united-states medical
Kicked out of doctors office for refusing to allow them to take pictures. is this legal?
<p>I moved this post off the medical stack exchange as it was flagged as off topic so hopefully this is the proper place for it.</p>

<p>I have a problem with a thumbnail that has been lingering for months now and I finally decided to make an appointment with a dermatologist. I called, made the appointment, filled out the paperwork, etc. I showed up for the appointment and all was normal, scanned my drivers license, took my co-pay and confirmed my medical history. They called my name and took me back to the room and the assistant asked to take a front and side picture of my face. I noticed a screen on the wall showing before/after shots of patients facial problems so I told the assistant that I was there for my thumb not any facial issues and she said it was for their records. I said I didn't mind if she took a picture of my thumb but that I didn't see any reason to take pictures of my face. Her tone immediately changed and she quickly finished the interview and left the room. A few minutes later a women walked in and introduced herself as the office manager and explained to me that it was their policy to take pictures of patients for "security reasons" and that I would be refused service if I did not comply. I politely told her I understand she has to follow her policies and asked for a refund of my co-pay which she provided then I left the office. Can a doctor legally do this? Is this a violation of HIPAA? If so where would I file a complaint?</p>

<p>The "Privacy Rule" (<a href="https://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title45/45cfr160_main_02.tpl" rel="noreferrer">45 CFR Part 160</a> and Part 164, <a href="https://www.ecfr.gov/cgi-bin/text-idx?tpl=/ecfrbrowse/Title45/45cfr164_main_02.tpl" rel="noreferrer">Subparts A, E</a>) don't forbid this. Sect. 164.502 states the general rule:</p>

<blockquote>
  <p>(a) Standard. A covered entity or business associate may not use or
  disclose protected health information, except as permitted or required
  by this subpart or by subpart C of part 160 of this subchapter.</p>
</blockquote>

<p>"Health information" is defnes in part 160 as</p>

<blockquote>
  <p>any information, including genetic information, whether oral or
  recorded in any form or medium, that:</p>
  
  <p>(1) Is created or received by a health care provider, health plan,
  public health authority, employer, life insurer, school or university,
  or health care clearinghouse; and</p>
  
  <p>(2) Relates to the past, present, or future physical or mental health
  or condition of an individual; the provision of health care to an
  individual; or the past, present, or future payment for the provision
  of health care to an individual.</p>
</blockquote>

<p>Your picture would not constitute health information (and anyhow, they are allowed to gather health information, just not freely disseminate it – the pictures on the wall were presumably with permission).</p>

<p>There is no general law (which would be state law) against taking a person's picture (though commercially exploiting someone's picture would require permission, via the concept of <a href="https://law.stackexchange.com/questions/11208/what-recourse-do-i-have-against-commercial-use-of-my-image/11212#11212">personality rights</a>), and it is directly required in a number of instances (for identification purposes – school ID, driver's license, passport, voting in some states). It is an unusual requirement and since they scanned your driver's license it is especially inexplicable. Assuming that this is just a story they tell all patients because they want before and after pictures (which you would have to consent to, if you didn't already in one of those "sign here" flurries), saying that this is for "security purposes" would be untrue, but I don't think it's actually illegal. Taking but not using a photo would not cause you harm, so if you had let them take the picture, there would not be a basis for suing. If they use it for advertising without permission, that would be a problem.</p>

<p>I once was able to speak directly with an HHS attorney. She stated that HHS would consider any information that connected patients to a specific doctor would be considered to be PHI. IOW, if others could reasonably infer that you were getting treatment from that doctor, then yes, that would be a breach of PHI. In addition, the doctor would also be in violation of HIPAA for not self-reporting the breach.</p>

<p>Regarding being 'ejected' - the question is - is a doctor required to treat all persons who request treatment? The answer is no. Doctors can decide to not take pretty much anyone, even for arbitrary reasons.</p>
