Privacy >> TUSDM Policy on Patient Image Use

TUSDM Policy on Patient Image Use

I. Purpose and Scope: 
  1. Tufts University School of Dental Medicine (TUSDM) is committed to protecting patients’ privacy in compliance with HIPAA. This policy sets the requirements for managing patient images regardless of format, and for obtaining patient authorization for acquiring, using, or releasing his or her images.
  2. This policy applies to all TUSDM Workforce Members.
II. Policy Statement: 
  1. TUSDM Workforce Members may acquire and use patient images for the purposes of, but not limited to, diagnosis, treatment, case management, payment, operations, insurance, and education within TUSDM. TUSDM will take all reasonable precautions to ensure patients’ privacy is protected, and to ensure the School’s clinical and educational missions are fulfilled.
  2. The managing of patient images includes acquiring, storing, using, distributing and, if appropriate, destroying, using the hardware, software, and other tools approved and provided by TUSDM for these actions.
  3. All patient images are the property of TUSDM and have an expiration date of 20 years from last treatment date. Any minors under the age of 18, will need to authorize patient image use again once they turn 18 years of age. 
IV. General Rules: 
  1. All patient images must be managed as specified in this and related policies and procedures, whether the image is identified/identifiable or de-identified/non-identifiable.
  2. Images used to make decisions about a patient’s care are considered part of that patient’s electronic health record, and must be included in the designated record set as defined in Appendix A: TUSDM Designated Record Set Standards.
  3. Supervising faculty must review and pre-approve the acquisition of any patient image by a TUSDM Workforce member. Faculty oversight is required acquiring any patient images in the TUSDM operating rooms.
  4. Pre-doctoral students must use TUSDM-owned cameras and to follow the TUSDM Camera Protocols as identified in the Tufts Basics Course and Appendix B: Camera Storage Protocol. No personal devices (example: cell phones) with image capabilities may be used.
  5. Faculty and post-doctoral residents may use designated devices (with image capabilities under certain restrictions.
    1. Cameras must be registered with Tufts TTS EI/O (Tufts Technology Services, Enterprise Infrastructure & Operations) in order to acquire patient images for TPO and educational purposes in accordance with this policy.
    2. Use must follow TUSDM Camera Protocols for Faculty and Resident-owned cameras (see Appendix B: Camera Storage Protocol).
  6. Identifiable images of TUSDM patients must only be used in the manner, and for the purposes, designated herein and as disclosed to, and authorized by, the patient.
  7. Patient authorization must be secured in writing:
    1. TPO and Internal Educational Purposes: TUSDM requires all patients entering TUSDM Clinics to electronically sign a General Informed Consent (GIC) in the patient's electronic health record (in axiUm). The GIC grants TUSDM permission to acquire photographs, videos, and other images to record treatment progress, payment, and for educational purposes within TUSDM.
      1. Patient Refusal to Sign GIC: Patients who refuse the acquisition of images will be directed to the supervising faculty member or the group practice coordinator/manager. Patients refusing to have images taken for the purposes listed in the GIC will be asked to seek a provider outside TUSDM.
      2. The faculty member or group practice coordinator/manager must discuss the risks, benefits, and alternatives of the patient’s decision to refuse the taking of images with the patient or his/her authorized personal representative. The patient’s electronic health record must be updated with a Clinical Case Note to reflect the patient’s decision to refuse imaging, the advisories provided, and that care was denied.
    2. TUSDM Research Studies: TUSDM requires storing a “Consent to Release Facial Images and Photographs” in the Research department as part of research study. Requests for an image release for research purposes must include appropriate Institutional Review Board (IRB) documentation.
    3. External Publications and Presentation: TUSDM requires a signed “Patient Authorization to Use and Disclose Photographs/Video” for each specific use of potentially identified/identifiable images in publications, public presentations, or board certification. The patient must consent before the images are used. All signed forms must be approved in advance by the TUSDM Security and Privacy Officer and uploaded to the patient’s electronic health record.
      1. Refusal or Withdrawal of Consent: The patient/authorized personal representative has the right to refuse signing the release for external publication. This refusal will have no impact on the provision/continuation of patient care. The patient has the right to withdraw publication consent at any time by contacting TUSDM’s Security and Privacy Officer. If publication or the presentation has already occurred, no action need be taken by TUSDM as to that use, but the image(s) may not be used for similar purpose in the future.
      2. Expiration Date: All image use authorizations must include either the expiration date OR the event at which the images will be presented.
      3. Transfer of Image Ownership: Remember that a publisher’s contract may entail the transfer of rights to image(s) to the publisher, and that those images may not be eligible for other use by the author or TUSDM.
    4. Patient-Requested Release of Images: Patients have the right to request and authorize release of images that are part of the designated record set to external parties (e.g., outside providers, lawyers, government programs). TUSDM requires a signed "Authorizing Release of My Health Information by TUSDM" form.
  8. Requests for use or disclosure of identified/identifiable images for TPO purposes do not require additional authorization; however, the Minimum Necessary Standard applies for non-treatment purposes.
  9. De-identified/non-identifiable images may be used for internal and declared external purposes without patient authorization. To be classified as a de-identified/non-identifiable images, the images must de-identified as specified in the HIPAA De-Identification Standard. De-identification must be done by approved personnel and by approved means as described in Appendix C: TUSDM Patient De-identification Standards.
  10. Only store patient images in approved repositories. TUSDM-approved image-storage repositories include:
    1. MiPacs Dental Enterprise Viewer: PACs is the acronym for a Picture Archiving and Communication system. TUSDM uses the MiPacs system to store patient images.
    2. Dolphin Imaging System.
    3. CoPath.
    4. TUSDM’s Distributed Files Services in folders linked to approved Tufts University accounts.
    5. TuftsBox folders linked to approved Tufts University accounts.
  11. Before storing an image in one of the approved repositories, it may be temporarily stored on the TUSDM-supplied camera. Every reasonable effort will be made to transfer the image as soon as practical to the approved repository. After doing so, the user must delete the image from the camera.
  12. TUSDM strictly prohibits certain activities:
    1. Do not use personal mobile devices, including cell phones, and tablets, to photograph, film, or record any patient information inclusive of images, video, or voice recording. This applies to all providers, faculty and staff.
    2. Do not use personal storage devices or unauthorized commercial cloud-based data-storage services to store patient images.
    3. No personal social media sites may be used to post patient images. Only sanctioned TUSDM social media sites with approval from faculty will be permitted.
    4. No photography on clinical floors, elevators, waiting rooms or the lobby during clinic hours as one could potentially have a patient in the background. The policy/signage is to mitigate any risk of patient images including reflections in the glass, patient in the background etc. and this applies to all students, Faculty, staff and patients.
  13. No patient images may be posted on any social media, brochures, presentations, etc. from mission trips, externships or foreign travel.
  14. TUSDM will adhere to the HIPAA Accounting of Disclosures Standard by requiring the patient’s electronic health record be updated to document which identifiable images have been disclosed to external parties without (to the extent allowable by law) or with patient authorization as specified in section G., when, to whom, and for what purpose.
  15. TUSDM requestors seeking authorization for patient image release for external educational purposes must obtain all necessary signatures on the “Patient Authorization to Disclose Photographs, Videos, and/or Images” form before using patient images in case presentations, case reviews, or other external purposes. An individual receiving the identified/identifiable images must acknowledge that safeguarding the protected health information of these images is his or her responsibility. 
V. Policy Compliance Monitoring and Enforcement: 
  1. The TUSDM Security & Privacy Officer is responsible for monitoring and enforcing this policy with the assistance of technical staff. The Patient Care & Quality Assurance Committee will monitor clinic-wide TUSDM compliance with this policy through the Quality Assurance Process.
VI. Potential Disciplinary Actions and Sanctions: 
  1. TUSDM Workforce Members who do not comply with this policy may be required to receive additional training and/or be referred to the appropriate authority for potential disciplinary action, e.g.:
    1. TUSDM students and residents via the Ethics, Professionalism, and Citizenship Committee.
    2. TUSDM staff via Human Resources.
    3. TUSDM faculty via the Compliance Committee or the Risk Management, Safety, and Infection Control Committee.
VII. Related Policies, Procedures, Forms: 
TUSDM Policy on Sanctions for HIPAA and MGL Violations
TUSDM Policy on Patient-Related Communication Using Electronic Means
VIII. Approval and Review Cycle: 
  1. This policy will be subject to annual review, revision, and approval by TUSDM Compliance Committee and, in the event of material changes, official adoption by TUSDM Executive Faculty.
Attachments: 

Appendix A: TUSDM Designated Record Set Standards

Appendix B: Camera Storage Protocol

Appendix C: TUSDM Patient De-identification Standards