4 ms·

Pre and Post Op Surgical photos are considered part of patient's medical record. I don't know about laws in the Canada, but in the US HIPAA provides how medical

Pre and Post Op Surgical photos are considered part of patient's medical record. I don't know about laws in the Canada, but in the US HIPAA provides how medical information must be treated. Specifically the HIPAA Privacy Rule sets the standard of how Personal Health Information must be protected. Even if the images are altered to make them impossible to identify the individual, the patient still "owns" their medical record and if that patients medical information is not being used in the course of treating that patient, then informed consent must be given before it can be used for other purposes. Edit to add: It's going to be very difficult to explain why a doctor posting their patients pre/post op photos on TikTok without consent is not a violation of HIPAA Privacy Rule.

haldujai 3y ago
Deidentified data isn’t Protected Health Information. There are valid reasons other than the provision of care to access PHI for deidentification, it can also be automated at the time of collection. Healthcare operations being a nice vague one, or a limited dataset. These don’t require consent. Deidentification is technically possible but much harder to do and reidentification risks are higher (e.g. distinctive mark) so it’s strongly advised to obtain consent. I expect most TikTok doctors are getting consent, I’ve heard happy aesthetics patients tend to give consent.
- throwaway290 3y ago
  If it is an image of a part of my body I don't see how it is deidentifiable. Unless you literally redraw it. Also the article is about the problem of TT doctors who are NOT getting consent.
  - haldujai 3y ago
    > If it is an image of a part of my body I don't see how it is deidentifiable Depends how unique the part of your body looks, I agree it’s very hard (potentially impossible) so it shouldn’t be done. My point is mostly about the comment I was replying to which posited this as a hypothetical and incorrectly stated it couldn’t be used, I’m clarifying that’s not how HIPAA works.
  - prepend 3y ago
    It’s still deidentified if only you recognize it. It violates deidentification only if others recognize it and tie it to you. And it doesn’t violate HIPAA even in those situations as HIPAA allows a certain percentage of reidentification (not specified in the law, but generally accepted at 1%) before it’s a breach.
- balls187 3y ago
  We’re talking about pre and post op photos. Not data. Again to reiterate it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule.
  - haldujai 3y ago
    > Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further clarification of what "any comparable images" means we can turn to the slightly less ambiguous commentary from HHS: >Comments: Some comments noted that identifiers that accompany photographic images are often needed to interpret the image and that it would be difficult to use the image alone to identify the individual. >Response: We agree that our proposed requirement to remove all photographic images was more than necessary. Many photographs of lesions, for example, which cannot usually be used alone to identify an individual, are included in health records. In this final rule, the only absolute requirement is the removal of full-face photographs, and we depend on the 'catch-all' of 'any other unique characteristic' to pick up the unusual case where another type of photographic image might be used to identify an individual. https://aspe.hhs.gov/sites/default/files/private/aspe-files/198626/pvcfr06.txt https://aspe.hhs.gov/sites/default/files/private/aspe-files/... > it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule. I completely agree that it's very hard to deidentify photos to a degree that they can be publicly disclosed (noting that TikTok is not specifically relevant to this challenge, the same considerations apply to a training dataset as one example). However, you described a specific hypothetical (Even if the images are altered to make them impossible to identify the individual) that would by definition satisfy deidentification requirements and no longer be considered PHI per this guidance.

haldujai 3y ago

Deidentified data isn’t Protected Health Information. There are valid reasons other than the provision of care to access PHI for deidentification, it can also be automated at the time of collection. Healthcare operations being a nice vague one, or a limited dataset. These don’t require consent. Deidentification is technically possible but much harder to do and reidentification risks are higher (e.g. distinctive mark) so it’s strongly advised to obtain consent. I expect most TikTok doctors are getting consent, I’ve heard happy aesthetics patients tend to give consent.

throwaway290 3y ago
If it is an image of a part of my body I don't see how it is deidentifiable. Unless you literally redraw it. Also the article is about the problem of TT doctors who are NOT getting consent.
- haldujai 3y ago
  > If it is an image of a part of my body I don't see how it is deidentifiable Depends how unique the part of your body looks, I agree it’s very hard (potentially impossible) so it shouldn’t be done. My point is mostly about the comment I was replying to which posited this as a hypothetical and incorrectly stated it couldn’t be used, I’m clarifying that’s not how HIPAA works.
- prepend 3y ago
  It’s still deidentified if only you recognize it. It violates deidentification only if others recognize it and tie it to you. And it doesn’t violate HIPAA even in those situations as HIPAA allows a certain percentage of reidentification (not specified in the law, but generally accepted at 1%) before it’s a breach.
balls187 3y ago
We’re talking about pre and post op photos. Not data. Again to reiterate it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule.
- haldujai 3y ago
  > Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further clarification of what "any comparable images" means we can turn to the slightly less ambiguous commentary from HHS: >Comments: Some comments noted that identifiers that accompany photographic images are often needed to interpret the image and that it would be difficult to use the image alone to identify the individual. >Response: We agree that our proposed requirement to remove all photographic images was more than necessary. Many photographs of lesions, for example, which cannot usually be used alone to identify an individual, are included in health records. In this final rule, the only absolute requirement is the removal of full-face photographs, and we depend on the 'catch-all' of 'any other unique characteristic' to pick up the unusual case where another type of photographic image might be used to identify an individual. https://aspe.hhs.gov/sites/default/files/private/aspe-files/198626/pvcfr06.txt https://aspe.hhs.gov/sites/default/files/private/aspe-files/... > it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule. I completely agree that it's very hard to deidentify photos to a degree that they can be publicly disclosed (noting that TikTok is not specifically relevant to this challenge, the same considerations apply to a training dataset as one example). However, you described a specific hypothetical (Even if the images are altered to make them impossible to identify the individual) that would by definition satisfy deidentification requirements and no longer be considered PHI per this guidance.