Responsible Office: Institutional Compliance Office	Last Review: 07/17/2024 Next Review: 07/17/2027
Contact: Melanie Burlison, Privacy Officer	Phone: 901.448.8030 Email: institutional.compliance@uthsc.edu
Related Policies: FI0160 – HIPAA Re-designation and General Policy

Purpose

In general, written consent shall be obtained to use a patient’s information and likeness or image (Image) if a patient’s identity can be determined or patient information is not de-identified. Exceptions to obtaining consent are as set forth in this procedure.

This procedure applies to all UTHSC clinics, educational activities or areas owned, operated and/or provided by UTHSC. It does not apply to uses of information or Images for treatment or payment purposes (as defined under HIPAA), or to inmates seen or treated by UTHSC providers.

Scope

UTHSC utilizes a variety of media to collect protected health information on patients and will hold all such information to the same standard of confidentiality and security as required for all protected health information according to UTHSC procedures.

Definitions

• Photography – for the purposes of this procedure “photography” will be used to indicate a recording of a patient’s likeness by a number of visual means, including still photography, videotaping, digital imaging, scans, and others.
• Consent – a written document signed by a patient (or authorized legal representative) agreeing to allow the patient’s information, or Images to be taken and/or used. The document shall be maintained in the patient’s medical and/or research record.
• De-identified – removal of all those identifiers listed in HIPAA regulation 45 CFR 164.514(b)(2), and not assigning a code or other means of record identification that could allow for re – identification of the patient.
• Images – means likeness or Image including, but not limited to, photographs, videotaped images, audio recordings, digital or other images of any kind or nature.

Procedure

Consent Process

Types Of Consent Documents

1. “Consent and Release to Use Images: As required under this Policy, before taking Images of a patient, written Consent shall be obtained from the patient (or authorized legal representative).
   This Consent only allows UTHSC to take and/or use patient information or Images for the purposes approved on the Consent form.
   
2. “HIPAA Authorization for Release of Patient Information.” This form is required for uses or disclosures of information or Images that require an authorization by law.
   
3. “Consent to Treatment/Health Care Agreement.” This is the standard consent for treatment, release of information and financial responsibility.

Obtaining Consent

A health care provider, or appropriately delegated person, is responsible to explain to the patient (or authorized legal representative) why a consent document and/or HIPAA Authorization is required by describing:

• the purpose of taking Images or information, and
• proposed use(s) of the information or Images (examples are for commercial, marketing, educational, or promotional purposes).

Activities Where Consent Required

Information or Images are obtained for various purposes, and the intended use will determine which forms are required.

1. Treatment and Payment. All information or Images used solely for treatment or payment purposes are part of the patient’s medical record and are identified using the medical record number, patient’s name, date of birth, and the date the information or Images were obtained. Use or disclosure for treatment or payment is subject to the same laws and policies governing release or disclosure of patient protected health information (PHI).
2. UTHSC Internal Educational Purposes. If the patient can be identified through the information or Images, for internal educational purposes (without the presence of the public or non-UTHSC physicians), obtaining written consent from the patient is required.
3. External Educational Purposes. To use patient information or Images at an educational activity outside of and not affiliated with UTHSC, written consent from the patient is required.

No Consent is required for educational purposes (external or internal) if a patient cannot be identified from the information or Images

**For example, a photograph of the oral cavity without unique identifiers would not require Consent. However, a photograph of an abdomen with a tattoo would require Consent.

4. Marketing/Fundraising/Publicity/Media. If a patient will be identifiable, before taking or using the patient’s information or Images for marketing, fundraising or other publicity materials or purposes, prior Written authorization must be obtained from the patient.

Family And Friends

Written Consent is not required for a patient’s family and friends to take Images of a patient who is receiving treatment at UTHSC. However, this is allowed only with the agreement of the Provider and patient, and with the acknowledgement that the individual may be asked to discontinue recording/photographing if the Provider deems it necessary. UTHSC staff must ensure that the images will in no way include other patients or staff who have not consented to be included in the images.

Equipment Used To Obtain Information Or Images

Only equipment owned, leased, or controlled by UTHSC shall be used to obtain information and/or Images pursuant to this procedure. UTHSC workforce members, including Business Associates, shall not use personal recording devices including, but not limited to, cell phones, cameras, flash drives, video recorders, etc. to take or store information and/or Images for or on behalf of UTHSC.

Release

Information and/or Images shall not be released to the patient or other individuals without a signed HIPAA Authorization from the patient, except when required by law or when the information and/or Images are de-identified. The patient is entitled to request copies of information and/or Images as allowed by law. A reasonable fee may be charged to cover the cost of copying.

Revocation

As with all patient authorizations for disclosure of protected health information, the patient has the right to revoke the consent for photographing, videotaping, or making other images, at any time. UTHSC will not be liable for any use of such images prior to the revocation.