A study of the personal use of digital photography within plastic surgery☆

Method 

An anonymous questionnaire was distributed to all surgical staff in the plastic surgery units at the Northern General Hospital, Sheffield, the Royal Infirmary Hospital, Leicester and the Royal Preston Hospital, Preston. The questionnaire was designed using guidelines set out in the UK Institute of Medical Illustrators model policy.6 The questions were theme-grouped to heighten cohesion,7 were closed-ended8 and available responses were on an adjectival scale containing an even number of possibilities.9 The survey was mapped to prevent respondents from answering unnecessary questions.

Results 

Responses were received from 42 of the 60 surgeons surveyed. Thirty surgeons had taken digital photographs of patients themselves. The first part of the study looked at the purpose for which images were taken and the process of gaining informed consent. The second part studied issues of patient confidentiality, image copyright and data protection.

Patient confidentiality, image copyright and data protection 

Appropriate steps should be taken to ensure patient anonymity when processing medical images.6, 10, 11, 12 Of the 25 surgeons who took images for teaching purposes, 17 took no extra measures to ensure the subject's anonymity, whilst eight used methods such as blanking or blurring the eyes or face. For images taken with the intention of publication, 14 respondents took no further measures, whilst nine also used similar measures, most commonly blanking or blurring the eyes or face.

The copyright of any image taken of a National Heath Service (NHS) patient on UK NHS Trust premises, irrespective of who takes the image, belongs to that NHS Trust.10 To investigate awareness of this, respondents were asked who they believed owned the copyright for images taken by themselves, with their own camera. Nine stated that they thought copyright rested with the clinician taking the photograph, 20 with the patient and five with the hospital and NHS Trust. Eight respondents did not know.

When submitting images for publication, journals frequently request that authors transfer copyright to the publisher. Thirty of the 42 surgeons correctly thought the publisher would own copyright of the image after publication. Of the 23 respondents who had submitted photographs for publication, two stated they always refuse transfer of copyright, two usually did, three rarely did and 16 never did.

Under UK legislation and in accordance with the seventh principle of the Data Protection Act13 all personal data should be stored in a secure manner. When asked where respondents stored images, 26 used their personal computer, 18 used their camera, and five their office computer. Seven surgeons printed hard copies for the patient's records. Regarding the security measures taken, 22 stated they were the only users of the computer, 18 password-protected their personal computer and two password-protected their image files.

The NHS Trust acts as the data controller for images taken of NHS patients on NHS property.10 In the UK the surgeon acts as the data controller for images of private patients and should register with the Information Commissioner's Office.14 Eight surgeons stated they had also taken digital photographs of patients in the private sector. Two of the respondents had notified the Information Commissioner of his role as a data controller. One respondent correctly renewed his application yearly.

Key points highlighted in the ‘Model policy’ issued by the UK Institute of Medical Illustrators are shown in Table 1.6

Table 1. Areas of importance highlighted within The Model Policy – The Institute of Medical Illustrators7

	1.	Consent to photography should be discussed at 3 levels:
		1. Illustration as part of the medical records.
		2. Illustration can be used as a teaching aid.
		3. Illustration can be used for publication.
	2.	Consent may be withdrawn (unless illustration has passed into the public domain).
	3.	Copyright of images of NHS patient's belongs to the Trust.
	4.	For publication, transfer of copyright should be refused.
	5.	Patient anonymity should be protected wherever possible.
	6.	The Trust acts as the Data Controller for images taken of NHS patients.
	7.	The Clinician acts as the Data Controller for images taken in the private sector.
	8.	Storage of images must be; traceable, retrievable and secure.

Discussion 

Although this is a small study representing the experiences of surgeons working in only three plastic surgery units, the results highlight a number of important points that will be of interest to all plastic surgeons using digital cameras at work. Thirty surgeons, over 70% of the respondents, were taking digital photographs of patients themselves using their own cameras.

The most common uses of digital images were for teaching and publication. The Data Protection Act states that personal information must be ‘fairly and lawfully processed’ (fifth principle) and this must be for ‘limited purposes’ only (second principle).13 The important practical point of this, is that if a clinician takes a photograph of a patient then they must be clear about the reason for doing this and this needs to be fully explained to the patient and the appropriate consent obtained.

Although the process of informed consent is generally known, as clinicians we must be specific about its purpose and stringent in its documentation. Consent to photography should be discussed on three levels: firstly, that the image is for the medical record; secondly, that it can be used in teaching; and thirdly, that it can be used for publication and subsequently be accessible within the public domain.6 This information is contained on proformas used in medical photography consent forms available in many units.15, 16 Patients can then choose which level of consent they wish to give. Implicit in the consent process should be an understanding that consent may be withdrawn at any time up until the point at which the information has passed, irretrievably, into the public domain.

The most common form of consent in this study was verbal. Although verbal discussion forms the basis of the consent process, it is preferable to supplement this in written form. It is best practice to have reproducible documentary evidence to support the surgeon's defence if the need arose. Other recently published studies have shown this to be a national trend.17 Many journals require written consent prior to publication and issue photography consent forms for patients to sign.18

Despite digital photographs being taken regularly and submitted for publication there was a lack of knowledge related to the copyright of these images. A photographic image of a NHS patient taken on NHS property, regardless of who takes the image, resides with the NHS Trust. Furthermore, because the NHS Trust owns the copyright, it is arguable that best practice suggests when submitting an image for publication, transfer of copyright to the publisher should be refused.10 Most respondents were unaware of this and subsequently have not taken this action in their previous practice. This presents a dilemma to a surgeon seeking publication of his work if a journal is resistant to accepting a paper for publication unless transfer of copyright is agreed.

Attempts to protect patient anonymity are recommended10 but in practice can be difficult. It has been suggested that the standard method of blacking out the eyes and face rarely achieves anonymity.11, 12 Instead it may be preferable to gain proper and full consent for publication of the photograph in its unedited form.

The seventh principle of the Data Protection Act states that data should be stored in a secure manner.10, 13, 19 This study did raise concerns about image storage and the security of stored images. Most surgeons taking digital photographs stored them on their personal computers, predominately laptops and transiently on their digital cameras. Sixty per cent of respondents had their computer universally password-protected but very few had any other security measures. There is justified concern that failure to store images securely increases the potential risks of breach in confidentiality secondary to loss, theft or misuse of cameras and personal computers.

Anyone acting in a private capacity within the UK and in control of handling personal information considered privy to confidentiality rights must legally register with the Information Commissioner's Office as a data controller.14 Whilst the NHS Trust acts as the Data Controller for images of NHS patients, so the surgeon must legally register as Data Controller in the private sector so he can ‘lawfully process’ personal information (including images). Just over a quarter of all respondents had taken photographs in the private sector but the majority were unaware of this requirement. Notification with the Information Commissioner can be done at a cost of £35 and should be renewed annually.20 The maximum penalty in the magistrates courts if found to be in breach of these regulations stands at a fine of £5000 plus costs and notification to the GMC.21

Any image that illustrates a patient's condition or aspect of their treatment constitutes part of their medical records and as such should be accorded the same standards of confidentiality and consent to disclosure as any written or dictated record.10 Clinical photographs and video recordings are the only forms of medical records that produce a recognisable image of a patient that may be instantly identifiable by a lay person.22, 23 Despite the opportunities offered by advances in digital image technology, plastic surgeons should be aware of the guidelines governing medical photography in their place of practice. In the UK, this equates to relevant parts of the Data Protection Act (1998)13 and the NHS Confidentiality code of practice and compliance to legislation and guidance issued by the European Commission.24 Although, presently, there is no specific national policy governing medical photography for individual medical practitioners, individuals and plastic surgery units may find the Institute of Medical Illustrators model policy and guidelines useful.6 Medical professionals need to keep up to date with the governing principles of medical photography if they wish to continue taking clinical images of patients themselves.