Submit your HIPAA questions to Editor Jaclyn Fitzgerald at firstname.lastname@example.org  and we will work with our experts to provide the information you need.
Q: I am employed by an acute care psychiatric hospital. The hospital’s police department will sometimes take photographs of injuries patients have at the time of admission. The photos are not kept with the medical record; they are kept separately with our police department. If a patient asks for a copy of his or her medical record—including the photos—may we release copies of the photos along with the copy of the record? There is some debate about whether a court order is needed for the photos because a standard release signed by the patient is insufficient. Are there any HIPAA rules pertaining to this issue?
A: Under the HIPAA Privacy Rule, individuals have the right to access PHI in a designated record set. Generally, the designated record set includes medical and billing records. If you define your legal medical record to exclude these photographs, you are under no obligation to release them as part of your designated record set. You may release them if you choose, but you have the right to deny the patient access to the photographs if they are not part of your designated record set.
Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, vice president of health information for Baylor Scott & White Health in Temple, Texas, answered this question for HCPro’s Briefings on HIPAA . This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions.