Are patient photos PHI?

Yes. A patient photo is called protected health information (PHI) under HIPAA when it can identify the patient and is held by your clinic or a company working for your clinic.

This includes more than just photos of a patient’s face. A close-up photo of a scar, a photo a patient sends to your clinic after surgery, or a before-and-after photo printed on paper and kept in a patient’s file can all be PHI.

This guide explains how to check whether a patient photo is PHI, common mistakes clinics make, and how the UK, UAE, Australia and Saudi Arabia protect the same type of photo.

HIPAA defines PHI in 45 CFR 160.103. Strip away the legal wording, and a photo is PHI when 3 things are true at once:

Under HIPAA, a covered entity (a health insurance company, a company that helps process health insurance claims, or a doctor or clinic that meets HIPAA’s rules) includes a health plan, a health care clearinghouse (a company that helps process health information for insurance claims), or a health care provider (doctors, nurses, surgeons, hospitals and clinics that provide medical care) that sends health information electronically for certain standard transactions (approved ways of sending health information, such as insurance claims). A business associate (a company that handles patient information for a clinic) is a company that handles PHI for a covered entity. For example, a company that stores patient photos for a clinic may be a business associate.

The photo must have been created or received by a doctor, nurse, clinic or another health care provider, and it must relate to the patient’s health, medical care or payment for that care.
For example, a photo of a patient’s wound after surgery contains information about their health

The photo shows who the patient is, or there is a reasonable reason to believe someone could identify them.
Most photos taken in plastic surgery, dermatology and wound care clinics meet all three conditions.
It does not matter whether the photo is saved on a computer, stored on a phone or printed on paper. HIPAA covers information in different forms, so a printed photo kept in a patient’s medical file can also be PHI.

No. Faces are the clearest case. HIPAA’s de-identification rule lists “full face photographic images and any comparable images” as an identifier (45 CFR 164.514(b)(2)(i)(Q)).

But the test is whether the photo can identify the person, not whether you can see a face. A body photo can identify someone through:

• a tattoo, birthmark or distinctive scar
• jewelry, a wristband or a room number in the frame
• the file name, such as “Smith_J_abdominoplasty_wk6.jpg”
• metadata stored inside the file, such as the date, time and location
• the patient record it is filed under

This is an easy point to miss. A close-up of a skin problem may not show anything that identifies the patient. But if the photo is saved in that patient’s medical record, it is linked to their identity and can still be PHI. 

Be careful with cash-only clinics. Whether a medical spa must follow HIPAA depends on how it handles billing and whether it meets the rules for a covered entity.Do not assume that HIPAA does not apply just because your clinic accepts cash. Check with the person responsible for following privacy rules at your clinic.

A photo can become PHI when your clinic receives it. While it is only on the patient’s personal phone, HIPAA generally does not apply to the patient as the holder of that photo, because the patient is not a covered entity(a health insurance company, or a doctor or clinic that meets HIPAA’s rules). 

Once your clinic receives the photo by email, text message or upload, it has received health information from the patient. If the photo can identify the patient, it can be PHI. Your team must protect every copy it holds, just as it protects photos taken by clinic staff. 

This also includes copies saved in a staff member’s personal text messages or email. If patients send photos to a staff member’s personal phone number, that phone may now contain PHI. Read our guide, “Is a phone gallery HIPAA compliant?”, to learn how to handle photos stored on phones.

Yes. You can remove a photo from PHI status by properly de-identifying it. Simply cropping the photo is usually not enough. HIPAA provides two methods for de-identification (45 CFR 164.514(b)). 

• Safe Harbor. Remove all 18 listed identifiers, including full-face images and any unique characteristic. You must also be sure that the remaining information does not identify the patient. For example, removing the face is not enough if a visible tattoo can still identify the patient.
• Expert determination. A qualified expert uses accepted scientific or statistical methods (ways of studying information and measuring risk) to check whether someone could identify the patient from the remaining information.
• The expert must write down and keep a record, why the risk of identifying the patient is very small.

Why this matters in aesthetic clinics: Imagine that a surgeon recognises a patient’s torso in a photo, even after the face has been removed. Safe Harbor method has not been met if your surgeon knows whose torso is in a photo.

Before you treat any photo as de-identified, work through this list:

• Crop out the face, and any tattoo, birthmark or unusual scar.
• Remove jewelry, wristbands and backgrounds you’d recognize.
• Rename the file so it holds no name, date or record number.
• Remove the metadata(information saved inside the photo file ), such as date and location.
• Store the photo separately from the patient’s medical record.

These steps help you check for identifying information, but completing this list does not automatically mean the photo meets HIPAA’s de-identification rules.

If you’re unsure, keep treating the photo as PHI. It costs little and protects you.

A limited data set (health information with certain identifying details removed) is different from fully de-identified information. Under specific HIPAA rules, it can be used for research, public health and health care operations (activities that help a health care organisation run its services).

A limited data set must not include full-face photos or similar images (45 CFR 164.514(e)(2)(xvi)).

If you are unsure whether a photo has been properly de-identified, continue to protect it as PHI. This helps protect the patient’s privacy.

Sharing an identifiable patient’s photo for marketing without the required written permission can break HIPAA rules in the US. This includes photos posted on a clinic’s website, Instagram or patient success stories.

You can be fined. In the US, HIPAA says you need the patient’s written permission before you use their photo for marketing. This includes your website and social media. If you post it without permission, the US health department (HHS) can fine your clinic.

The fine depends on how much your clinic knew and whether it fixed the problem. These levels are set in 45 CFR 160.404. In 2026, the fine for each violation can be from $145 up to $73,011. If the clinic ignored the rule on purpose and did not fix the problem in time, the fine for each violation starts at $73,011. The most HHS can charge for the same violation in one year is $2,190,294. These amounts go up every year. HHS published the 2026 amounts on January 28, 2026.

In practice, HHS has said it will use lower yearly limits. These are $25,000, $100,000, $250,000 and $1,500,000, depending on how serious the case is.

In a few cases, the law also allows jail time. Knowingly sharing a patient’s health information without permission can mean up to 1 year in jail. If it is done to make money, it can mean up to 10 years.

Real cases show this can happen. In 2016, a physical therapy clinic paid $25,000 for putting patient stories with names and face photos on its website without permission. In 2025, a care company paid $182,000 after it posted a patient’s photo and medical details on social media.

The fix is simple. Ask each patient to sign a separate marketing permission form. Keep a copy. Stop using the photo if the patient changes their mind.

This is general information, not legal advice. Ask your compliance lead or a lawyer about your clinic.

Yes. “PHI” is a US term, but each market below protects identifiable patient photos as health data. Use each country’s own rule, not HIPAA.

The Information Commissioner’s Office (ICO, the UK’s data protection authority) says health data includes personal information that tells us something about a person’s health or medical treatment.

A digital photo is not automatically biometric data (information about a person’s body used to identify them). It becomes biometric data when special technical processing (using technology to examine a person’s features) is used to identify someone, such as facial recognition.

Doctors should also follow the General Medical Council’s (GMC, the organisation that sets standards for doctors in the UK) guidance on taking and using photos, videos and audio recordings of patients.

The GDPR (the European Union’s law for protecting personal information) uses the same definitions of health data in this area as the UK GDPR. Individual EU countries may have additional rules, so check with a local legal adviser to understand which rules apply to your clinic.

Federal Law No. 2 of 2019 covers health information in different forms, including information that can be seen, heard or read and relates to the health sector.

Dubai’s Health Authority (DHA, the organisation that regulates health care in Dubai) and Abu Dhabi’s Department of Health (DoH, the organisation that regulates health care in Abu Dhabi) also have rules that clinics in their areas may need to follow.

The Arabic text of the law is the legally authoritative version (the version that takes priority if there is a difference in wording).

Under the Privacy Act 1988 (Australia’s law for protecting personal information), health information is a type of sensitive personal information (information that needs extra protection).

The Office of the Australian Information Commissioner (OAIC, Australia’s privacy regulator) explains that health information includes personal information collected by a health service provider about a person.

A photo can be personal information if the person can reasonably be identified from it.

The Personal Data Protection Law (Saudi Arabia’s law for protecting personal information) classifies health data as sensitive personal data (information that needs extra protection).

This includes personal information about a person’s physical health, mental health or psychological condition, or the health services they have received.

A vendor’s website may mention “HIPAA” a lot, but that doesn’t tell you what the contract says. These questions get you facts you can check:

• Will you sign a BAA before we upload any patient photo? Ask to see the document, not just a promise.
• Does the BAA cover the plan we’re buying? Check that it names the exact service your team will use.
• Which subcontractors touch our photos? For example, the cloud provider or the tools the vendor’s support team uses. Ask whether the vendor has a BAA with each one (45 CFR 164.502(e)(1)(ii)).
• How fast will you tell us about a breach? HIPAA requires a business associate to tell you without unreasonable delay, and no later than 60 days after it discovers a breach (45 CFR 164.410). Many clinics ask for a shorter deadline in the contract.
• What happens to our photos if we leave? Ask how you export them and when the vendor deletes its own copies.
• Do photos stay out of staff phone galleries? If the app saves to the camera roll, photos can sync to personal cloud accounts that have no BAA.
• Does each person get their own login, and is there an audit trail (a record of who viewed or shared each photo)? You’ll need both to meet your own HIPAA duties.

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

A signed BAA doesn’t make your clinic compliant. It covers only what the vendor does with your photos. Everything else is still your clinic’s job.

That includes your risk analysis (45 CFR 164.308(a)(1)(ii)(A)), staff training (164.308(a)(5)) and rules for staff phones and other devices. It also includes getting a patient’s written authorization before you use an identifiable photo in marketing (164.508(a)(3)).

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

A real case shows what this looks like. In 2016, Raleigh Orthopaedic Clinic in North Carolina handed the x-ray films and health information of about 17,300 patients to a company that promised to digitize them. The clinic and the company never signed a BAA. The clinic later agreed to pay $750,000 to HHS to settle the case.

HHS said a BAA is “more than a mere check-the-box paperwork exercise.” The signed contract has to be in place before any patient information is shared. As part of the settlement, the clinic had to put three fixes in place:

• Name one person responsible for making sure a BAA is signed before PHI is shared.
• Use a standard BAA template.
• Keep its BAA records for at least 6 years after it stops working with each vendor.

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

“BAA” is a US term. Other countries use different contracts and rules. Each law below applies only in its own country.

United Kingdom. Under UK GDPR Article 28, your clinic is the “controller” (it decides how patient data is used). Any company that handles that data for you, such as a clinical photo app vendor, is a “processor”. The two must have a written contract. The Information Commissioner’s Office (ICO), the UK data regulator, lists what the contract must cover, including documented instructions, security, sub-processors (subcontractors) and what happens to the data when the contract ends. The ICO says this guidance is under review after the Data (Use and Access) Act.

European Union. EU GDPR Article 28 sets the same duty for clinics in the EU. A clinic needs a written contract with any company that handles patient data for it, such as a clinical photo app vendor.

United Arab Emirates. Federal Law No. 2 of 2019 covers the use of information and communication technology (ICT) in health fields. Its Article 13 says health data from services in the UAE generally may not be stored, processed or transferred outside the country, except in cases the rules allow. So ask a clinical photo app vendor in writing where your photos are stored. Also check the rules of your emirate’s health regulator.

Australia. The Privacy Act 1988 has no BAA. Its Australian Privacy Principles (APPs) include APP 8, which applies when you send personal information, such as patient photos, to a recipient overseas. An example is a clinical photo app vendor that stores photos outside Australia. Before you do, you must take reasonable steps to make sure that recipient doesn’t breach the APPs. Under section 16C of the Act, your clinic can still be held responsible for what that recipient does with the information.

Saudi Arabia. The Personal Data Protection Law (PDPL), Article 8, says your clinic, as the “controller” (it decides how patient data is used), “shall only select Processors providing the necessary guarantees”. A processor is a company that handles the data for you, such as a clinical photo app vendor. The clinic must also keep checking that the processor follows the law.

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

Use this checklist in your daily work:

• Protect every clinical photo as PHI by default. This includes close-up photos that do not show the patient’s face.
• Protect photos sent by patients. If a photo can identify the patient and meets the HIPAA definition, protect it from the moment your clinic receives it.
• Give patients one approved way to send photos. Do not ask them to send photos to a staff member’s personal phone number.
• Check photo file names. Remove patient names from photo files stored outside the patient’s medical record.
• Get separate written permission for marketing. Before using an identifiable patient photo for marketing, get the required written authorization (formal written permission) under 45 CFR 164.508(a)(3). Our patient photo consent form page explains what it needs.
• Check photos before calling them de-identified. Use one of HIPAA’s two approved methods: Safe Harbor or expert determination. Keep a written record of the method used.
• Check the rules for each country. If your clinic is outside the US, check which country’s health data protection laws apply to that clinic location.

Ask patients to send photos through a secure upload link (a link that lets patients send photos safely) instead of sending them to a staff member’s phone number.CureCast’s secure patient photo upload lets a patient upload from their browser, with no app. The photo goes straight into their record, not into a staff phone.

CureCast supports HIPAA-compliant workflows and provides a business associate agreement (BAA), a contract in which a vendor promises to protect your patients’ data.Your clinic is still responsible for following the rules that apply to its own work. . Read our HIPAA guide for clinical photos to understand which responsibilities remain with your clinic. If your clinic is outside the US, read our guides to UK data protection and Australia’s Privacy Act to learn more about the rules that may apply.

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

Is a wound photo PHI if the face isn’t shown?

Yes, if your clinic holds the photo and it is linked to the patient. The link could be the patient’s medical record, the file name or identifying details in the photo. The patient’s face does not need to be shown.

Is a de-identified patient photo PHI?

No. A photo de-identified under 45 CFR 164.514(b) is not PHI. Simply removing the patient’s face is usually not enough.

Is a before-and-after photo on Instagram still PHI?

Yes. Posting it doesn’t change what it is. You need the patient’s written authorization before you post it (45 CFR 164.508(a)(3)).

Do you need consent to take clinical photos?

HIPAA lets you use PHI for treatment without a separate authorization (45 CFR 164.506). Your state law or clinic policy may still require consent. In the UK, GMC guidance expects consent or other valid authority before taking photos or videos or making audio recordings of the patient.

This guide is general information, not legal advice. Rules differ by state and country. Check with your clinic’s compliance officer (the person responsible for checking that the clinic follows the rules) or legal adviser to understand which rules apply to your clinic.

HIPAA applies to most US clinics that bill insurance electronically. Not sure if yours is one? Your compliance lead can confirm.

This post is general information about HIPAA and similar laws in other countries. It is not legal advice. Check your own situation with your compliance lead or counsel.

References

All accessed 15 October 2026. Legislation links are listed for you to click; none is marked verified.

United States

• 45 CFR 160.103, Definitions: “covered entity”, “health information”, “individually identifiable health information”, “protected health information” (including the exclusions for employment records and people dead more than 50 years). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
• 45 CFR 164.514(b), de-identification: Safe Harbor identifiers (b)(2)(i)(Q) full-face images and (b)(2)(i)(R) unique characteristics; actual knowledge test (b)(2)(ii); expert determination (b)(1). 45 CFR 164.514(e)(2)(xvi), limited data set. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
• 45 CFR 164.508(a)(3), authorization for marketing. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
• 45 CFR 164.506, uses for treatment, payment and health care operations. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
• HHS, Guidance on de-identification of PHI. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html

United Kingdom and EU

• UK GDPR, Article 4(14) biometric data, Article 4(15) data concerning health, Article 9 special category data. https://www.legislation.gov.uk/eur/2016/679/contents
• ICO, “What is special category data?” (page notes it is under review after the Data (Use and Access) Act). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
• GMC, “Making and using visual and audio recordings of patients”. https://www.gmc-uk.org/professional-standards/the-professional-standards/making-and-using-visual-and-audio-recordings-of-patients
• Regulation (EU) 2016/679 (GDPR), Articles 4(15) and 9. https://eur-lex.europa.eu/eli/reg/2016/679/oj

UAE

• Federal Law No. 2 of 2019 on the Use of ICT in Health Fields, Article 1 (definition of health information). Official English translation; Arabic prevails.

Australia

• Privacy Act 1988 (Cth), section 6, definitions of “health information”, “personal information” and “sensitive information”. https://www.legislation.gov.au/C2004A03712/latest/text
• OAIC, “What is health information?”. https://www.oaic.gov.au/privacy/your-privacy-rights/health-information/what-is-health-information

Saudi Arabia

• Personal Data Protection Law (Royal Decree M/19), Article 1, definitions of “sensitive data” and “health data”. Copy hosted by MISA; confirm against SDAIA’s current consolidated text. https://misa.gov.sa/app/uploads/2025/08/PersonalDataProtectionLaw.pdf