> Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further cl

> Not data Photos are a type of data and are equivalent under HIPAA which only considers "Full-face photographs and any comparable images" PHI. For further clarification of what "any comparable images" means we can turn to the slightly less ambiguous commentary from HHS: >Comments: Some comments noted that identifiers that accompany photographic images are often needed to interpret the image and that it would be difficult to use the image alone to identify the individual. >Response: We agree that our proposed requirement to remove all photographic images was more than necessary. Many photographs of lesions, for example, which cannot usually be used alone to identify an individual, are included in health records. In this final rule, the only absolute requirement is the removal of full-face photographs, and we depend on the 'catch-all' of 'any other unique characteristic' to pick up the unusual case where another type of photographic image might be used to identify an individual. https://aspe.hhs.gov/sites/default/files/private/aspe-files/198626/pvcfr06.txt https://aspe.hhs.gov/sites/default/files/private/aspe-files/... > it’s going to be very hard to argue tiktok posts fall under an exception for the privacy rule. I completely agree that it's very hard to deidentify photos to a degree that they can be publicly disclosed (noting that TikTok is not specifically relevant to this challenge, the same considerations apply to a training dataset as one example). However, you described a specific hypothetical (Even if the images are altered to make them impossible to identify the individual) that would by definition satisfy deidentification requirements and no longer be considered PHI per this guidance.