The Australian Medical Association Limited and state AMA entities comply with the Privacy Act 1988. Please refer to the AMA Privacy Policy to understand our commitment to you and information on how we store and protect your data.




Use and disclosure of clinical images

As with any health information, a doctor should only use and/or disclose clinical images in accordance with relevant privacy legislation and/or a hospital’s policies. In
general, this means that clinical images should only be used and/or disclosed:

  • for the direct or primary purpose for which they were collected;
  • for a secondary purpose closely related to the direct or primary purpose;
  • in accordance with the patient’s consent (if the use and disclosure is different from the direct or secondary purpose); or
  • where permitted by law – that is, the use and disclosure falls within an exemption under the relevant privacy legislation.

The direct or primary purpose is the purpose (or purposes) the patient was informed about when he or she provided consent for the image to be collected. In the
health context, this would normally be related to the provision of clinical care and treatment, but it could be for medical research or training if this was explained to the patient when the image was collected.

Example: on presentation to the Emergency Department a clinical image of a facial lesion is taken as a record of the patient’s condition at the time. The direct purpose is to capture details of the patient’s lesion.

A secondary purpose closely related to the direct or primary purpose is one where the patient has a reasonable expectation that the clinical image would be used in this way. This covers the provision of clinical care, including sharing the image with a colleague to confirm diagnosis, treatment, and management.

Example: the clinical image of the facial lesion is sent to or shared with a dermatologist for advice on the appropriate treatment for the patient. Example of a use that would not be a secondary purpose: the clinical image of the facial lesion is stored in an identifiable form on the doctor’s smartphone. It is later emailed to another doctor who posts it on Facebook as a good example of that type of unusual lesion. The patient would not have reasonably expected that his clinical image would be used in this way.

To avoid any dispute about whether the use or disclosure of an image is in the reasonable expectation of a patient, it is advisable to inform the patient as to how
the image may be used when obtaining consent to take an image. This provides the patient with an opportunity to let you know if they object to such use.

Patient consent – a clinical image can be used or disclosed in a way that is different to its direct or secondary purpose where the patient consents to the clinical image being used or disclosed in this way. This consent should be documented.

Other circumstances where you may be able to use or disclose a clinical image

Circumstances may exist where you are allowed or required by law to disclose clinical images to third parties without patient consent. For example, to prevent a
serious threat to the safety or health of a patient or the public. However, you should always seek advice from your hospital management and, if necessary, consult with your medical defence organisation as to when these circumstances apply.

De-identification of clinical images 

Clinical images used for teaching, training, and research should be de-identified, where possible, and must comply with relevant research or ethical guidelines.
When de-identifying photographs, remember that seemingly insignificant features, such as tattoos, can still make a person identifiable to others. Even when all
identifying features are removed, sometimes the clinical condition itself may provide recognition - the rarer the clinical presentation, the more likely it may be identifiable.

Also remember that digital images may contain metadata that could be used to identify an individual, despite other identifiers being removed. This may include the
time/date of capture, the device that was used, and the GPS location of capture. Care should be taken to remove this data when de-identifying images.

Key Points to Remember

  • Before taking a clinical image, consider the purpose for which you require the image, and obtain appropriate consent.
  • Make sure the patient understands the reasons for taking the image, how it will be used and to whom it will be shown.
  • Document the consent process in the health record. Check what your health service/hospital requirements are for written consent.
  • Never send a clinical image to anyone else unless you have the patient’s consent to do so, or if the patient would reasonably expect you to send the image for the purpose of their clinical management, or if you are otherwise permitted by law to do so.
  • If the clinical image is sent to the wrong person, patient privacy has been breached. In these circumstances, you should seek advice from hospital management or your medical defence organisation.