Receiving and storing patient images

The increased use of remote consultations during the Covid-19 pandemic has caused a lot of queries about the receipt and storage of images sent by patients. Dr Rachel Birch, Medico-legal Consultant at Medical Protection, reviews the relevant guidance

The medico-legal implications of obtaining and storing images of patients, including children, are increasingly coming under the spotlight for many doctors because of the now-commonplace use of remote consultations during the pandemic. The relevant Medical Council guidance in such situations is covered under Chapter 4 of the Guide to Professional Conduct and Ethics for Registered Medical Practitioners.

Paragraph 34 provides guidance on recording and, whilst it is written in a way that is aimed at a clinician making an image or recording of the patient, in the current situation it would still apply in a remote consultation where the patient has made the image, and particularly if they have done so at the request of the clinician

34.1 Audio, visual or photographic recordings of a patient, or a relative of a patient, in which that person is identifiable should only be made with their express consent. You should keep these recordings confidential as part of the patient’s record. You should be aware of security when sharing information by electronic means, including text, other electronic messaging or emailing, and you should do all you reasonably can to protect confidentiality. You should get consent before sharing videos, photos or other images of patients.

34.2 In exceptional circumstances, you may take images of patients using your personal mobile device. You should do so only when this is necessary for the patient’s care. The images must not identify the patient, must be kept for the minimum time needed, and must be deleted as soon as possible. You are responsible for data protection in this regard and you must comply with any rules and procedures of your employer.

Paragraph 33 addresses medical records and, in particular, paragraphs 33.1, 33.2 and 33.4 are relevant here:

33.1 Medical records consist of relevant information learned from or about patients. They include visual and audio recordings and information provided by third parties, such as relatives.

33.2 You must keep accurate and up-to-date patient records either on paper or in electronic form. Records must be legible and clear and include the author, date and, where appropriate, the time of the entry, using the 24-hour clock.

33.4 You must comply with data protection and other legislation relating to storage, disposal and access to records. You should understand the eight rules of data protection.

Consent and images of children

If you have asked for the parent or guardian to send a particular photograph, for example of a rash on the child’s arm or of their swollen ankle, then it would be important to remember that this image forms part of the consultation and should be stored within the patient’s medical records. It would be advisable to record the consenting discussion that you have had with the parent in the clinical record. It would also be prudent to make a note of the clinical relevance and purpose of the images to justify their use and storage.

The Medical Council advises, in Section 18 of their ethical guidance, that children and young people should be involved as much as possible in decisions about their healthcare and their views should be listened to. The age of consent for medical treatment is 16 years. However, young people may have the capacity at an earlier age than 16 to be involved in a decision to share a photograph of them, and, if so, they should be encouraged to be involved in that decision.

If you have asked for the parent or guardian to send a particular photograph, for example of a rash on the child’s arm or of their swollen ankle, then it would be important to remember that this image forms part of the consultation and should be stored within the patient’s medical record

Where a parent or guardian has sent a photograph unsolicited, it might seem as though they have given implied consent. However, if this would not be an image taken in the course of a normal face-to-face consultation, or if the image is of an intimate area, you should confirm with the parent or guardian that they consent to you viewing and potentially storing the image, or even sharing the image (for example, if you required a second opinion).

The Medical Council, in its ethical guidance, reminds doctors of their obligation to protect children:

26.1 You must be aware of and comply with the national guidelines and legislation for the protection of children, which state that the welfare of the child is of paramount importance.

26.2 If you believe or have reasonable grounds for suspecting that a child is being harmed, has been harmed, or is at risk of harm through sexual, physical, emotional abuse or neglect, you must report this to the appropriate authorities and/or the relevant agency without delay. You should inform the child’s parents or guardians of your intention to report your concerns taking into account that this may endanger you or the patient. Giving relevant information to appropriate authorities or statutory body for the protection of a child is a justifiable breach of confidentiality, provided that you follow the guidance in paragraph 31.3.

Under the Children First Act 2015, doctors are “mandated persons” who are legally obliged to report their concerns, as soon as practicable, to Tusla if they believe that a child has been harmed, is being harmed, or is at risk of being harmed. If, on review of a photograph, you are concerned that a child may be at risk of harm, it is important that you take the appropriate steps to protect that child. Doctors may wish to contact Tusla and their medical defence organisations for advice in such a circumstance.

Storage and recording consultations

It would be advisable to approach your IT provider as they would be able to advise whether it would be possible to store any video consultations and photographs, and if so, how. Medical Protection is unable to provide specific advice on IT systems; however, it is important that you consider Data Protection Commission guidance on data security matters. In any remote consultation, it is important to take careful and detailed notes, as in a face-to-face consultation, ensuring that it is clear within the records that this is a remote consultation.

You might also wish to discuss with the patient how and where the consultation would be stored at the start of the consultation, being mindful that a copy of this consultation could be requested by the patient. You should ensure any personal and sensitive patient data is stored and recorded in accordance with the General Data Protection Regulation.

Conclusion

If it is clinically appropriate to store an image of a patient, whether adult or child, then a practice or hospital is unlikely to be criticised. The Medical Council is clear that audio and visual recordings should form part of the medical record. However, practices and hospitals may want to consider whether their IT system would allow for particularly sensitive images to be flagged as such, signalling extra caution needed when disclosing the medical record.

We strongly recommend discussing the matter further with colleagues, in order to agree on and develop a policy that creates a consistent approach. As with any new policy, all staff members should be trained on this and it should be reviewed at regular intervals and updated as necessary. It is important also to be aware that guidance available to clinicians during the pandemic is constantly evolving and you should stay updated on Medical Council and ICGP guidance.