HIPAA before and after photos.

Facial features. Distinctive marks. Distinctive anatomy. Actual-knowledge test.

Imagery becomes PHI when the photo can be used alone or in combination to identify the individual. Facial features are explicitly listed in the 18 identifiers under 45 CFR 164.514 Safe Harbor ¹ . A facial photo of a patient is PHI. Distinctive marks (tattoos, scars, birthmarks), unique anatomical features, identifiable jewelry or clothing also surface as identifying information. Photos of body parts that the patient considers distinctive (even when the face is cropped) can still be PHI.

The Safe Harbor test reads against actual knowledge: the covered entity must not have actual knowledge that the remaining information could be used alone or in combination to identify the individual. Practical de-identification of patient imagery is harder than text de-identification because the identifiable features are visual and harder to remove cleanly.

Two paths. Different documentation requirements.

Safe Harbor removes 18 specific identifiers (name, address, dates more specific than year, contact information, biometric identifiers, full-face photographic images and any comparable images) and requires the covered entity not have actual knowledge that the remaining information could identify the individual ¹ .

Expert Determination is the alternative: a qualified statistician determines that the risk of identification is very small. Expert Determination accepts more granular de-identification (cropped photos, blurred facial features) when the statistical analysis supports the conclusion. Plastic-surgery and dermatology galleries occasionally use Expert Determination for partial-face or cropped imagery; the determination has to be documented by a qualified expert at the time of de-identification, with the methodology and result retained for audit.

Five elements scoped to imagery use, not text.

The imagery-specific authorization carries the same five elements as text-testimonial authorization under 45 CFR 164.508(c), but the description has to be specific to imagery use ² . Which photos, what surfaces they appear on (the practice's website gallery, social media, print marketing materials), the duration of use, the patient's right to revoke. The form names the photos by reference or by attached identifier; a catch-all 'gallery use' description does not satisfy the specific-and-meaningful standard.

The ASPS Code of Ethics on patient-image use adds specialty-specific guidance that several state medical boards reference ³ . Several boards adopt the ASPS framework by reference when no state-specific imagery rule exists. The architectural pattern: a separate imagery-specific authorization form executed at the time of the imagery use, distinct from the text-testimonial authorization. The two forms operate on different uses of patient information and a text-testimonial authorization does not cover imagery use.

Aggregated outcome graphics. De-identified statistical surfaces.

De-identification works for aggregated outcome graphics where no individual patient is the subject. A bar chart showing 'typical recovery time across 200 patients in a plastic-surgery series' has no individual identifiable; the aggregate is the surface. The covered entity must still document the de-identification methodology and confirm no individual is identifiable from the aggregate.

The OCR has resolved enforcement actions against practices that published identifiable imagery without authorization ⁴ . The HHS Wall of Shame retains the public log ⁵ . The architectural pattern errs on the side of imagery-specific authorization rather than de-identification for identifiable imagery.

The imagery-consent workflow is the load-bearing surface for plastic-surgery and dermatology pages in the healthcare SEO architecture at Praxis. The gallery surface depends on the workflow upstream of every published photo.