Disclosure Of Protected Health Information Research Articles

EConsult for Provider-to-Provider Consultation


 The main cost considerations related to electric consultation (eConsult) can be grouped as start-up or infrastructure costs (e.g., equipment, developing electronic forms, creating workflows, and web page design), remunerations, (e.g., for primary care providers, specialist, and auxiliary staff), and societal cost (e.g., productivity loss, time spent travelling, cost of fuel to travel).
 Considerations for a successful integration of eConsult models into clinical workflows may be broadly categorized into pre-implementation factors (e.g., appropriate training for staff, anticipating and addressing potential barriers or concerns, and having contingency plans for technological failures), implementation factors (e.g., ensuring availability of appropriate data collection and processing devices and software, defining appropriateness of eConsult, building efficiency into the design by using standardized data capture forms, maximizing auto-populating data fields to reduce documentation time, ensuring appropriate confidential documentation, and emphasizing critical information).
 There were limitations in that no papers were identified to address the questions regarding ethical and professional considerations for the collection, use, and disclosure of protected health information, or the strengths and limitations of a standalone eConsult versus an eConsult platform integrated within an electronic medical records system. Furthermore, although the included studies contained some useful answers, they were not designed to address any of the research questions. Thus, well-designed studies focusing on the individual questions may be necessary for more comprehensive answers.

Privacy as the Price of Drug Access

In response to the recent increase in FDA-approved specialty drugs and escalating specialty drug prices, drug companies now offer patient support programs (“PSPs”) for eligible patients prescribed a particular pharmaceutical drug. Such programs encompass both financial assistance for the purchase of a specialty drug and behavioral services, including nursing support and injection training, intended to improve drug adherence. Although ostensibly gratuitous, these programs have a steep and underappreciated cost: disclosure of protected health information. In effect, patient support programs compel patients to trade protected health information for drug access. This Article provides the first in- depth examination of the legal and ethical concerns associated with patient support programs. Enrollment in a drug company’s patient support program furnishes the company with linked patient- and prescriber- identifying information for each enrollee, data which may enable drug companies to target marketing to patients and healthcare providers with an otherwise unattainable degree of precision. Moreover, once a drug company acquires an enrollee’s protected health information pursuant to a valid Health Insurance Portability and Accountability Act (HIPAA) authorization, a drug company faces few limits on downstream uses of those data. This Article illuminates a possible role for patient support program-mediated data collection in two unlawful drug company practices: (1) kickback schemes in coordination with foundations that cover pharmaceutical drug copays, and (2) “product hopping” to a new brand-name drug formulation after patent expiration of an older formulation. The current regime for health data privacy in the United States lacks adequate safeguards to prevent drug companies from exploiting patient support program-derived data to the detriment of patients. The Article ends by proposing practical modifications to the HIPAA Privacy Rule to modernize HIPAA’s protections vis-à-vis health data transferred from covered entities to noncovered entities such as drug companies.

Breaching Trust: A Qualitative Study of Healthcare Experiences of People Who Use Drugs in a Rural Setting.

Background: Increased drug use has disproportionately impacted rural areas across the U.S. People who use drugs are at risk of overdose and other medical complications, including infectious diseases. Understanding barriers to healthcare access for this often stigmatized population is key to reducing morbidity and mortality, particularly in rural settings where resources may be limited.Methods: We conducted 20 semi-structured interviews with people who use drugs, including 17 who inject drugs, in rural southern Illinois between June 2018 and February 2019. Interviews were analyzed using a modified grounded theory approach where themes are coded and organized as they emerge from the data.Results: Participants reported breaches of trust by healthcare providers, often involving law enforcement and Emergency Medical Services, that dissuaded them from accessing medical care. Participants described experiences of mistreatment in emergency departments, with one account of forced catheterization. They further recounted disclosures of protected health information by healthcare providers, including communicating drug test results to law enforcement and sharing details of counseling sessions with community members without consent. Participants also described a hesitancy common among people who use drugs to call emergency medical services for an overdose due to fear of arrest.Conclusion: Breaches of trust by healthcare providers in rural communities discouraged people who use drugs from accessing medical care until absolutely necessary, if at all. These experiences may worsen healthcare outcomes and further stigmatize this marginalized community. Structural changes including reforming and clarifying law enforcement's role in Emergency Departments as well as instituting diversion policies during arrests may help rebuild trust in these communities. Other possible areas for intervention include stigma training and harm reduction education for emergency medicine providers, as well as developing and implementing referral systems between Emergency Departments and local harm reduction providers and medically assisted drug treatment programs.

A Digital Library for Increasing Awareness About Living Donor Kidney Transplants: Formative Study.

BackgroundIt is not common for people to come across a living kidney donor, let alone consider whether they would ever donate a kidney themselves while they are alive. Narrative storytelling, the sharing of first-person narratives based on lived experience, may be an important way to improve education about living donor kidney transplants (LDKTs). Developing ways to easily standardize and disseminate diverse living donor stories using digital technology could inspire more people to consider becoming living donors and reduce the kidney shortage nationally.ObjectiveThis paper aimed to describe the development of the Living Donation Storytelling Project, a web-based digital library of living donation narratives from multiple audiences using video capture technology. Specifically, we aimed to describe the theoretical foundation and development of the library, a protocol to capture diverse storytellers, the characteristics and experiences of participating storytellers, and the frequency with which any ethical concerns about the content being shared emerged.MethodsThis study invited kidney transplant recipients who had received LDKTs, living donors, family members, and patients seeking LDKTs to record personal stories using video capture technology by answering a series of guided prompts on their computer or smartphone and answering questions about their filming experience. The digital software automatically spliced responses to open-ended prompts, creating a seamless story available for uploading to a web-based library and posting to social media. Each story was reviewed by a transplant professional for the disclosure of protected health information (PHI), pressuring others to donate, and medical inaccuracies. Disclosures were edited.ResultsThis study recruited diverse storytellers through social media, support groups, churches, and transplant programs. Of the 137 storytellers who completed the postsurvey, 105/137 (76.6%) were white and 99/137 (72.2%) were female. They spent 62.5 min, on average, recording their story, with a final median story length of 10 min (00:46 seconds to 32:16 min). A total of 94.8% (130/137) of storytellers were motivated by a desire to educate the public; 78.1% (107/137) were motivated to help more people become living donors; and 75.9% (104/137) were motivated to dispel myths. The ease of using the technology and telling their story varied, with the fear of being on film, emotional difficulty talking about their experiences, and some technological barriers being reported. PHI, most commonly surnames and transplant center names, was present in 62.9% (85/135) of stories and was edited out.ConclusionsWith appropriate sensitivity to ensure diverse recruitment, ethical review of content, and support for storytellers, web-based storytelling platforms may be a cost-effective and convenient way to further engage patients and increase the curiosity of the public in learning more about the possibility of becoming living donors.

Risk Management Amid a Global Pandemic

Back to table of contents Previous article Next article Government & LegalFull AccessRisk Management Amid a Global PandemicAnne Huben-Kearney, R.N., B.S.N., M.P.A.Anne Huben-KearneySearch for more papers by this author, R.N., B.S.N., M.P.A.Published Online:28 Apr 2020https://doi.org/10.1176/appi.pn.2020.5a38AbstractBe sure you know the current regulations and best practices regarding the provision of patient care during the COVID-19 pandemic.Thank you for your strength and resilience in providing vital mental health services to your patients, colleagues, friends, and family during this challenging time.Why talk about risk management during the COVID-19 pandemic? Risk mitigation is always critical, especially in a global emergency. Use of best practices, such as those listed below, ensures that your practice is consistent and safe.Telehealth ConsiderationsThe standard of care provided via telehealth is the same as the standard of care for traditional face-to-face encounters, including patient evaluation and assessment, treatment plans, medication, and documentation.If planning to provide telepsychiatry services, choose a HIPAA-compliant telehealth vendor and obtain a Business Associate Agreement (BAA) to ensure data protection and security. If using one of the non-HIPAA-compliant platforms, such as Skype or FaceTime, which are temporarily allowed during this national emergency, enable all available encryption and privacy modes.Regardless of the technology platform, obtain informed consent from each patient authorizing the use of telehealth. Include in the discussion the potential for privacy and security breaches; emphasize the need for interactions to be conducted in a location that provides auditory and visual privacy; and point out that Skype, FaceTime, or similar services are not secure, HIPAA-compliant systems. Document the patient’s understanding prior to use.Providing Care for Patients Out of StateOne of the major changes impacting care during the COVID-19 crisis involves licensure in the state where the patient is located. During this pandemic, governors in many states have issued executive orders waiving licensure requirements, and many have expedited temporary licenses for out-of-state physicians wishing to provide telehealth services to the residents of their state. Check the executive orders for the states in which your patients are now located. Refer to the Council of State Governments’ “COVID-19 Resources for State Legislators” for a listing of the executive orders.Prescribing Controlled SubstancesWith the COVID-19 public health emergency, the Drug Enforcement Administration (DEA) has suspended the requirement of the Ryan Haight Act that a health care professional conduct an initial, in-person exam of a patient before electronically prescribing a controlled substance. Comply with state laws or regulations on prescribing controlled substances that may not have been suspended.If practicing telepsychiatry in multiple states, only one DEA registration is required under federal law to dispense controlled substances in those states. Refer to the Drug Enforcement Agency Diversion Control Division’s COVID-19 information page.Potential Exposure to COVID-19 in the OfficeIf notified that a patient has or highly suspects he or she has the COVID-19 virus, best practice is to contact your patients who may have encountered that individual. Inform the patients that another patient has tested positive or highly suspects he or she may have the COVID-19 virus and was at the office on the same day. To maintain privacy compliance under HIPAA, do not provide names, appointment times, or information that may make it possible to identify that individual.If Asked to Release InformationThe HIPAA Privacy Rule permits disclosure of protected health information without individual authorization to a public health authority, such as the Centers for Disease Control and Prevention or state/local health departments. Limit the disclosure to the “minimum necessary,” such as the name and phone number of the patient, but do not release the clinical record or patient diagnosis. ■APA Practice Guidance for COVID-19.Office for Civil Rights, U.S. Department of Health and Human Services—Notification of Enforcement Discretion for Telehealth Remote Communications During COVID-19 Nationwide Public Health Emergency.Clinical Questions About COVID-19: Questions and Answers.This information is provided as a risk management resource for Allied World policyholders and should not be construed as legal or clinical advice. This material may not be reproduced or distributed without the express, written permission of Allied World Assurance Company Holdings Ltd, a Fairfax company (“Allied World”). Risk management services are provided by or arranged through AWAC Services Company, a member company of Allied World. All Rights Reserved.Anne Huben-Kearney, R.N., B.S.N., M.P.A., is the assistant vice president of the Risk Management Group, AWAC Services Company, a member company of Allied World. ISSUES NewArchived

Important Considerations for the Institutional Review Board When Granting Health Insurance Portability and Accountability Act Authorization Waivers.

Background: Privacy is recognized as a basic human right in the United States and has been identified as a core principle of ethics in clinical research. However, changes in the regulations, changes in how research is conducted, and the availability of health data stored in electronic health record systems all pose risks to individuals’ privacy.Methods: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule addresses the use and disclosure of individuals’ health information and sets standards for privacy rights so that individuals can understand and control how their health information is used. However, despite the significant increase in the complexity of the data privacy landscape, the HIPAA Privacy Rule has been largely unchanged since its enactment in 1996.Results: Generally, healthcare entities may not use or disclose protected health information (PHI) for research without written authorization from each subject permitting that use or disclosure. However, the HIPAA Privacy Rule allows an institutional review board (IRB) to waive the need for such authorization if documentation is provided that the use or disclosure of PHI presents “no more than a minimal risk to the privacy” of the subjects. Because IRBs were one of the only bodies allowed to waive the need for authorizations in the research context, they essentially served as the gatekeepers of privacy for human subjects. However, this situation changed with the 2018 revisions to 45 CFR §46—known as the Common Rule—that added new categories of exempt research. Under the new regulations, research administrative staff may review a submitted research study and determine that it is exempt without the IRB ever being involved and with no independent review of privacy considerations. This change lessens privacy protections for research subjects. Therefore, IRBs must be mindful of the relevant HIPAA guidance and carefully consider all facts and circumstances available when granting approvals of HIPAA authorization waiver requirements, especially in the content of exempt research, so that the IRB is confident that reasonable safeguards to protect patient privacy have been maintained. Research institutions should amend their processes to ensure that the appropriate level of privacy review is given to all studies, even those that are exempt.Conclusion: Few concrete rules are applicable in the research context that ensure compliance with the HIPAA Privacy Rule. Ultimately, more definitive regulatory guidance integrating HIPAA and the revised Common Rule should be promulgated.

Review of HIPAA, Part 1: History, Protected Health Information, and Privacy and Security Rules.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 has made an impact on the operation of health-care organizations. HIPAA includes 5 titles, and its regulations are complex. Many are familiar with the HIPAA aspects that address protection of the privacy and security of patients' medical records. There are new rules to HIPAA that address the implementation of electronic medical records. HIPAA provides rules for protected health information (PHI) and what should be protected and secured. The privacy rule regulates the use and disclosure of PHI and sets standards that an entity working with health data must follow to protect patients' private medical information. The HIPAA security rule complements the privacy rule and requires entities to implement physical, technical, and administrative safeguards to protect the privacy of PHI. This article-part 1 of a 2-part series-is a refresher on HIPAA, its history, its rules, its implications, and the role that imaging professionals play.

A Medical Examiner Wants Information. What’s Next?

Back to table of contents Previous article Next article Legal NewsFull AccessA Medical Examiner Wants Information. What’s Next?Moira WertheimerJ.D., R.N., C.P.H.R.M.Moira WertheimerSearch for more papers by this authorJ.D., R.N., C.P.H.R.M.Published Online:12 Jun 2017https://doi.org/10.1176/appi.pn.2017.6b10AbstractA young man is found deceased in a car in a nearby park, and there does not appear to be any foul play involved. A search of the victim’s car reveals some drug paraphernalia and an empty prescription bottle containing medicine that you prescribed. The medical examiner contacts you and requests the records of your last three visits with the patient and a list of all medications you prescribed. You are not sure if you are permitted to release the requested mental health information.Unfortunately, there may come a time in your psychiatry practice when one of your patients becomes a medical examiner (ME) case. When this happens, you may receive a request for information from the ME regarding your recent treatment and/or any medications you may have prescribed. The request may or may not come in the form of a subpoena, and often it may come via an email or telephone call. In addition, in some jurisdictions the request may come from a coroner as opposed to an ME. “Coroner” and “ME” are discrete titles (often used interchangeably) referring to individuals who complete somewhat similar roles, but they may have very different training and qualifications. Some jurisdictions may use a coroner system to investigate and determine a cause of death. The federal privacy laws discussed below do not distinguish between ME requests or coroner requests for information. For the purposes of this discussion, I am using the term ME. Under most state laws, the ME, typically a physician, is charged with impartially investigating and subsequently certifying the cause or manner and circumstances of the patient’s death, that is, homicide, suicide, accident, natural, or undetermined. As such, the ME may seek information from treating physicians to prepare a record of facts surrounding the patient’s cause of death. Keep in mind that an inquiry from the ME does not necessarily mean he or she is evaluating the treatment provided.As you know, federal and state privacy laws govern when and how protected health information (PHI) may be released absent specific patient consent, including PHI of a deceased patient. The Health Insurance Portability and Accountability Act (HIPAA) does not treat psychiatric information differently from other health information (except for heightened protection against disclosure of psychotherapy notes). As such, under HIPAA, a psychiatrist may disclose PHI to the ME to assist with identifying the deceased, determining the cause of death, and carrying out “other duties as authorized by law.” Similarly, 42 CFR Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records, permits disclosure of PHI when requested by the ME.In addition to the federal HIPAA and Part 2 regulations, you must also determine whether your state’s privacy laws permit you to release the requested information. Many states’ privacy laws afford greater protection against disclosure than HIPAA or Part 2 protections. When there is a difference between federal and state confidentiality protections, deference should be given to the law affording greater protection against disclosure without patient consent. Please consult with your local attorney or risk management professional to determine whether you may release PHI in response to the ME’s request. ■This information is provided as a risk management resource and should not be construed as legal, technical, or clinical advice. This information may refer to specific local regulatory or legal issues that may not be relevant to you. Consult your professional advisors or legal counsel for guidance on issues specific to you. This material may not be reproduced or distributed without the express, written permission of Allied World Assurance Company Holdings, AG (“Al-lied World”). Risk management services are pro-vided by or arranged through AWAC Services Company, a member company of Allied World.Moira Wertheimer, J.D., R.N., C.P.H.R.M., is assistant vice president of the Psychiatric and Healthcare Risk Management Group of AWAC Services Co., a member company of Allied World. ISSUES NewArchived

Cloudy.

Cloudy.

A Matter of Trust: The Cost of HIPAA Non-Compliance

A Matter of Trust: The Cost of HIPAA Non-Compliance

Managing protected health information in distributed research network environments: automated review to facilitate collaboration

BackgroundMulti-site health sciences research is becoming more common, as it enables investigation of rare outcomes and diseases and new healthcare innovations. Multi-site research usually involves the transfer of large amounts of research data between collaborators, which increases the potential for accidental disclosures of protected health information (PHI). Standard protocols for preventing release of PHI are extremely vulnerable to human error, particularly when the shared data sets are large.MethodsTo address this problem, we developed an automated program (SAS macro) to identify possible PHI in research data before it is transferred between research sites. The macro reviews all data in a designated directory to identify suspicious variable names and data patterns. The macro looks for variables that may contain personal identifiers such as medical record numbers and social security numbers. In addition, the macro identifies dates and numbers that may identify people who belong to small groups, who may be identifiable even in the absences of traditional identifiers.ResultsEvaluation of the macro on 100 sample research data sets indicated a recall of 0.98 and precision of 0.81.ConclusionsWhen implemented consistently, the macro has the potential to streamline the PHI review process and significantly reduce accidental PHI disclosures.

Confidentiality: An Essential Element of Professionalism

W683 words, should uphold a principle of discretion in all dealings with others, even in private life. Such discretion should constitute an integral part of a physician’s character, not just a pose physicians adopt when they don their white coats each morning. More recently, the principle of confidentiality has received considerable attention in connection with the HIPAA of 1996 [3]. Title II of this legislation includes the Privacy Rule, which establishes regulations for the use and disclosure of protected health information (PHI), which includes information about health status, health care, or payment for health care that can be linked to a specific person through name, medical record number, social security number, address, telephone number, and so on. Concerns in these areas are heightened in the era of electronic medical records, which make PHI more widely accessible [4]. According to HIPAA, health professionals and health care organizations may disclose PHI only if they have obtained prior authorization from the individual concerned. They must document their privacy policies and procedures and keep track of such disclosures. In addition, they must train the members of their workforce in the policies and procedures concerning PHI. Suspected breaches in the protection of PHI are to be reported to the local privacy official and ultimately to the Office for Civil Rights in the Department of Health and Human Services. Recently, the University of California, Los Angeles (UCLA) agreed to a settlement of $865,000 in a case involving repeated violations of PHI by unauthorized employees [5]. Confidentiality: An Essential Element of Professionalism

Patients’ Confidentiality

Critical care providers are often privy to confidential information in the course of clinical practice. A dilemma can arise when confidential information is requested by family members or friends of the patient. Critical care nurses must be aware of the regulations regarding confidentiality, as well as situations where the use and disclosure of protected health information are permitted.

Medicine and the Media: Balancing the Public's Right to Know With the Privacy of the Patient

The discussion surrounding the release of celebrity health information to the media is not a new issue for health care professionals to consider. The rapid dissemination of updates concerning the health of a “public person” is now available to a wide audience through Internet communication and social media systems. The “appetite” of the news organizations and the public at large to obtain “breaking news” on a medical topic of interest involving a recognized political figure, sports star, or entertainer needs to be carefully weighed against the current laws intended to protect the privacy of the individual. Minute-by-minute, no longer day-to-day, updates seem essential through a variety of media, including a mobile phone and other handheld electronic devices. Competition between news services has only increased the demand for the latest news. Regrettably, the more sensational and potentially unbelievable the health-related news story, the more likely it will be distributed faster and farther to a larger audience using contemporary electronic media. Two fairly recent events provide reason to pause and consider both the legal and the ethical standards involved in release of medical information by health care professionals. The tragic shooting of Congresswoman Gabrielle Giffords on January 8, 2011, captured the attention and concern of individuals throughout the world. She was one of 19 victims of this mass shooting, and there were 6 fatalities. Treating physicians were quick to reveal information regarding her condition to a shocked public. Regular updates on the nature of her injuries and the progress of her recovery were provided to an absorbed press trying to offer answers to a gripped national and international audience. According to separate reports, Ms Giffords’ husband, Astronaut Mark Kelly, gave the University Medical Center in Tucson, AZ, permission to disclose certain facts relevant to her progress and prognosis.1 A spokesperson for the hospital stated that any of the information released to the press would be discussed before-hand with her family.1 Despite Mr Kelly’s approval, some privacy experts remained surprised at the amount and type of health care data the press were privy to. Included were concerns of whether Ms Giffords herself would have approved of having so many medical and personal details being shared with a wide audience.1 Compared to Congresswoman Gabrielle Giffords’ extensive media exposure, the release of health information to the press surrounding the serious medical condition of Steve Jobs (CEO of Apple Inc) was far more reserved. Mr Jobs gave permission to release further information to the public several days after a Wall Street Journal article reported that he had received a liver transplant 2 months previously.2 During a June 2009 press release, the head of transplantation James D. Eason, MD, of the University of Tennessee Health Science Center, acknowledged that Mr Jobs had earlier undergone a liver transplant at that institution.3 The release detailed his progression through the United Network for Organ Sharing system as well as limited information about his present condition and prognosis.3 The report finished with a statement confirming that the “hospital respect[s] and protect[s] every patient’s private health information and cannot reveal any further information on the specifics of Mr Jobs’ case.”3 On August 24, 2011, Mr Jobs resigned his leadership position, indicating he “could no longer meet my duties and expectations as Apple’s CEO.”4 No further information was provided regarding this decision.4 The current article will explore the tort law and constitutional restrictions placed on the disclosure of information into the public forum. This will lay the framework for a discussion related to the exchange of health care information. Both ethical and legal standards are described with emphasis on the important role of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Privacy Act Basics for Private Practitioners

Privacy Act Basics for Private Practitioners

HIPAA Privacy Regulations

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) impacts all health-care professionals, including speech-language pathologists (SLPs). The administration simplification section of HIPAA includes specific regulations designed to protect the privacy of an individual's health records. These privacy regulations are not designed to impede upon essential health-care practices, but do require that covered providers take reasonable steps to limit the use and disclosure of protected health information. Important aspects of the privacy regulations include the development of facility- or practice-specific privacy policies, the development of a privacy manual, staff training on privacy policies and procedures, and the drafting and posting of a notice of privacy practices. In addition, authorization forms are mandated for instances of use and disclosure of public health information not related to treatment, payment, or health-care operations.

HIPAA: Impact on Clinical Practice

HIPAA: Impact on Clinical Practice

Photographic images, digital imaging, dermatology, and the law

Patient photographic images play an important role in medical record keeping and training. They are particularly important in ophthalmology, dermatology and plastic surgery. Digital photography has made such imaging more accessible. However, an assessment of the legal implications of image taking is necessary to use images properly. This article summarizes some of the legal issues. Specifically, it discusses the image as part of the medical record, images as medical evidence, and implications of the Health Information Portability Accountability Act (HIPAA) of imaging. Indeed, images are part of the medical record and must be treated with the same care as written medical records. Because multiple digital images are sometimes taken and digital images can be easily manipulated, they present novel issues in this regard. Images can be used as evidence in court. Issues regarding digital images include authentication, manipulation, audit trail verification, and data compression. HIPPA requires that health care providers control and track those who have access to identifiable digital medical information. This should facilitate the use of digital images as evidence because the provenance of digital images can be established. HIPPAA covers the use and disclosure of protected health information, such as “full-face photographic images and any comparable images.” To publish identifiable digital images (images of the face), it seems prudent for patients to waive in writing their rights to this protected health information. Images will continue to enhance medical care, and understanding and accounting for the legal underpinnings of their use is prudent.—Valerie Biousse

Photographic Images, Digital Imaging, Dermatology, and the Law

Patient photographic images play an important role in dermatological record keeping and training. An assessment of the legal implications of image taking is necessary to use images properly. Images are parts of the medical record and must be treated with the same care as written medical records. Because multiple digital images are sometimes taken and digital images can be easily manipulated, they present novel issues in this regard. Images can be used as evidence in court. Issues regarding digital images include (1). authentication, (2). manipulation, (3). audit trail verification, and (4). data compression. The Health Information Portability and Accountability Act requires that health care providers control and track those who have access to identifiable digital medical information. This should facilitate the use of digital images as evidence because the provenance of digital images can be established. The Health Information Portability and Accountability Act covers the use and disclosure of protected health information, such as "full-face photographic images and any comparable images." To publish identifiable digital images (images of the face), it seems prudent for patients to waive in writing their rights to this protected health information. Conclusion Images will continue to enhance dermatological care, and understanding and accounting for the legal underpinnings of their use is prudent.