If patient data are de-identified according to the HIPAA Privacy Rule, the data are no longer considered protected health information by federal law. The de-identification rule includes patient photographs (if they are not identifiable by accession or medical number or other identifiers). De-identified patient data is no longer private and may be shared publicly, such as in a textbook, in a platform presentation at a national pathology meeting, and on social media.
According to Jerad M. Gardner, MD and Timothy C. Allen, MD, JD (2018), “As the specimen is clearly distinct and separate from the patient, many of the potential ethical and legal concerns related to photography of patients are not applicable to photography of pathology specimens. Regarding pathology specifically, we were unable to discover any previous legal cases in which a pathologist or other party was sued for sharing de-identified gross or microscopic pathology images in any public setting, including social media. We are also unaware of any legal case in which a pathologist was sued specifically for any type of activity involving Twitter, Facebook, or other social media.”
However, caution should be exercised when publishing medical photographs on social media. In addition to obvious identifiers, digital images and mobile devices embed so-called technical metadata into the image files. Exchangeable image file format (EXIF) data is a type of metadata pertaining to photographic images; this data is created and stored with the image when the photo is taken. Common EXIF data can include camera make, serial number, shutter speed, focal length, compression mode, and aperture settings (see figure). EXIF data may also include the specific date, time, and location data pertaining to the photograph. Timestamping of the photograph in terms of the day and time - along with location recording with Global Positioning System coordinates (i.e. “geotagging”) - can create specific patient identifiers. The method for de-identification specifically calls for time and location data removal. To accomplish this, we would recommend turning off the smartphone Global Positioning System locating feature to prevent geotagging and the use of a commercially available smartphone EXIF data removal application.
We would not recommend sharing any medical photographs on social media due to risks of privacy breaches.
