Pictures are worth a policy

It’s never been easier, cheaper or more worrisome to take a photo, especially in a long-term care (LTC) facility.   

Electronic devices with their camera apps are in the hands of residents, visitors, staff and volunteers. Sharing a photo can also share protected health information and put a facility at risk for potential Health Insurance Portability and Accountability Act (HIPAA) violations, lawsuits alleging invasion of privacy and unwanted media attention. There’s also the added concern for residents with Alzheimer’s disease or dementia, who may not have the capacity to give their consent.

Policies and procedures should address the situations or reasons why cameras might be used, and the devices they might be used on. An ECRI Institute press release sent by email advises healthcare facilities to develop a thorough and thoughtful approach policy for safely capturing those Kodak moments.  


Residents and visitors need to be informed about the special privacy considerations that exist in a healthcare setting and how to avoid including unintended people or personal information in the frame.

Facilities should inform residents and visitors of these policies and procedures, possibly in admission materials and signs posted throughout the building.


Employees, staff and volunteers need to be informed about the potential patient privacy violations with using their devices without consent. Their privacy should also be respected, and policies must also address what to do if photography distracts, interferes or impedes their ability to deliver care.  

Education or research purposes

Patient authorization is not required by HIPAA if the recordings are used for healthcare operations such as quality improvement or training and education within the facility. Authorization is required for educational or research purposes outside of the facility, such as a professional conference.

Marketing and the media

Written authorization must be obtained to use images of residents on a facilitiy’s promotional material, as required by the marketing provision of the HIPAA privacy rule. The media must also obtain patient consent to be photographed.

Topics: Executive Leadership , Risk Management , Technology & IT