Total Body Photography Vendor Email and PHI Policy Guide

When Do Total Body Photographs Contain PHI?

A total body photograph may be protected health information (PHI) when it identifies a person and is created, received, maintained, or transmitted by a HIPAA-covered entity or business associate in connection with health care. A photograph that is not identifiable or is not connected to an individual’s health information may not be PHI under HIPAA, but context matters.

Removing a person’s face does not automatically make a clinical image de-identified. Tattoos, distinctive marks, background details, filenames, metadata, or a link to a patient record may still identify the person. Under HIPAA’s Safe Harbor method, full-face photographs and comparable images are identifiers that must be removed, along with the other specified identifiers; the covered entity must also lack actual knowledge that the remaining information could identify the person. See HHS guidance on de-identification.

When a vendor handles identifiable clinical images for a health care organization, treat them as PHI unless the organization has determined that the images have been de-identified under a HIPAA-recognized method.

What Should a Vendor Business Associate Agreement Cover?

A photography vendor may be a business associate when it performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. The relationship and the vendor’s role matter: a photographer is not automatically a business associate in every engagement, and HIPAA provides an exception for disclosures to a health care provider for treatment. See HHS business associate guidance.

When a business associate agreement (BAA) is required, it should clearly define the vendor’s permitted and required uses and disclosures of PHI, require appropriate safeguards, and prohibit use or disclosure beyond the agreement or what the law requires. It should also address incident and breach reporting, subcontractors, assistance with individual rights requests where applicable, and return or destruction of PHI when the agreement ends if feasible. See HHS sample business associate agreement provisions.

Specify the services covered, which staff may access images, approved transfer and storage methods, retention and deletion procedures, and whether any secondary use is allowed. Do not assume a vendor’s general privacy policy replaces the written BAA when HIPAA requires one.

How Should Staff Secure PHI in Email?

HIPAA does not expressly prohibit sending electronic protected health information (ePHI) by email. The Security Rule requires safeguards for access, integrity, and transmission, and calls for an assessment of the risks involved in using open networks. HHS explains that encryption is an addressable implementation specification: the organization must assess whether it is reasonable and appropriate and, if it is not, document that decision and implement an appropriate alternative when available. See HHS email and ePHI guidance and HHS guidance on encryption.

Use the organization’s approved email encryption or secure messaging system when sending images. Where appropriate, a secure portal or encrypted link with restricted access can reduce the risk of an exposed attachment. Avoid personal email accounts, unnecessary identifying details in subject lines, and unapproved cloud storage. Encryption helps protect a message in transit, but it does not prevent disclosure to the wrong recipient or make an unauthorized use permissible.

Apply written protected health information safeguards to the full workflow, including downloading, viewing, forwarding, and deleting images. The organization’s risk assessment and policies should determine which tools and controls are appropriate for its systems and circumstances.

How Can Staff Verify Recipients Before Sending Images?

Before sending a clinical image, confirm that the recipient is authorized to receive it and that the disclosure is permitted for the stated purpose. Check the email address character by character, rather than relying only on autocomplete, and confirm the recipient’s identity and role when needed. HHS identifies checking an email address for accuracy as a reasonable safeguard against an unintended disclosure. See HHS guidance on email communications.

Confirm that the correct image and attachment are selected, and that the destination account or secure link belongs to the intended recipient. Use access restrictions and an expiration date for shared links when available. If you discover an incorrect address or attachment after sending, notify the organization’s privacy or security contact promptly and follow its incident-response procedures.

When Is Patient Authorization Required for Disclosure?

A separate HIPAA authorization is generally not needed for uses and disclosures the Privacy Rule permits, including many uses for treatment, payment, and health care operations. However, permission to use a photograph for clinical care does not automatically allow a vendor or provider to publish it, use it in a portfolio, post it on social media, or disclose it for another unrelated purpose.

HIPAA generally requires a valid written HIPAA authorization for uses or disclosures not otherwise permitted by the Privacy Rule, including marketing uses and disclosures, subject to limited exceptions. The authorization must describe the information and purpose, identify who may use or disclose it and who may receive it, and include an expiration date or event and the individual’s signature, along with other required statements. See HHS guidance distinguishing consent from authorization and HHS marketing guidance.

A general consent form or a statement in a privacy notice does not substitute for an authorization when HIPAA requires one. Organizations should have privacy staff review the proposed use, the image, and any authorization before external release.

How Should Clinical Photographs Be Stored and Added to Medical Records?

Capture and transfer images through organization-approved systems. Avoid leaving identifiable images in a personal phone’s camera roll, consumer photo library, or unmanaged messaging account. If a temporary device or storage location is authorized, use the safeguards specified by the organization and transfer the image to its approved system as soon as practicable.

When a photograph is used to make decisions about a patient or is part of the clinical record, the organization should manage it with that record and apply appropriate access and retention procedures. HHS explains that a designated record set can include information used, in whole or in part, to make decisions about individuals, and that the right of access can include images in the record. See HHS guidance on designated record sets.

HIPAA does not establish a general medical-record retention period; state law and other applicable requirements may govern how long records must be kept. While PHI is maintained, it must be protected, and electronic PHI must be disposed of securely when appropriate. See HHS guidance on medical-record retention and HHS guidance on secure disposal.

What Limits Apply to Vendor Access and Use of Patient Images?

Give vendor personnel access only when it is needed to perform the contracted service, and remove access when it is no longer required. HIPAA’s Security Rule requires access controls for ePHI; unique user accounts, role-based permissions, and activity logs can help an organization manage and review access. See HHS audit protocol for Security Rule controls.

The minimum necessary standard generally requires reasonable limits on PHI used or disclosed for a particular purpose, but it does not apply to disclosures to or requests by a health care provider for treatment. For vendor work, define the scope of access in the BAA and limit image access to what is appropriate for the vendor’s assigned function. See HHS minimum necessary guidance.

A vendor should not reuse patient images for advertising, public portfolios, training, or other independent purposes unless that use is permitted and any required authorization has been obtained. BAAs should also set clear limits on subcontractor access and require appropriate protections for any PHI handled downstream.

In practice, a reliable policy pairs a properly scoped vendor agreement with secure email and storage, verified recipients, appropriate patient authorization, and role-based access to images.

FAQs

Do total body photographs count as protected health information?

They can. A total body photograph is PHI when it identifies a person and is connected with health information handled by a covered entity or business associate. Removing the face alone may not be enough to de-identify an image; distinctive marks, context, metadata, or links to patient records may still identify the person. See HHS de-identification guidance.

When does a photography vendor need a business associate agreement?

A BAA is generally required when the vendor performs a service on behalf of a covered entity and handles PHI as part of that service, unless an exception applies. Whether it is required depends on the vendor’s actual role and relationship with the organization. See HHS business associate guidance.

Should emails containing patient photographs be encrypted?

Use encryption when the organization’s risk assessment determines it is reasonable and appropriate, and follow the organization’s documented safeguards and approved tools. HIPAA treats encryption as an addressable Security Rule specification rather than a blanket requirement for every email, but ePHI sent by email must still be adequately protected. See HHS guidance on encryption.

When is written patient authorization required before sharing identifiable images?

Written authorization is generally required when sharing an identifiable image for a purpose the Privacy Rule does not otherwise permit, such as many marketing or public-facing uses. It is not generally required for a disclosure permitted for treatment, payment, or health care operations. The organization should confirm that any authorization specifically covers the image, recipient, and intended purpose. See HHS guidance on consent and authorization.