Clinical photography is a valuable tool for physicians. Smartphones, as well as other devices supporting network connectivity, offer a convenient, efficient method to take and share images. However, due to the private nature of the information contained in clinical photographs there are concerns as to the appropriate storage, dissemination, and documentation of clinical images. Confidentiality of image data must be considered and the dissemination of these images onto servers must respect the privacy and rights of the patient. Importantly, patient information should be considered as any information deriving from a patient, and the concepts outlined therefore apply to any media that can be collected on, or transmitted with, a smart-device.
Clinical photography can aid in documenting form and function, in tracking conditions and wound healing, in planning surgical operations, and in clinical decision-making. Additionally, clinical photographs can provide physicians with a valuable tool for patient communication and education. Due to the convenience of this type of technology it is not appropriate to expect physicians to forego their use in providing their patients with the best care available.
The technology and software required for secure transfer, communication, and storage of clinical media is presently available, but many devices have non-secure storage/dissemination options enabled and lack user-control for permanently deleting digital files. In addition, data uploaded onto server systems commonly cross legal jurisdictions. Many physicians are not comfortable with the practice, citing security, privacy, and confidentiality concerns as well as uncertainty in regards to regional regulations governing this practice.1 Due to concern for patient privacy and confidentiality it is therefore incredibly important to limit the unsecure or undocumented acquisition or dissemination of clinical photographs.
To assess the current state of this topic, Heyns et al. have reviewed the accessibility and completeness of provincial and territorial medical regulatory college guidelines.2 Categories identified as vital and explored in this review included: Consent; Storage; Retention; Audit; Transmission; and Breach. While each regulatory body has addressed limited aspects of the overall issue, the authors found a general lack of available information and call for a unified document outlining pertinent instructions for conducting clinical photography using a smartphone and the electronic transmission of patient information.2
The discussion of this topic will need to be ongoing and it is important that physicians are aware of applicable regulations, both at the federal and provincial levels, and how these regulations may impact the use of personal devices. The best practices supported here aim to provide physicians and healthcare providers with an understanding of the scope and gravity of the current environment, as well as the information needed to ensure patient privacy and confidentiality is assessed and protected while physicians utilize accessible clinical photography to advance patient care. Importantly, this document only focusses on medical use (clinical, academic, and educational) of clinical photography and, while discussing many core concepts of patient privacy and confidentiality of information, should not be perceived as a complete or binding framework. Additionally, it is recommended that physicians understand the core competencies of clinical photography, which are not described here.
The Canadian Medical Association (CMA) suggests that the following recommendations be implemented, as thoroughly as possible, to best align with the CMA policy on the Principles for the Protection of Patient Privacy (CMA Policy PD2018-02). These key recommendations represent a non-exhaustive set of best practices - physicians should seek additional information as needed to gain a thorough understanding and to stay current in this rapidly changing field.
* Informed consent must be obtained, preferably prior, to photography with a mobile device. This applies for each and any such encounter and the purpose made clear (i.e. clinical, research, education, publication, etc.). Patients should also be made aware that they may request a copy of a picture or for a picture to be deleted.
* A patient's consent to use electronic transmission does not relieve a physician of their duty to protect the confidentiality of patient information. Also, a patient's consent cannot override other jurisdictionally mandated security requirements.
* All patient consents (including verbal) should be documented. The acquisition and recording of patient consent for medical photography/dissemination may be held to a high standard of accountability due to the patient privacy and confidentiality issues inherent in the use of this technology. Written and signed consent is encouraged.
* Consent should be considered as necessary for any and all photography involving a patient, whether or not that patient can be directly recognized, due to the possibility of linked information and the potential for breach of privacy. The definition of non-identifiable photos must be carefully considered. Current technologies such as face recognition and pattern matching (e.g. skin markers, physical structure, etc.), especially in combination with identifying information, have the potential to create a privacy breach.
* Unsecure text and email messaging requires explicit patient consent and should not be used unless the current gold standards of security are not accessible. For a patient-initiated unsecure transmission, consent should be clarified and not assumed.
* Transmission of photos and patient information should be encrypted as per current-day gold standards (presently, end-to-end encryption (E2EE)) and use only secure servers that are subject to Canadian laws. Explicit, informed consent is required otherwise due to privacy concerns or standards for servers in other jurisdictions. Generally, free internet-based communication services and public internet access are unsecure technologies and often operate on servers outside of Canadian jurisdiction.
* Efforts should be made to use the most secure transmission method possible. For data security purposes, identifying information should never be included in the image, any frame of a video, the file name, or linked messages.
* The sender should always ensure that each recipient is intended and appropriate and, if possible, receipt of transmission should be confirmed by the recipient.
* Storing images and data on a smart-device should be limited as much as possible for data protection purposes.
* Clinical photos, as well as messages or other patient-related information, should be completely segregated from the device's personal storage. This can be accomplished by using an app that creates a secure, password-protected folder on the device.
* All information stored (on internal memory or cloud) must be strongly encrypted and password protected. The security measures must be more substantial than the general password unlock feature on mobile devices.
* Efforts should be made to dissociate identifying information from images when images are exported from a secure server. Media should not be uploaded to platforms without an option for securely deleting information without consent from the patient, and only if there are no better options. Automatic back-up of photos to unsecure cloud servers should be deactivated. Further, other back-up or syncing options that could lead to unsecure server involvement should be ascertained and the risks mitigated.
4. Cloud storage should be on a Canadian and SOCII certified server. Explicit, informed consent is required otherwise due to privacy concerns for servers in other jurisdictions.
5. AUDIT & RETENTION
* It is important to create an audit trail for the purposes of transparency and medical best practice. Key information includes patient and health information, consent type and details, pertinent information regarding the photography (date, circumstance, photographer), and any other important facts such as access granted/deletion requests.
* Access to the stored information must be by the authorized physician or health care provider and for the intended purpose, as per the consent given. Records should be stored such that it is possible to print/transfer as necessary.
* Original photos should be retained and not overwritten.
* All photos and associated messages may be considered part of the patient's clinical records and should be maintained for at least 10 years or 10 years after the age of majority, whichever is longer. When possible, patient information (including photos and message histories between health professionals) should be retained and amalgamated with a patient's medical record. Provincial regulations regarding retention of clinical records may vary and other regulations may apply to other entities - e.g. 90 years from date of birth applies to records at the federal level.
* It may not be allowable to erase a picture if it is integral to a clinical decision or provincial, federal, or other applicable regulations require their retention.
* Any breach should be taken seriously and should be reviewed. All reasonable efforts must be made to prevent a breach before one occurs. A breach occurs when personal information, communication, or photos of patients are stolen, lost, or mistakenly disclosed. This includes loss or theft of one's mobile device, texting to the wrong number or emailing/messaging to the wrong person(s), or accidentally showing a clinical photo that exists in the phone's personal photo album.
* It should be noted that non-identifying information, when combined with other available information (e.g. a text message with identifiers or another image with identifiers), can lead to highly accurate re-identification.
* At present, apps downloaded to a smart-device for personal use may be capable of collecting and sharing information - the rapidly changing nature of this technology and the inherent privacy concerns requires regular attention. Use of specialized apps designed for health-information sharing that help safeguard patient information in this context is worth careful consideration.
* Having remote wipe (i.e. device reformatting) capabilities is an asset and can help contain a breach. However, inappropriate access may take place before reformatting occurs.
* If a smartphone is strongly encrypted and has no clinical photos stored locally then its loss may not be considered a breach.
* In the event of a breach any patient potentially involved must be notified as soon as possible. The CMPA, the organization/hospital, and the Provincial licensing College should also be contacted immediately. Provincial regulations regarding notification of breach may vary.
Approved by the CMA Board of Directors March 2018
i Heyns M†, Steve A‡, Dumestre DO‡, Fraulin FO‡, Yeung JK‡
† University of Calgary, Canada
‡ Section of Plastic Surgery, Department of Surgery, University of Calgary, Canada
1 Chan N, Charette J, Dumestre DO, Fraulin FO. Should 'smart phones' be used for patient photography? Plast Surg (Oakv). 2016;24(1):32-4.
2 Unpublished - Heyns M, Steve A, Dumestre DO, Fraulin FO, Yeung J. Canadian Guidelines on Smartphone Clinical Photography.
COMPLEMENTARY AND ALTERNATIVE MEDICINE
This statement discusses the Canadian Medical Association's (CMA) position on complementary and alternative medicine (CAM). CAM, widely used in Canada, is increasingly being subject to regulation. The CMA's position is based on the fundamental premise that decisions about health care interventions used in Canada should be based on sound scientific evidence as to their safety, efficacy and effectiveness - the same standard by which physicians and all other elements of the health care system should be assessed. Patients deserve the highest standard of treatment available, and physicians, other health practitioners, manufacturers, regulators and researchers should all work toward this end. All elements of the health care system should "consider first the well-being of the patient."1 The ethical principle of non-maleficence obliges physicians to reduce their patient's risks of harm. Physicians must constantly strive to balance the potential benefits of an intervention against its potential side effects, harms or burdens. To help physicians meet this obligation, patients should inform their physician if the patient uses CAM.
CAM in Canada
CAM has been defined as "a group of diverse medical and health care systems, practices and products that are not presently considered to be part of conventional medicine."i This definition comprises a great many different, otherwise unrelated products, therapies and devices, with varying origins and levels of supporting scientific evidence. For the purpose of this analysis, the CMA divides CAM into four general categories:
* Diagnostic Tests: Provided by CAM practitioners. Unknown are the toxicity levels or the source of test material, e.g., purity. Clinical sensitivity, specificity, and predictive value should be evidence-based.
* Products: Herbal and other remedies are widely available over-the-counter at pharmacies and health food stores. In Canada these are regulated at the federal level under the term Natural Health Products.
* Interventions: Treatments such as spinal manipulation and electromagnetic field therapy may be offered by a variety of providers, regulated or otherwise.
* Practitioners: There are a large variety of practitioners whose fields include chiropractic, naturopathy, traditional Chinese and Ayurvedic medicine, and many others. Many are unregulated or regulated only in some provinces/territories of Canada.
Many Canadians have used, or are currently using, at least one CAM modality. A variety of reasons has been cited for CAM use, including: tradition; curiosity; distrust of mainstream medicine; and belief in the "holistic" concept of health which CAM practitioners and users believe they provide. For most Canadians the use is complementary (in addition to conventional medicine) rather than alternative (as a replacement). Many patients do not tell their physicians that they are using CAM.
Toward Evidence-Informed Health Care
Use of CAM carries risks, of which its users may be unaware. Indiscriminate use and undiscriminating acceptance of CAM could lead to misinformation, false expectations, and diversion from more appropriate care, as well as adverse health effects, some of them serious.
The CMA recommends that federal, provincial and territorial governments respond to the health care needs of Canadians by ensuring the provision of clinical care that continually incorporates evidence-informed technological advances in information, prevention, and diagnostic and therapeutic services.2 Physicians take seriously their duty to advocate for quality health care and help their patients choose the most beneficial interventions. Physicians strongly support the right of patients to make informed decisions about their medical care. However, the CMA's Code of Ethics requires physicians to recommend only those diagnostic and therapeutic procedures that they consider to be beneficial to the patient or to others.3 Until CAM interventions are supported by scientifically-valid evidence, physicians should not recommend them. Unless proven beneficial, CAM services should not be publicly funded. To help ensure that Canadians receive the highest-quality health care, the CMA recommends that CAM be subject to rigorous research on its effects, that it be strictly regulated, and that health professionals and the public have access to reliable, accurate, evidence-informed information on CAM products and therapies. Specific recommendations are provided below:
a) Research: Building an Evidence Base
To date, much of the public's information on CAM has been anecdotal, or founded on exaggerated claims of benefit based on few or low-quality studies. The CMA is committed to the principle that, before any new treatment is adopted and applied by the medical profession, it must first be rigorously tested and recognized as evidence-informed.4 Increasingly, good-quality, well-controlled studies are being conducted on CAM products and therapies. The CMA supports this development. Research into promising therapies is always welcome and should be encouraged, provided that it is subject to the same standards for proof and efficacy as those for conventional medical and pharmaceutical treatments. The knowledge thus obtained should be widely disseminated to health professionals and the public.
b) An Appropriate Regulatory Framework
Regulatory frameworks governing CAM, like those governing any health intervention, should enshrine the concept that therapies should have a proven benefit before being represented to Canadians as effective health treatments.
i) Natural Health Products. Natural health products are regulated at the federal level through the Natural Health Products Directorate of Health Canada.
The CMA believes that the principle of fairness must be applied to the regulatory process so that natural health products are treated fairly in comparison with other health products.5 The same regulatory standards should apply to both natural health products and pharmaceutical health products. These standards should be applied to natural health products regardless of whether a health claim is made for the product. This framework must facilitate the entry of products onto the market that are known to be safe and effective, and impede the entry of products that are not known to be safe and effective until they are better understood. It should also ensure high manufacturing standards to assure consumers of the products' safety, quality and purity. The CMA also recommends that a series of standards be developed for each natural health product. These standards should include:
* manufacturing processes that ensure the purity, safety and quality of the product;
* labelling standards that include standards for consumer advice, cautions and claims, and explanations for the safe use of the product to the consumer.6
The CMA recommends that safety and efficacy claims for natural health products be evaluated by an arm's length scientific panel, and claims for the therapeutic value of natural health products should be prohibited when the supportive evidence does not meet the evidentiary standard required of medications regulated by Health Canada.7 Claims of medical benefit should only be permitted when compelling scientific evidence of their safety and efficacy exists.8
The Canadian Medical Association advocates that foods fortified with "natural health" ingredients should be regulated as food products and not as natural health products
The CMA recommends that the regulatory system for natural health products be applied to post-marketing surveillance as well as pre-marketing regulatory review. Health Canada's MedEffect adverse reaction reporting system now collects safety reports on Natural Health Products. Consumers, health professionals and manufacturers are encouraged to report adverse reactions to Health Canada.
ii) CAM Practitioners. Regulation of CAM practitioners is at different stages. The CMA believes that this regulation should: ensure that the services CAM practitioners offer are truly efficacious; establish quality control mechanisms and appropriate standards of practice; and work to develop an evidence-informed body of competence that develops with evolving knowledge.
Just as the CMA believes that natural health products should be treated fairly in comparison with other health products, it recommends that CAM practitioners be held to the same standards as other health professionals. All CAM practitioners should develop Codes of Ethics that insure practitioners consider first the best interests of their patients.
Among other things, associations representing CAM practitioners should develop and adhere to conflict of interest guidelines that require their members to:
* Resist any influence or interference that could undermine their professional integrity;9
* Recognize and disclose conflicts of interest that arise in the course of their professional duties and activities, and resolve them in the best interests of patients;10
* Refrain, for the most part, from dispensing the products they prescribe. Engaging in both prescribing and dispensing , whether for financial benefit or not, constitutes a conflict of interest where the provider's own interests conflict with their duty to act in the best interests of the patient.
c) Information and Promotion
Canadians have the right to reliable, accurate information on CAM products and therapies to help ensure that the treatment choices they make are informed. The CMA recommends that governments, manufacturers, health care providers and other stakeholders work together to ensure that Canadians have access to this information. The CMA believes that all natural health products should be labeled so as to include a qualitative list of all ingredients. 11 Information on CAM should be user-friendly and easy to access, and should include:
* Instructions for use;
* Indications that the product or therapy has been convincingly proven to treat;
* Contraindications, side effects and interactions with other medications;
* Should advise the consumer to inform their health care provider during any encounter that they are using this product.12
This information should be provided in such a way as to minimize the impact of vested commercial interests on its content.
In general, brand-specific advertising is a less than optimal way of providing information about any health product or therapy. In view of our limited knowledge of their effectiveness and the risks they may contain risks, the advertising of health claims for natural health products should be severely restricted. The CMA recommends that health claims be promoted only if they have been established with sound scientific evidence. This restriction should apply not only to advertising, but also to all statements made in product or company Web sites and communications to distributors and the public. Advertisements should be pre-cleared to ensure that they contain no deceptive messages. Sanctions against deceptive advertising must be rigidly enforced, with Health Canada devoting adequate resources to monitor and correct misleading claims.
The CMA recommends that product labels include approved health claims, cautions and contraindications, instructions for the safe use of the product, and a recommendation that patients tell physicians that they are using the products. If no health claims are approved for a particular natural health product, the label should include a prominent notice that there is no evidence the product contributes to health or alleviates disease.
The Role of Health Professionals
Whether or not physicians and other health professionals support the use of CAM, it is important that they have access to reliable information on CAM products and therapies, so that they can discuss them with their patients.
Patients should be encouraged to report use of all health products, including natural health products, to health care providers during consultations. The CMA encourages Canadians to become educated about their own health and health care, and to appraise all health information critically.
The CMA will continue to advocate for evidence-informed assessment of all methods of health care in Canada, and for the provision of accurate, timely and reliable health information to Canadian health care providers and patients.
i Working definition used by the National Center for Complementary and Alternative Medicine of the U.S. National Institutes of Health.
1 Canadian Medical Association. CMA code of ethics (update 2004). Ottawa: The Association; 2004.
2 Canadian Medical Association. Policy resolution GC00-196 - Clinical care to incorporate evidence-based technological advances. Ottawa (ON): The Association; 2000. Available: http://policybase.cma.ca/dbtw-wpd/CMAPolicy/PublicB.htm.
3 Canadian Medical Association. CMA code of ethics (update 2004). Ottawa: The Association; 2004. Available: http://policybase.cma.ca/dbtw-wpd/CMAPolicy/PublicB.htm.
4 Canadian Medical Association. CMA statement on emerging therapies [media release]. Ottawa (ON): The Association; 2010. Available: www.facturation.net/advocacy/emerging-therapies.
5 Canadian Medical Association. CMA statement on emerging therapies [media release]. Available: www.facturation.net/advocacy/emerging-therapies.
6 Canadian Medical Association. Brief BR1998-02 - Regulatory framework for natural health products. Ottawa (ON): The Association; 1998.
7 Canadian Medical Association. Policy resolution GC08-86 - Natural health products. Ottawa (ON): The Association; 2008.
8 Canadian Medical Association. Policy resolution GC10-100 - Foods fortified with "natural health" ingredients. Ottawa (ON): The Association; 2010. Available:
9 Canadian Medical Association. CMA code of ethics (update 2004). Ottawa: The Association; 2004. Paragraph 7. Available: http://policybase.cma.ca/dbtw-wpd/CMAPolicy/PublicB.htm.
10 Canadian Medical Association. CMA code of ethics (update 2004). Ottawa: The Association; 2004. Paragraph 11. Available: http://policybase.cma.ca/dbtw-wpd/CMAPolicy/PublicB.htm.
11 Canadian Medical Association. Brief BR1998-02 - Regulatory framework for natural health products. Ottawa: The Association; 1998.
12 Canadian Medical Association. Brief BR1998-02 - Regulatory framework for natural health products. Ottawa: The Association; 1998.