In the late 18th century Robert Willan developed a classification for skin diseases, which he described with the aid of illustrations.1 However, it was not until 1826 that the French physicist Nicéphore Niépce used the technique of photography for this purpose. Since then, there has been a close link between dermatology and photography.2

Photography, whether for diagnostic purposes, clinical-care follow-up, or teaching and knowledge transfer, continues to play a fundamental role in the practice of dermatology today.3,4 Dermatological photography is an invaluable instrument and can be considered as important as other complementary tests.5 Although there is no standardized method for obtaining and using medical photographs for dermatological purposes,6 teaching dermatology7,8 or publishing a scientific article in this field without the aid of clinical photographs is unimaginable.3

The increasing use of dermatological photography can be attributed to its high medical value and the fact that images can be obtained noninvasively with relative ease given the widespread availability of high-quality cameras (including those incorporated into smart phones).9

The use of photography has medical-legal and bioethical implications with which we should be familiar and comply. Moreover, revision of these implications is warranted in light of recent legislative changes,8,10,11 particularly those relating to the need for prior authorization to obtain,3,4 display, or store3,12 such images. The encryption or coding of photographs used in teledermatology to prevent unauthorized access13,14 and the dissemination of clinical photographs through professional forums and social networks15 are two areas that merit particular attention.

To address the implications of the use of photography in dermatology, taking into account the patient’s perspective, it is useful to have a knowledge of patients’ attitudes towards medical photography. A recent Spanish study16 reported very positive attitudes among patients (94.8%) regarding the use of medical photography in general, and specifically for diagnosis (86.6%), treatment follow-up (88.1%), and consultations between medical professionals (86.6%). The findings indicate that patients generally have a positive attitude to being photographed for medical purposes, provided that the photographer is the attending physician (as also reported in an international study17) and the lesions are malignant and located in unidentifiable areas. Despite an overall positive attitude, patients expressed some reluctance to consent to certain types of photography, such as that of the face or genital area (78.4% and 70.3%, respectively). Finally, some patients, while recognizing the diagnostic value of photographs, expressed reluctance to consent for religious reasons, in line with the findings of the aforementioned international study.17

In this article we discuss the main bioethical and medical-legal implications of the use of photography in dermatology, and provide a series of corresponding best-practice recommendations.

The medical use of photography, regardless of its purpose, should always take into account the ethical principles that apply to all fields of medicine. These principles are based on the guidelines for the protection of human subjects in research, as described in the 1979 Belmont report,18 itself a reaction of medical professionals to the Tuskegee study (1932–1972, Alabama, USA) of the natural progression of untreated syphilis, and on the Oviedo Convention,19 signed in Spain in 1997, for the Protection of Human Rights and Dignity of the Human Being With Regard to the Application of Biology and Medicine.

Furthermore, all medical actions should be conducted in accordance with the 4 principles of Beauchamp and Childress20: autonomy, beneficence, nonmaleficence, and justice. The principle of autonomy refers to the individual capacity of all individuals to freely deliberate and decide (i.e. to make decisions about themselves relating to matters that concern them). Informed consent is the quintessential expression of the principle of autonomy. The principle of beneficence refers to the moral obligation to act for the benefit of others, promoting their well-being and legitimate interests. It is assumed that health professionals, thanks to their training, know what is most appropriate for their patients. The third principle, that of nonmaleficence (also known as primum non nocere), refers to the obligation not to harm or endanger the patient, and to prevent potential harm. Finally, the principle of justice refers to the obligation to treat each individual equally, and forms the basis of a key element of health policy, namely the equitable sharing of healthcare resources.

In the context of medical photography, understanding that a patient attending a healthcare center establishes a quid pro quo relationship whereby they must share information in exchange for adequate care,21 the principles relating to confidentiality (i.e. autonomy and nonmaleficence) are of particular importance.

For these and other purposes, medical organizations have drawn up deontological codes22,23 to which all physicians must adhere when conducting professional practice.

Table 1 summarizes the multiple legal and regulatory provisions, of varying hierarchies, of the European and Spanish legal systems that are applicable to medical photography.

Two distinct legal forms of legal protection apply to the field of medical photography: protection of the fundamental right to self-image; and protection of personal data. The former is regulated by Organic Law 1/1982, of May 5, on Civil Protection of the Right to Honor, Personal and Family Privacy, and Self-Image.24 Spanish laws regulating personal data protection have undergone several recent legislative modifications relating to the acquisition and display of medical photographs. In our opinion, these changes significantly condition the manner in which medical professionals carry out these activities.

The aforementioned modifications are a consequence of approval of the General Data Protection Regulation (GDPR) of the European Union (EU 2016/679),25 of April 27, 2016, on the Protection of Natural Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, a mandatory regulation applicable since May 25, 2018; and its adaptation to Spanish legislation by the repeal of Law 15/1999, of December 13, on the Protection of Personal Data and immediate replacement with Organic Law 3/201826, of December 5, on Protection of Personal Data and Guarantee of Digital Rights.

Of particular relevance to the present article are the provisions outlined in recital 26 of European Regulation (EU) 2016/679,25 which states the following: “The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”

Any analysis of the use of photography in dermatology should consider 2 key scenarios: first, the taking of photographs and their inclusion in the patient’s medical history; and second, the potential use of photographs for educational purposes or in scientific publications.

There are few legal doubts regarding the use of photographs for medical purposes, provided that the photographs are taken for inclusion in the patient’s medical history. Such photographs are subject to the same criteria and formalities as any other component of the medical history (e.g. additional tests). Moreover, the legal requirements governing the storage and maintenance of such images do not differ to those applied to the other documents that comprise the medical history.

Although not legally necessary, in order to ensure complete medical transparency, which undoubtedly benefits the doctor-patient relationship, patients of whom images are acquired can be informed about data protection and the inclusion of photographs in their medical history. To this end, it is recommended to use an information and consent document on the collection and use of personal data that expressly states the following: “data collection includes photography for the purposes of diagnosis or follow-up care”. Any photograph that is combined with additional medical documentation becomes subject to personal data protection legislation; although the photograph may not necessarily identify the patient, it is linked to a series of documents that make the patient identifiable.

In the case of photographs obtained by a dermatologist during the course of their professional activity and subsequently exhibited for teaching purposes or in a scientific publication, 2 specific scenarios should be considered: that in which the patient cannot be identified based on either the photograph or the information accompanying it; and that in which the patient can be identified.

It should be noted that no authorization is required to exhibit for educational purposes or for scientific publication photographs that correspond to the first of these 2 scenarios.

However, in cases in which the patient can be identified, even if only from additional information accompanying the photograph, exhibition of the photograph requires the patient’s express authorization, which should be specific to the photograph in question and its intended use (e.g. undergraduate or continuing education, scientific publication).

In summary, as a consequence of recent legislative changes, the GDPR of EU 2016/67925 does not apply to the display of photographs that do not enable patient identification. Conversely, authorization is always required for the exhibition of images that enable identification of the patient (i.e. photographs of the face27 or any other body area or circumstance that entails a non-negligible possibility of identifying the patient). In cases in which the dermatologist is unsure as to whether the photograph could identify the patient, given the relatively lax definition of this concept in the legislation it is recommended to obtain authorization to exhibit the photograph.

The medical history, informed consent, and medical confidentiality are, in our view, 3 key contexts in which the legal implications of medical photography merit special consideration.

In a survey of dermatologists,31 100% of respondents said that they used their mobile phones to photograph patients; 85% stored about 100 images of patients on their mobile phone; and 62% stored more than 200. Of the dermatologists surveyed 62% said they also used a digital camera in their consultations. Clinical photography has become an integral part of clinical practice, especially in the more “visual” specialties,32 such as dermatology, maxillofacial surgery, traumatology, and plastic surgery.33 Today’s social networks have brought about a high degree of connectivity between individuals, great ease of access to and management of the information generated, and a level of immediacy whereby even applications such as WhatsApp are used to respond to medical consultations. In this context it is important that health professionals who actively use these networks have access to basic advice on the applicable legal and deontological framework.15,23

This is particularly important in the context of the sharing of patient photographs via social networks. It is crucial to bear in mind the limits of communication once information leaves the strict confines of the doctor-patient relationship, or the inter-professional relationship, and enters a more public dimension via social networks or media that allow widespread dissemination of information. From the outset, it should be noted that uploading, exhibition, or sharing of a photograph depicting the image of a person requires the express and unequivocal consent of the individual photographed.

In all these cases, the doctor should remember that they remain a medical professional, and therefore are obliged to observe and comply with deontological standards. Moreover, their actions can have civil, labor, or even criminal consequences.23 The Spanish Medical Colleges Organization has published a style manual for doctors and medical students on the appropriate use of social networks34 and the Council of Medical Colleges of Catalonia has drawn up recommendations specific to this issue (Table 2).23

The use of photography for diagnostic, clinical-care, educational, or knowledge transfer purposes is an essential element of current dermatology practice. However, based on an analysis of the regulatory framework, to which recent changes have been made, and of the bioethical issues associated with medical photography, it is advisable to follow a series of basic standards, detailed below, to ensure compliance with the regulatory legal framework and associated ethical obligations.

• 1

  An understanding of the right to privacy of the patient, as the owner of their self-image (i.e. the principle of autonomy) is the key to correct use of clinical images in dermatology. This in turn will ensure that patients accept medical photography as an integral part of their ethical care and trust that such images will be used appropriately.35

• 2

  The use of photography in dermatology requires an open, empathetic doctor-patient relationship that takes into account the patient’s concerns about photography.36 The dermatologist must inform the patient of the purpose for which any clinical image is obtained. In some cases it may be advisable to show the photograph to the patient to ensure that they understand its medical relevance.4

• 3

  Recent modifications to personal data protection legislation mean that the use of dermatological photographs for any purpose is subject to distinct legal provisions depending on whether or not the patient is directly or indirectly identifiable. In cases in which the image does not allow identification of the patient, data protection requirements do not stipulate the need for authorization. However, to provide the dermatologist with a greater degree of legal security it is advisable to inform the patient in question when taking photographs.

• 4

  In the event that the image may be subsequently exhibited and reveal the patient’s identity it is necessary to obtain authorization that specifically states the purpose of the exhibition, whether for educational use or for scientific publication.

• 5

  Because legislation is updated periodically and image-acquisition technology evolves continuously, information relating to the use and acquisition of medical photographs should be periodically re-evaluated to ensure compliance with the obligation to adequately inform patients.

• 6

  Clinical images should be managed in the same manner as any other document generated during the care process and should be included in the patient’s medical history. The medical history is an instrument designed primarily to ensure adequate patient care. Access to the medical history should be restricted to the physicians participating in the care process and access for judicial, epidemiological, public health, research, or teaching purposes should occur in accordance with the provisions of the PRL and current legislation on personal data protection.

• 7

  The archiving, conservation, maintenance, and access security of medical photographs are the responsibility of the healthcare center in which they are acquired. Healthcare professionals who perform their activity outside a healthcare center are responsible for the management and custody of the documentation they generate. Dermatologists could consider producing a consensus document on the appropriate use and storage of digital photography in dermatology practice.37

• 8

  In accordance with Law 3/2018,26 health centers are obliged to appoint a data protection delegate. This obligation does not apply to professionals who carry out their activity as individuals.

• 9

  Although some authors lower their guard when responsibly sharing via social networks photographs that do not allow patient identification,38 because of potential liability issues prudence is recommended when sharing medical images8 via social networks within professional groups accustomed to a high level of responsibility.

• 10

  Dermatology residency training programs should directly address the ethical and medical legal aspects of the use of photography.36

The authors declare that they have no conflicts of interest.