HIPAA Recording Guidance January 2023
HIPAA Guidance on Photos, Video and Audio Recording in Clinical Areas
Photography, video, and audio recordings (collectively recordings) have the potential to violate patient
privacy and interfere with patient care. Recordings must be taken, used, and/or disclosed in compliance
with state and federal law. This guidance sets out rules for the recording of protected health information
(PHI) and the recording of individuals (visitors, employees, or patients) in a University clinical setting.
Consent vs. Authorization
In this document, “authorization” refers to the permission that HIPAA requires for use or release of PHI.
Under HIPAA, authorization must be in writing and there are specific statements that must be included for
the authorization to be valid. https://hipaa.yale.edu/sites/default/files/files/5031-FR.pdf ).
“Consent” refers to the process of obtaining permission from a patient to make a recording in
circumstances where a HIPAA authorization Is not required. The requirements for consent vary based on
the context.
Allowable Photo/Video Recording for Business Purposes
1. Patient Consent for Recording a Patient/Individual
The Joint Commission revised their standards related to consent in 2022, removing the
requirement that consent be obtained prior to recording a patient for purposes unrelated to
diagnosis, treatment, or identification of the patient, such as quality improvement, training, or
other internal organizational activities. While no longer required in most cases, ethical
considerations support notifying patients of the intent to record them and how the image(s) may
be used. Explicit notice of allowable internal uses are included in the Patient Financial
Authorization and clinicians should consider seeking permission prior to photographing a patient.
However, certain recordings are necessary for safety and operational purposes and may take
place without patient permissions, including:
• To document abuse or neglect
• For safety or security of patients, workforce, or visitors
• For identification of the patient
• For patient care and treatment activities including patient safety, care coordination, and
treatment planning. In such cases, recordings should be integrated into the medical
record.
• To monitor clinical conditions via video surveillance
• For recording done by the patient’s family members or friends when a) the recording
does not interfere with patient care or capture other patients or PHI and b) permission is
obtained from any workforce member being recorded.
2. Patient Authorization for Use or Disclosure of a Recording
Patient authorization is governed by HIPAA. Recordings that identify a patient or otherwise
include PHI such as full face photos, photos of unique identifying marks, or photos of patients that
are date stamped (reflecting a date of service) are subject to HIPAA., If a recording identifies a
patient or contains PHI, and if the purpose for which the recording will be used or disclosed is
unrelated to treatment, payment or healthcare operations (TPO), then written authorization of the
patient or the patient’s personal representative is required.
Instances in Which Patient Authorization is Not Required to Use or Disclose a Recording