Sam Ko, MD, MBA asked this pertinent question on Twitter. My answer is below. Feel free to correct me and please provide references for your opinion.Question: "Are Drs required to get Pt permission to use non-identifiable images for medical education?"
Answer: According to most journals, no.
The NEJM policy is here:
"If a photograph of an identifiable patient is used, the patient should complete and sign our Release Form for Photographs of Identifiable Patients. Any information that might identify the patient or hospital, including the date, should be removed from the image."
This is the BMJ policy:
Images – such as x rays, laparoscopic images, ultrasound images, pathology slides, or images of undistinctive parts of the body – may be used without consent so long as they are anonymised by the removal of any identifying marks and are not accompanied by text that could reveal the patient’s identity through clinical or personal detail.
Case Reports and HIPAA
Physicians must assure that the case report does not contain any of the 18 health information identifiers noted in the HIPAA regulations, unless authorization from the individual (s) has been obtained. The authorization is not required if neither of the 18 identifiers below are used in the case report.
List of 18 Identifiers:
1. Names;
2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
4. Phone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social Security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints;
17. Full face photographic images and any comparable images; and
18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)
References:
Physicians must assure that the case report does not contain any of the 18 health information identifiers noted in the HIPAA regulations, unless authorization from the individual (s) has been obtained. The authorization is not required if neither of the 18 identifiers below are used in the case report.
List of 18 Identifiers:
1. Names;
2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
4. Phone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social Security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints;
17. Full face photographic images and any comparable images; and
18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)
References:
Author Center - NEJM Images in Clinical Medicine.
Patient confidentiality. BMJ.
The Human Research Protection Program - UCSF.edu.
HIPAA Resources - The Privacy Rule - NIH.gov.
Single Case Report Policy - Johns Hopkins Medicine.
Medical Case Report Policy - Louisville.edu.
Privacy of Individually Identifiable Health Information. Code of Federal Regulations.
HIPAA Resources - The Privacy Rule - NIH.gov.
Single Case Report Policy - Johns Hopkins Medicine.
Medical Case Report Policy - Louisville.edu.
Privacy of Individually Identifiable Health Information. Code of Federal Regulations.
Image source: Bone fracture, from Wikipedia, the free encyclopedia (public domain).
Are doctors required to get patient permission to use non-identifiable investigations (X-rays, CTs, EKGs) for medical education online?
ReplyDeleteThis is a very interesting question which hopefully can bring forth a lot of valuable comments. This question also raises few other pertinent questions regarding other related clinical and pathological investigations. As a pathologist, I would like to add that there are certain key legal and regulatory issues related to saving and sending out tissues, slides, and tissue blocks. It provides an overview of legal and regulatory requirements related to (1) the retention of slides and tissue blocks; (2) the maintenance of privacy and confidentiality when sending out slides for second opinions, disease consensus meetings, state registry reporting, or research; and (3) the ownership of tissues, slides, and tissue blocks. There are laws that requires laboratories to retain slides and tissue blocks for as long as 20 years. Regulations allow indirect treatment providers, such as most pathologists, to send out slides, tissues, and tissue blocks (with identifiable health information) for payment, treatment, or health care operations purposes, and certain public health reporting purposes, without patient permission. These regulations require pathologists to obtain patient authorization or an Institutional Review Board-approved waiver of informed consent when using any identifiable patient health information for research purposes. Generally, we advocate obtaining a patient’s informed consent to use the patient’s tissues in research and other nontreatment contexts in order to avoid ownership dilemmas.
A patient is seeking a second opinion on his cancer diagnosis and requests from the hospital his entire medical record, including all prepared slides. It is not possible to prepare recuts that are comparable with the original slides. The hospital laboratory maintains that it is required to retain all original slides and thus cannot give up these slides. The patient insists that he is entitled to receive and keep all of the slides.
Although this basic scenario is one that hospitals, laboratories, and pathologists face regularly, it raises many complex regulatory and legal issues. There should be a general overview of certain legal and regulatory issues facing laboratories and pathologists when dealing with tissues, slides, and tissue blocks. Specifically, there should be a forum to focus on three key issues facing laboratories and pathologists today:
(1) Does a laboratory have to retain all of its original slides, tissues, and tissue blocks?
(2) What obligations does a laboratory or pathologist have with regard to maintaining patient confidentiality when sending out slides, tissues, or tissue blocks?
(3) Who actually owns the slides or tissue
Srikumar Chakravarthi, Pathologist, Malaysia
Very impressive doc.
ReplyDeleteAre doctors or other health care workers allowed to profit from this? Also can photos of unidentifiable body parts of patients be used for teaching purposes online, perhaps even those taken during a urological or gynecological operation?
ReplyDeleteJust a Patient
Of note however is that publishing an image that increases generalizable knowledge such as in a case report may be subject to IRB review, even if full approval is not required. It is generally preferable to ask and verify first to make sure you are following your institution's policies than to publish without knowledge of them and risk your status and privileges.
ReplyDelete