Contextual Integrity and Informed Consent: Providing Web Access to Images of Health and Medicine

1. Contextual Integrity and Informed Consent: Providing Web Access to Images of Health and Medicine Phoebe Evans Letocha The Johns Hopkins Medical Institutions pletocha@jhmi.edu

2. Primary use for education, healthcare, and research Utilize advances in photographic technology from 19th century photomicrography and portraiture to 21st century digital imagery Images of Health and Medicine 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

3. Risks to individual privacy • Exposure of images of the body may be source of embarrassment and discomfort • Revelation of health condition may be source of discrimination • Association of individual with images may be basis for societal stigmatization • Violations of privacy may have negative impact on property rights 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

4. Rights to Health Images of Celebrities • Right of Publicity • Based in state law • Property right controlling commercial use • Privacy interests to images of deceased celebrities held by their estates • Elvis Presley • Dale Earnhardt • Farrah Fawcett • Michael Jackson 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

5. HIPAA Privacy Rule and Archives • Defines criteria for protecting individual privacy • Application to archives dependent upon relationship to HIPAA covered entity • Provides an administrative framework for managing access and use of archival information in the Digital Age • Allows role-based access to archival records 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

6. Protected Health Information Any information in any form or medium, related to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or payment for health care; that identifies or can be used to identify the individual; and that is transmitted or maintained in any form or medium, including electronic, oral, or paper, by a covered entity.

7. names geographic subdivisions smaller than a state all elements of dates (except year) telephone numbers facsimile numbers electronic mail addresses social security numbers medical record numbers health plan beneficiary numbers account numbers certificate/license numbers vehicle identifiers and serial numbers device identifiers and serial numbers web universal resource locators (URLs) internet protocol (IP) address numbers biometric identifiers full-face photographic images Any other unique identifying number, characteristic, or code, unless otherwise permitted by the Privacy Rule for re-identification Set of 18 Identifiers that must be removed to de-identify health information 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

8. Online publication of archival images containing PHI is a form of re-disclosure that requires individual authorization HIPAA Privacy Rule covers PHI of the deceased as well as the living PHI exists in any format or media, including digital images Implications of HIPAA for online access to archival images 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

9. Options for Online Access Authorized access Individual authorization based on informed consent Role-based access through institutional authorization or waivers of authorization Screen and redact protected information As part of processing and description of holdings Screen on demand at time of request for access Reuse of previously published images 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

10. Patient authorization form Informed consent Specify acceptable use Ability to revoke authorization Authorization not a condition for treatment 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

11. Role-based access: A model for the Digital Age Helen Nissenbaum’s Construct of Contextual Integrity • Takes into account the context-relative informational norms • Modeled on security controls for computer systems • Designates roles for users • Limits access to authorized users • Takes into account role of users and need for information rather than restricting information itself 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

12. Harvard’s Visual Information Access Regulation of patient images Some images not available Thumbnail views for public web access Login required for full sized image view of patients 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

13. Researchers: Assessing their context Need to know and access the information Use of the information and dissemination Plan to protect sensitive information Relationship to the subjects Sensitivity of the information Risk to individuals 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

14. Best Practices De-identification • When identity of the individual is not relevant to any research interests • Remove the full face and other 18 identifiers of the individual subject of the PHI, or of relatives, employers, or household members of the individual • Consider the likelihood that remaining information may be used to re-identify a subject of the information 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

15. Challenge of redacting photographs • Redaction may diminish content and aesthetic value of the image AMCMA Item 117075 - [Helen Taussig, examining small girl in wheel chair, circa 1947] 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

16. Redacting PHI in photographs and film:What is protected • Identifiable images of patients when authorization/informed consent to release is in doubt • specific medical conditions • specific treatment • diagnosis specific setting 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

17. Identifying PHI in photographs and film:Acceptable risks to individuals • General waiting room or ward scenes without diagnosis • Vaccination and preventive medicine • Healthy child exams • Non-specific use of equipment, eg glasses, wheelchair • Previously published images 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

18. General waiting room or ward scenes without diagnosis AMCMA Item 49407 - [Johns Hopkins Hospital, Womens Ward G., circa 1920s]

19. Vaccination and preventive medicine AMCMA Item 104984 - [Carolyn Conant Van Blarcom, administering silver nitrate eye drops to infant] 1901-1904

20. Healthy child exams AMCMA Item 105005 - [Johns Hopkins Hospital nurses with pediatric patients in the Outpatient Department, circa 1923]

21. Non-specific use of equipment, eg glasses, wheelchair AMCMA Item 105028 - [Eight children (patients) with three nurses in playroom, circa 1930s]

22. Previously published images • Review context of original publication • Verify patient consent • Consider the sensitivity of the information and the potential harm in republication • Accept the risk

23. National Museum of Health and Medicine 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

24. NMHM @ flickr 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

25. NLM’s Images from the History of Medicine 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

26. CDC Public Health Image Library

27. AMCMA online catalog 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

28. AMCMA website 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

29. AMCMA @ flickr 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

30. AMCMA @ YouTube 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

31. Re-use of archival images

32. Dermatology Image Atlas 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

33. Dermatlas 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

34. Dermatlas: Combating unintended use by pornography seekers 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

35. Archivists responsibilities in posting medical images online • Respect patient privacy in compliance with HIPAA • Ground medical images in context of creation • Promote responsible reuse • Be aware of unintended use and take steps to mitigate risk • Monitor reuse of images 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

36. References • Connor, J.T.H. and Rhode, Michael “Shooting Soldiers: Civil War Medical Images, Memory, and Identity in America” Invisible Culture, Issue 5, 2003. http://www.rochester.edu/in_visible_culture/Issue_5/ConnorRhode/ConnorRhode.html#fn33 • Lawrence, Susan. “Access Anxiety: HIPAA and Historical Research” J Hist Med Allied Sci 62: 422-460, 2007. • Lehmann, Christoph, Cohen, Bernard, and Kim, George. “Detection and management of pornography-seeking in an online clinical dermatology atlas” J Am Acad Dermatol. 54(4):633-7, 2006 Apr. • Nissenbaum, Helen. “Privacy and Contextual Integrity”. Washington Law Review. 79:119, 2004. • Madrigal, Alexis. “Open Data: Rare Trove of Army Medical Photos Heads to Flickr” Wired Science. March 17, 2009. http://www.wired.com/wiredscience/2009/03/medarchives/ 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

37. References • Mifflin, Jeffrey. “Visual Archives in Perspective: Enlarging on Historical Medical Photographs” American Archivist 70(1): 32-69, 2007 Spr/Sum. 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine

38. Presenter Phoebe Evans Letocha Collections Management Archivist pletocha@jhmi.edu Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions 2009 SAA: Privacy Issues for Photographs/ Film of Health and Medicine