10

I moved this post off the medical stack exchange as it was flagged as off topic so hopefully this is the proper place for it.

I have a problem with a thumbnail that has been lingering for months now and I finally decided to make an appointment with a dermatologist. I called, made the appointment, filled out the paperwork, etc. I showed up for the appointment and all was normal, scanned my drivers license, took my co-pay and confirmed my medical history. They called my name and took me back to the room and the assistant asked to take a front and side picture of my face. I noticed a screen on the wall showing before/after shots of patients facial problems so I told the assistant that I was there for my thumb not any facial issues and she said it was for their records. I said I didn't mind if she took a picture of my thumb but that I didn't see any reason to take pictures of my face. Her tone immediately changed and she quickly finished the interview and left the room. A few minutes later a women walked in and introduced herself as the office manager and explained to me that it was their policy to take pictures of patients for "security reasons" and that I would be refused service if I did not comply. I politely told her I understand she has to follow her policies and asked for a refund of my co-pay which she provided then I left the office. Can a doctor legally do this? Is this a violation of HIPAA? If so where would I file a complaint?

Improve this question

2 Answers 2

Reset to default
7

The "Privacy Rule" (45 CFR Part 160 and Part 164, Subparts A, E) don't forbid this. Sect. 164.502 states the general rule:

(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

"Health information" is defnes in part 160 as

any information, including genetic information, whether oral or recorded in any form or medium, that:

(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Your picture would not constitute health information (and anyhow, they are allowed to gather health information, just not freely disseminate it – the pictures on the wall were presumably with permission).

There is no general law (which would be state law) against taking a person's picture (though commercially exploiting someone's picture would require permission, via the concept of personality rights), and it is directly required in a number of instances (for identification purposes – school ID, driver's license, passport, voting in some states). It is an unusual requirement and since they scanned your driver's license it is especially inexplicable. Assuming that this is just a story they tell all patients because they want before and after pictures (which you would have to consent to, if you didn't already in one of those "sign here" flurries), saying that this is for "security purposes" would be untrue, but I don't think it's actually illegal. Taking but not using a photo would not cause you harm, so if you had let them take the picture, there would not be a basis for suing. If they use it for advertising without permission, that would be a problem.

Improve this answer
5
  • Can a private doctor eject a patient at any time from the office for any reason? I was really surprised this happened after they had already taken my money and put me in a room. I will see if I can get a copy of the policy in question and if I agreed to allow pictures.
    – Neelix
    Jun 13, 2017 at 1:47
  • 1
    Yes, they pretty much can. Obviously you don't owe them money if they don't provide the service.
    – user6726
    Jun 13, 2017 at 4:48
  • 2
    I'd have thought that taking money constituted acceptance of a contract to provide a medical service, so in theory the OP could claim any additional costs (e.g. suffering due to delay, wasted time, transport) due to their failure to fulfill the original contract.
    – Paul Johnson
    Jun 16, 2017 at 17:49
  • 1
    No, that ritual is really about you and your insurance company, that your insurance company requires them to do a thing so that you can get serviced at a special rate etc. What the insurance requires is, collect a co-payment from you.
    – user6726
    Jun 17, 2017 at 0:24
  • Doesn't taking your money create a contract?
    – Paul Johnson
    May 8, 2022 at 19:29
5

I once was able to speak directly with an HHS attorney. She stated that HHS would consider any information that connected patients to a specific doctor would be considered to be PHI. IOW, if others could reasonably infer that you were getting treatment from that doctor, then yes, that would be a breach of PHI. In addition, the doctor would also be in violation of HIPAA for not self-reporting the breach.

Regarding being 'ejected' - the question is - is a doctor required to treat all persons who request treatment? The answer is no. Doctors can decide to not take pretty much anyone, even for arbitrary reasons.

Improve this answer
3
  • 3
    If the information (photo) is not disseminated, there is no breach. Gathering PHI is not itself a breach.
    – user6726
    Oct 8, 2017 at 4:55
  • 1
    when other patients see your photo, that is a disclosure of PHI. when the disclosure is made without consent, that is a breach
    – Bruce Borkosky
    Oct 9, 2017 at 6:42
  • 6
    We have no evidence that the posted photos were without permission.
    – user6726
    Oct 9, 2017 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .