Is It a HIPAA Violation to Take a Picture of a Patient?

Taking a picture of a patient is a HIPAA violation only when the person with the camera works for a HIPAA-covered organization and captures or shares an identifiable image without a purpose the Privacy Rule allows or a proper written authorization. A visitor, a family member, or a journalist taking a photo is not bound by HIPAA at all. A nurse taking the same photo on a personal phone very likely is. The rule turns on three things: who is holding the camera, why the photo is being taken, and whether the patient signed a valid authorization when one was required.

Who HIPAA Actually Binds

HIPAA reaches two groups: Covered Entities and their Business Associates. Covered Entities are health plans, healthcare clearinghouses, and providers like hospitals, clinics, pharmacies, and individual doctors. Business Associates are outside vendors that handle protected health information on a covered entity’s behalf, such as billing services, IT companies, or cloud storage providers.¹

If the person taking the photo doesn’t fit either category, HIPAA has nothing to say about it. A patient photographing themselves, a spouse taking a picture in the hospital room, or a reporter shooting in a public area is outside the statute. That doesn’t automatically make the photo acceptable. The facility can restrict cameras through its own visitor policies, and state privacy or trespass laws can still apply. But the federal privacy rule is not the tool that governs those situations.

Where HIPAA does apply, it covers everyone in the workforce: employees, contractors, medical staff, students, and volunteers. A medical student’s snapshot is treated the same as a physician’s.

When a Photo Counts as Protected Health Information

HIPAA protects individually identifiable health information, called PHI. A patient photograph becomes PHI whenever there is a reasonable basis to believe someone could identify the person from the image. The Privacy Rule specifically lists full-face photographs among the 18 categories of identifiers.² A close-up of a distinctive tattoo, scar, or birthmark can also qualify if it makes the patient recognizable.

Digital photos carry more identifying information than shows on screen. Smartphones embed metadata including GPS coordinates, timestamps, and device serial numbers. Under HIPAA’s Safe Harbor de-identification method, device serial numbers and “any other unique identifying number, characteristic, or code” must be removed before an image is considered de-identified.³ A photo that looks anonymous can still be PHI if the embedded data ties it back to a specific patient or location.

A photo can be stripped of PHI status if all 18 identifiers are removed, but doing that while keeping the image clinically useful is often difficult. Cropping a face out of a wound photo is easy. A facial reconstruction image loses its purpose without the face.

When a Workforce Member Can Take a Patient Photo

The Privacy Rule allows a covered entity to use and share PHI, including photographs, for treatment, payment, and healthcare operations without a separate written authorization.⁴ A facility may choose to ask for consent anyway, but the rule doesn’t require it.⁵

What that covers in real settings:

A dermatologist photographing a suspicious mole to track changes over time. That’s treatment.
An oral surgeon sending pre-operative images to a consulting specialist. Also treatment.
A hospital taking an admission photo for patient identification. That’s a healthcare operation.

Medical education is a grayer zone. Many organizations treat training as a healthcare operation, but institutional policies typically require written consent before photographing patients for teaching, whether the audience is a room of residents or a conference. Best practice calls for de-identifying educational images as much as possible: cropping faces, redacting names and record numbers, and covering eyes and noses when the full face can’t be removed. If a photo originally taken for treatment later proves useful for teaching, consent should be obtained before it’s repurposed.

When Taking a Picture Becomes a Violation

A violation happens when someone in a covered entity’s workforce photographs a patient for a purpose the Privacy Rule doesn’t allow, and without valid written authorization. The clearest examples:

A nurse photographs a patient’s unusual condition and posts it to a personal social media account.
A staff member texts a patient photo to a friend or coworker for gossip.
A worker saves an identifiable patient image on a personal device as a curiosity.

None of these serve treatment, payment, or operations, so none qualify for the permission the Privacy Rule grants.

Less obvious violations happen through method rather than motive. Emailing a legitimate clinical photo to a colleague through an unsecured personal email account can breach the Security Rule even when the clinical purpose is valid. Taking a treatment photo on a personal smartphone instead of a facility-approved device often violates institutional policy and undermines the security requirements HIPAA imposes on stored electronic PHI. The reason for the photo matters. So does how it’s captured and where it lives.

When the Patient Has to Sign Off

Any use of a patient photograph outside treatment, payment, or healthcare operations requires a signed written authorization. The most common example is marketing: before-and-after photos on a practice website, in a brochure, or on social media. A general treatment consent form does not cover these uses.⁶

Federal regulations spell out what a valid authorization must contain:⁷

A specific description of the photograph or images covered.
The purpose the photo will be used for.
The people or classes of people authorized to share the image and those who will receive it.
An expiration date or event.
The patient’s signature and date, or a personal representative’s signature with a description of their authority.
A statement that the patient can withdraw the authorization in writing at any time.
Notice about whether the facility can refuse treatment if the patient declines to sign.
A warning that information shared under the authorization may no longer be protected by HIPAA once it reaches the recipient.

A vague form that says something like “I agree to the use of my photographs” without naming the purpose, the recipients, and an expiration doesn’t meet these requirements.

A patient can revoke the authorization at any time by giving the covered entity written notice. The revocation takes effect when the organization receives it, not when the patient sends it. The facility doesn’t have to undo actions already taken while the authorization was valid. If a clinic posted a testimonial photo last month and the patient revokes today, the image must come down going forward, but the clinic isn’t liable for the period the authorization covered.⁸

What a Violation Costs

When a covered entity improperly takes or shares a patient photo, the HHS Office for Civil Rights can impose civil monetary penalties. The tiers reflect how culpable the organization was, and the dollar amounts are adjusted for inflation each year. The current figures are:⁹

No knowledge of the violation: $145 to $73,011 per violation, with an annual cap of $2,190,294.
Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, same annual cap.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
Willful neglect, not corrected: $73,011 to $2,190,294 per violation, same annual cap.

Each improperly shared photograph counts as its own violation, so a single incident touching multiple patients can stack quickly. An employee who photographs five patients and posts the images could expose the organization to five separate per-violation penalties.

The Department of Justice can also bring criminal charges against any individual who knowingly obtains or discloses identifiable health information in violation of HIPAA:¹⁰

General violation: up to $50,000 in fines, up to one year in prison, or both.
Under false pretenses: up to $100,000 in fines, up to five years in prison, or both.
Intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm: up to $250,000 in fines, up to ten years in prison, or both.

A healthcare worker who sells a patient image or uses it to harass someone faces the top tier. Accessing a celebrity patient’s record out of curiosity and sharing a photo with friends could support charges under the general tier. On top of the federal penalties, the individual usually faces termination and sanctions from a state licensing board, up to loss of a medical or nursing license.

If an unauthorized photograph qualifies as a breach of unsecured PHI, the covered entity must notify each affected patient in writing within 60 calendar days of discovering the breach.¹¹ That obligation runs to the organization, not the individual employee, but it means a patient whose image was misused has a right to be told.¹²

What a Patient Can Actually Do

HIPAA does not create a private right of action. You cannot sue a hospital or an employee in court under HIPAA itself. Enforcement runs through the federal government: the HHS Office for Civil Rights for civil penalties, the Department of Justice for criminal cases.

That leaves state law as the route for a personal lawsuit. Most states recognize privacy torts like intrusion upon seclusion and public disclosure of private facts, both of which can fit an unauthorized patient photo. Depending on your state, negligence, breach of confidentiality, or state medical privacy statutes may also apply, and some states provide statutory damages. If your image was taken or shared without your permission, it’s worth talking to a lawyer about state-level claims alongside a federal complaint.

How to File an OCR Complaint

If a healthcare provider or one of its workers photographed you improperly, you can file a complaint with the HHS Office for Civil Rights. It must be filed within 180 days of when the violation occurred, though OCR may extend that for good cause.¹³ The complaint has to name the covered entity or business associate and describe what happened.

You have three ways to file:

Online through the OCR Complaint Portal on the HHS website. Fill out the form, sign it electronically, and print a copy.
By mail or email using the HIPAA Privacy and Security Complaint Form Package, available in PDF from HHS. Send it to the Office for Civil Rights in Washington, D.C., or email OCRComplaint@hhs.gov.
Through your own written letter that includes your contact information, the organization’s name and address, a description of the violation, and your signature.

OCR won’t investigate anonymous complaints, so your name and contact information have to be included.¹³ HIPAA also bars covered entities from retaliating against anyone who files, so you cannot legally be refused care or otherwise punished for reporting.¹⁴

1
HHS.gov. Covered Entities and Business Associates
2
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
3
HHS.gov. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule
4
U.S. Department of Health & Human Services. Uses and Disclosures for Treatment, Payment, and Health Care Operations
5
HHS.gov. Treatment, Payment, and Health Care Operations Disclosures
6
HHS.gov. Authorizations
7
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
8
HHS.gov. Can an Individual Revoke His or Her Authorization
9
Health and Human Services Department. Annual Civil Monetary Penalties Inflation Adjustment
10
Office of the Law Revision Counsel. 42 US Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
11
eCFR. 45 CFR 164.404 – Notification to Individuals
12
HHS.gov. Breach Notification Rule
13
HHS.gov. How to File a Health Information Privacy or Security Complaint
14
eCFR. 45 CFR 164.530 – Administrative Requirements