share images with unauthorized people or accounts.

How should screening images be stored and shared?

Store images in an approved imaging system or medical record, and share them only through an approved secure transmission method with a verified recipient. Keep images protected for the applicable retention period and follow organizational policy and state law; HIPAA does not establish a general medical-record retention period.

Is consent required to record or use images for education?

HIPAA does not require a separate authorization for every use of PHI for treatment, but clinical consent rules, state law, or organizational policy may apply to image capture. Educational use depends on the audience and purpose: follow privacy review requirements and use identifiable images only when an applicable authorization or other permission allows it. Public sharing of identifiable patient information generally requires prior written authorization.