Current through all regulations passed and filed through September 16, 2024
(A)
Policy
statement
The university of Toledo "UT" permits
photographic imaging, video/audio recordings, filming, utilizing negatives or
films prepared from such photographs and/or other means of recording and
reproducing images, to be referred to as "photographs" going forward, for
purposes of teaching, staff development, medical/healthcare education,
documentation, to enhance patient care and/or publicity. There is a fundamental
responsibility to ensure that photographs are used in a reasonable manner in
order to adhere to the integrity of protected health information "PHI,"
individual rights to privacy, quality of patient care and efficient
operations.
(B)
Purpose of policy
The purpose of this policy is to ensure
the responsible use of the various types of photographs in order to ensure
employee and patient privacy and comply with health insurance portability and
accountability act "HIPAA" and other applicable laws and regulations including
the joint commission standards.
(C)
Consents
(1)
Patient consent -
identity not disclosed
UT patients in all areas/clinics sign
the patient general consent states; "I consent to the making of photographs or
other images for medical purposes and also scientific or educational purposes
as long as my identity is not disclosed. I will advise the university of Toledo
if I wish to withdraw this consent."
(2)
No consent
needed
A consent is not required when taking
photographs for the sole purpose of documentation in the patient's medical
record.
(3)
Consent - identity disclosed
Photographs that identify the person(s)
taken for the purposes of teaching, staff development, medical/healthcare
education and/or publicity purposes must always have a valid, complete, and
duly authorized consent on file - consent form "LG017."
(D)
Photographs
(1)
Medical record documents
(a)
Photographs taken for documentation in the medical
record or for medical purposes such as for surgeries or surgery segments, etc.
will be permitted, but precautions must be taken to ensure there is no risk to
the patient.
(b)
Photographs must be secured and remain in the physical
possession of the health information management, released only to those who
have authorization, used only for the purpose documented in the consent (if
applicable) and taken by a UT employee.
(2)
Teaching, staff
development, medical/healthcare education and research
(a)
Photographs
should be de-identified when used for the purposes of teaching, staff
development and medical/healthcare education and research; see 3364-90-05 of
the Administrative Code (de-identifiable and re-identifiable health
information, limited data set and data use agreements).
(b)
Photographs taken
that would identify the patient or patient's family, must have a signed consent
form "LG017" as stated in (C) (3) of this rule. Photographs that include
faculty, staff, students, or employees require a verbal consent. At no time may
these photographs be posted on a social media or copied for
publication.
(3)
Marketing
Photographs taken for the purpose of
marketing should be handled through the university of Toledo office of
communications. Proper consent will be obtained at that time from the office of
communications.
(E)
Equipment
Equipment used for taking
photographs:
(1)
A cell phone may be used as photography equipment with
the following restrictions:
(a)
There is limited risk to the patient.
(b)
Adherence to all
infection control policies and procedures is maintained.
(c)
The photograph is
downloaded as soon as possible and maintained as part of the patient's medical
record.
(d)
The photograph is sent in a secure manner to only those
involved in the care of the patient such as attending
physicians/faculty.
(e)
The photograph is deleted from the cell phone so that
it cannot be viewed by those who do not have a need to view,
and
(f)
At no time will random photography be permitted, such
as in common areas that would include patients or others not
consented.
(2)
Equipment in may be used in a sterile field such as,
but not limited to, surgeries, and surgery segments. Prior authorization must
be obtained when applicable and in compliance with section (C) of this rule.
The following restrictions apply:
(a)
There is limited risk to the patient.
(b)
Adherence to all
infection control policies and procedures is maintained.
(c)
Use of equipment
should not disrupt or create a safety concern or violate the privacy of other
employees, patients or visitors.
(F)
Electronic
media
Electronic transmission is permitted if
sent from a secured connection. The university of Toledo information technology
department should be consulted prior to electronic transmission to ensure that
secure connections are incorporated and assured. Transmission of photographic
images may be only shared with those who are involved with the patient's care,
such as but not limited to, attending physician/faculty or other clinical
personnel.
(1)
In order to protect the patient's confidentiality,
photographs sent via the internet/telemedicine must be encrypted, along with
any attached medical information, prior to sending.
(2)
Stream video may
be only transmitted from a secure server to another secure site/web page where
the viewing requires password login to view the images.
(3)
No photographs
including stream videos shall be shared by electronic media such as but not
limited to: facebook, twitter or other social networks.
(G)
Destruction, de-identified, disclosure, documentation storage and retention of
photographs
(1)
Destruction
(a)
Photographs taken for purposes of documenting in the medical record should be
downloaded and maintained by the health information management "HIM"
department. Once downloaded the image must be destroyed within a reasonable
time frame and in a manner that the photograph may not be reconstructed at a
later date. This includes all equipment that is capable of taking/producing
photographs or video. See rule 3364-90-16 of the Administrative Code (medical
record retention and destruction; disposal of protected health
information).
(b)
All other photographs taken for teaching, staff
development, and medical/healthcare education should be de-identified or a
consent should be maintained on file.
(2)
De-identified
De-identified is defined in rule
3364-90-05 of the Administrative Code (de-identifiable and re-identifiable
health information;
limited data set and data use
agreements). The policy requires that all patient data that would identify the
patient be removed from the photograph or not included in the photograph, such
as patient's face, medical record number, room number, account number or any
other identifying attribute that could identify the patient.
(3)
Disclosure
Unless otherwise required by federal or
state law, photographs will not be released to outside requestors without a
specific release from the patient or his/her legal representative.
(a)
Photographs taken
at the university of Toledo/university of Toledo medical center "UTMC" are the
property of the university and may be only obtained through proper
procedures.
(b)
If the patient wants a copy of the photographs used for
medical record documentation, the patient must complete the release of
information form in the HIM department (rule 3364-90-01 of the Administrative
Code (release of health information).
(c)
Photographs taken
for other purposes, unless otherwise prohibited by law, may be released if due
diligence is taken to ensure that any other patient's information is not
portrayed anywhere in the image or footage.
(4)
Documentation/storage/retention
Photographs taken for medical record
documentation should be clearly identifiable with the patient's name, hospital
identification number and date, and should be stored securely in the medical
record to protect confidentiality.
(H)
Kobacker
adolescent and child psychiatry
Consent is not necessary for
photographs used for identification purposes, such as passing medications in
the kobacker adolescent and child psychiatry program. The photographs are to be
destroyed upon the patient's discharge.
(I)
Research
Photographs with identifiable patient
information which may be taken as part of a research protocol must be approved
by the institutional review board "IRB."
