In general, any individual can take any other individual's photograph in a public place, and the subject of the photograph has no right to stop it. A hospital is a public place, even though it is on private property.

Before taking photographs of a patient for educational, publicity, or research purposes, a healthcare provider needs to obtain the patient's written consent. The applicable law protecting the patient's privacy is the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

HIPAA requires organizations working with protected health information (PHI) to ensure the confidentiality of the sensitive information. There are 18 HIPAA identifiers that constitute PHI, one of which is full-face photos.

What is not PHI? De-identified health information neither identifies nor provides a reasonable base to identify an individual. Health information by itself without the 18 identifiers is not considered to be PHI. For example, a dataset of vital signs by themselves do not constitute protected health information.

Patient Consent. As a foundational matter, it is best practice to obtain written patient consent prior to taking a photograph or video of a patient. The form of such consent may vary depending on the purpose of the photograph (e.g., treatment versus marketing), and may vary from state to state.

Workforce members are allowed to take photos and videos of patients, but only for a use or disclosure required or permitted by the Privacy Rule. Photos taken for any other purpose require a written authorization from the patient which explains why the photo is being taken and who it will be shared with.

Common examples of social media HIPAA compliance violations include: Posting verbal "gossip" about a patient to unauthorized individuals, even if the name is not disclosed. Sharing of photographs, or any form of PHI without written consent from a patient.