Patient Photography Consent in Australia: Clinical Care, Teaching and Marketing

Australian clinics generally need appropriate consent before taking identifiable patient photographs. Limited exceptions apply under the Privacy Act. The type of consent depends on the intended use. A photograph taken for diagnosis and treatment planning sits within the patient’s clinical record and is governed by the Privacy Act 1988 and, in some states, dedicated health records legislation. A photograph used for teaching, conference presentations or published research requires separate, purpose-specific consent. A photograph used in advertising triggers additional obligations under the Health Practitioner Regulation National Law and Ahpra’s advertising guidelines.

Three principles apply across all three purposes:

1. Explain to the patient why the photograph is being taken, who will see it and how it will be used.
2. Record consent in the patient’s file, ideally in writing.
3. Allow the patient to withdraw consent at any time and act on that withdrawal promptly.

This guide covers consent for clinical care, teaching and marketing in turn. For the advertising-specific rules on before-and-after images, see our companion article Before-and-After Photo Advertising in Australia: Ahpra Rules for Clinics.

Key principle: Consent for one purpose does not extend to another. A patient who agrees to a clinical photograph has not agreed to its use in a conference presentation or a social media post (Avant, Clinical Images: A Snapshot of the Issues).

For the product workflow, see CureCast clinical photo management for Australian clinics, including photo search, follow-up comparisons and secure patient upload.

To connect the consent record with day-to-day storage and access decisions, see how Australian clinics can store patient photos securely.

Clinical photographs serve three broad purposes, and each carries its own consent requirements.

The critical distinction is that consent for clinical care does not automatically extend to teaching or marketing. MDA National advises that “consent for clinical management with treating clinicians does not necessarily cover teaching junior colleagues” (MDA National, 2012). Each secondary use requires its own conversation and its own documented agreement.

Several overlapping laws govern clinical photographs. A private practice in any state must comply with the Commonwealth Privacy Act. Public hospitals are covered by their state’s law. Private practices in NSW, Victoria and the ACT follow their state or territory law as well. In practice, the obligations are similar.

Privacy Act 1988 (Cth) and the Australian Privacy Principles

The Privacy Act applies to private sector health service providers with an annual turnover above $3 million, and to all health service providers regardless of turnover when they hold health information (section 6D). The Australian Privacy Principles (APPs) set out how personal information, including health information, must be handled.

Four APPs are directly relevant to clinical photography:

• APP 3 (Collection): Collect only health information reasonably necessary for your clinic’s functions. The patient’s consent is generally required, unless an exception applies.
• APP 5 (Notification): Take reasonable steps to tell the patient why the information is collected, usual disclosures, access and complaint arrangements, and likely overseas recipients. Give this information at collection or, if that is not practicable, as soon as practicable afterwards.
• APP 6 (Use and disclosure): Health information collected for one purpose may be used for a secondary purpose only if the patient consents, or the secondary use is directly related to the primary purpose and the patient would reasonably expect it.
• APP 11 (Security): The provider must take reasonable steps to protect health information from misuse, interference, loss and unauthorised access.

The OAIC confirms that a patient photograph is personal information if the patient is reasonably identifiable, and that it is health information if it relates to the patient’s health or was collected to provide a health service (OAIC, Taking Photos of Patients).

NSW, Victoria and the ACT have enacted their own health records privacy legislation. These laws also apply to private health practices. A clinic in these places follows its state or territory law as well as the Privacy Act.

The Medical Board’s code Good Medical Practice requires practitioners to protect patient privacy and treat patient information as confidential. It also requires consent processes for releasing health information. The Board’s social media guidance asks doctors to check that photos they share do not reveal patient information and warns that information put online is often impossible to remove.

A photograph taken for diagnosis, treatment planning or outcome tracking forms part of the patient’s clinical record. Consent for this purpose follows the same principles as consent for any other clinical procedure.

Avant’s factsheet on digital photography states that images taken for clinical purposes “must only be taken with appropriate consent” and recommends following any hospital or practice policy that requires a signed form (Avant, Digital Photography Factsheet). Where verbal consent is obtained, Avant advises documenting it in the clinical notes and, if possible, having the patient initial the entry.

The RACGP’s guidance on clinical photography of skin lesions goes further, recommending informed written consent before any clinical images are taken. It identifies written consent as “best practice” and advises that, at a minimum, the consent and its scope should be documented in the patient file (Burns and Belton, AJGP, 2019).

At the point of consent, the patient should be told:

1. Why the photograph is being taken (for example, to record a baseline before treatment).
2. Who will have access to it within the treating team.
3. How and where it will be stored.
4. That the photograph forms part of the clinical record and is subject to the same retention requirements.

A patient who sends their own photograph to the clinic, for example by email or through a patient portal, implies consent for the treating clinician to view it for their care. That implied consent does not extend to other uses (Avant, Digital Photography Factsheet).

For sensitive images, such as photographs of intimate areas, written consent is particularly important. The clinical reason for the photograph should be clearly documented.

Using a clinical photograph for teaching, conference presentations or published research is a secondary use under APP 6. Unless the patient would reasonably expect it, secondary use requires consent.

MDA National advises that practitioners should not assume clinical consent covers educational use. Showing a photograph to a medical student during a ward round may seem routine, but it falls outside the primary purpose for which the image was collected (MDA National, 2012).

The distinction between identifiable and de-identified images matters here, but it does not eliminate the need for consent. The OAIC notes that de-identification requires more than obscuring the face: distinctive features such as a rare visible condition, a physical marking or a tattoo can identify a patient (OAIC, Taking Photos of Patients). Avant adds that most peer-reviewed journals require signed consent before publication of even non-identifiable images (Avant, Digital Photography Factsheet).

For formal research, ethics committee approval is typically required. The Medical Board’s code says doctors need informed consent before involving patients in teaching or research, and that human research must be approved by an ethics committee.

Practical steps for teaching and research consent:

• Obtain written consent before any non-clinical use.
• Specify the intended use: a conference presentation is different from a published journal article, and both are different from an internal teaching session.
• Explain that de-identification will be applied where possible, but that complete anonymity cannot always be guaranteed.
• Note that once an image is published, it is extremely difficult to remove (Burns and Belton, AJGP, 2019).
• If sharing images with colleagues informally, confirm that the patient has consented to that level of disclosure.

Advertising consent is separate from both clinical and teaching consent. The cosmetic surgery guideline issued by the Medical Board of Australia states this directly: advertising consent is separate from surgical consent (section 6.10(a)).

The advertising consent conversation must cover where images will appear, for how long, and the risks of social media distribution. The ten-point consent list in the cosmetic surgery guideline provides the most detailed Australian standard for advertising consent. Our companion article Before-and-After Photo Advertising in Australia: Ahpra Rules for Clinics covers that list and the full advertising requirements in detail.

The ADA NSW patient photographs information sheet reinforces this separation. It states that consent for clinical management does not automatically cover advertising, and that advertising use requires its own purpose-specific consent (ADA NSW, 2025).

Key points for marketing consent:

• Obtain advertising consent in a separate document from the clinical consent form.
• Allow the patient to view the images before agreeing to their use.
• Explain that images on social media may be shared, screenshotted or commented on by third parties.
• Make clear that the patient may decline advertising use without affecting their clinical care.
• Record advertising consent alongside the images it covers.

The ADA NSW patient photographs information sheet provides the most comprehensive published checklist of what a consent form should contain. The following list draws on that sheet and on the Avant and RACGP guidance cited above.

A photography consent form should include:

1. The date of the consent discussion.
2. The practice name and the patient’s identifying details.
3. The primary purpose of the photographs (clinical care, treatment planning, outcome tracking).
4. Each secondary purpose for which consent is sought, listed individually so the patient can agree to some and decline others (for example, teaching, conference presentations, journal publication, website marketing, social media).
5. The types of images that will be taken (full face, close-up of the treatment area, body region).
6. A statement on privacy and security: where originals will be stored, who will have access and how the images will be protected.
7. A de-identification statement: whether identifying features will be obscured for non-clinical uses.
8. A sharing statement: whether images may be shared with other practitioners, insurers or third parties, and under what circumstances.
9. A withdrawal clause: that the patient may withdraw consent at any time, in writing, and that the clinic will act on the withdrawal promptly.
10. A note that images already published or shared before withdrawal cannot always be retrieved.
11. A signed, dated and witnessed signature block.

The form should be presented before the photographs are taken, not after. The patient should receive a copy of the signed form.

Our patient photo consent form page shows how to build a form that covers all of these points alongside the photographs themselves.

A patient can withdraw consent for photography at any time, and clinics must act on that decision promptly. However, how the withdrawal plays out depends on what the images were originally collected for.

Marketing and teaching images. If a patient withdraws consent, the clinic must stop using those images immediately. Remove them from the website, social media, waiting-room displays and any teaching materials. Delete copies from shared drives or cloud folders that staff outside the direct care team can access. Confirm the deletion in writing to the patient.

Clinical record images. Images that form part of the patient’s medical record sit in a different category. Some state laws require clinics to keep health records for a set time. In NSW, this is 7 years after the last visit for adults, and until age 25 for patients who were under 18. So clinical images may have to stay in the record even when a patient withdraws consent for other uses. The patient can request that access to those images be restricted, but outright deletion is not always lawful. Explain this distinction clearly at the time of withdrawal so the patient understands why certain images are retained.

Published images are difficult to recall. Burns and Belton note in their 2019 AJGP article that images already published online are very hard to remove. Screenshots, cached pages and third-party shares may persist long after the original is taken down. This reality is one of the strongest arguments for obtaining specific, informed consent before any image leaves the clinical record.

Document the withdrawal. Record the date, scope and method of the withdrawal request in the patient’s file. Note which images were removed and from where, and flag any images retained in the clinical record along with the reason for retention.

The ADA NSW consent form template includes a withdrawal clause that patients sign at the outset, confirming they understand how to revoke permission and what happens when they do. Building withdrawal into the original consent process avoids surprises later.

Managing consent across clinical care, teaching and marketing is a record-keeping problem as much as a legal one. CureCast keeps consent records alongside patient photos, so the permission status of every image is visible at the point of use.

When a clinician captures a photo through CureCast, the platform prompts for consent details before the image is stored. The consent scope (clinical only, teaching, marketing, or a combination) is tagged to the image and cannot be separated from it. Staff members see at a glance whether a given photo is cleared for a conference presentation, a website gallery or only the patient’s own record.

If a patient withdraws consent for a particular use, the tag is updated and access to that image is restricted accordingly. The audit trail records who changed the consent status, when and why, which supports the documentation steps that Avant and the ADA NSW recommend.

For clinics that collect consent on paper forms, CureCast can store a scanned or photographed copy of the signed form linked to the same patient record. The form and the images it covers sit in one place, rather than in separate filing systems that fall out of sync.

Consent records are health information too, so they need the same protection as the photos. CureCast is a clinical photo app that helps Australian clinics keep both safe. Its encryption and access controls help your clinic meet APP 11 of the Privacy Act, which covers protecting health information, and the state health records laws described above. You can see how this works for your own team during the 14-day trial.

Learn more about clinical photo management for Australian practices.

Not in every case, but written consent is best practice. Avant advises that verbal consent is acceptable when documented in the patient’s notes, but written consent provides stronger evidence if a complaint arises. For sensitive areas, identifiable images or any photo that might be used beyond direct care, a signed consent form is the safer approach.

De-identification reduces privacy risk but does not eliminate the need for consent. The OAIC notes that a photo is personal information if the patient is identifiable or could reasonably be re-identified. Cropping a face from a skin-lesion photo may be enough for some clinical purposes, but journals typically require signed consent even for images described as non-identifiable. If in doubt, obtain consent.

Usually not. MDA National recommends that consent for photography be separate from treatment consent, because the purposes differ. A patient who consents to a procedure has not necessarily agreed to have that procedure photographed, much less to have the images used in teaching or marketing. Purpose-specific consent protects the clinic and respects the patient’s autonomy.

In NSW, the Health Records and Information Privacy Act 2002 requires private health service providers to keep health records for 7 years after the last visit for adults, and until age 25 for patients under 18. Other states may differ, so check your jurisdiction.

Ahpra can act on advertising breaches, and the National Law sets penalties for them. A patient can also complain to the privacy regulator (OAIC).

All accessed 4th November 2026.

Australian privacy law and guidance

• OAIC: Taking photos of patients: patient photos are personal and sensitive information; consent, de-identification and keeping images secure.
• OAIC: Small business: health service providers must follow the Privacy Act whatever their turnover.
• Privacy Act 1988, section 6D: a small business is not exempt if it provides a health service and holds health information.
• OAIC: Read the Australian Privacy Principles: the full text of the 13 principles.
• OAIC: APP 6, use or disclosure: a second use needs consent, or a directly related purpose the patient would expect.
• OAIC: APP 11, security: reasonable steps to protect information, and to destroy it when no longer needed unless a law requires keeping it.
• OAIC: Health and medical research: the Privacy Act allows some research use of health information in limited cases.
• OAIC: Handling privacy complaints: the Commissioner can investigate an alleged breach of the principles.

Medical Board of Australia and Ahpra

• Good medical practice: a code of conduct for doctors: 4.4 confidentiality and consent processes, 4.5.2 consent before teaching or research, 13.2.3 ethics committee approval.
• Ahpra: Social media guidance: check that shared photos do not reveal patient information; online information is hard to remove.
• Ahpra: Guidelines for advertising a regulated health service: section 133 of the National Law, including 4.4.1 on before-and-after images.
• Ahpra: Advertising and the law: the advertising rules in section 133 and the penalties for breaking them.
• Guidelines for registered medical practitioners who advertise cosmetic surgery: 6.10, advertising consent must be separate from consent to surgery (points (a) to (j)).
• Ahpra: Advertising higher risk non-surgical cosmetic procedures: the same separate advertising consent rule for non-surgical procedures.

State and territory rules

• Health Records and Information Privacy Act 2002 (NSW): 15 Health Privacy Principles; section 25, keep records 7 years for adults and until age 25 for children.
• Health Records Act 2001 (Vic): the principles apply to public and private providers, with no small business exemption.
• Health Records (Privacy and Access) Act 1997 (ACT): the ACT law on health records.