Keep Calm and Tweet On: Legal and Ethical Considerations for Pathologists Using Social Media

Physicians' respect for patient privacy is an ethical principle dating all the way back to the original Hippocratic Oath.²⁶  Modern versions of that oath continue to maintain the essential importance of respecting patient privacy.²⁷  The respect for patient privacy is fundamental to the social contract that exists between patients and their physicians. Patients trust physicians to diagnose and treat them, but they also expect physicians to respect their privacy. The HIPAA Privacy Rule did not create the principle of patient privacy, it merely codified it to define the legal limits of what physicians and other “covered entities” may and may not do regarding private patient data, which is referred to as protected health information (PHI). In addition, HIPAA defines PHI as patient data that are “individually identifiable,” and HIPAA includes a list of 18 data points that are considered as patient identifiers.²⁸  A patient's PHI cannot be disclosed to third parties unless that disclosure is for patient care purposes (or related purposes allowed by HIPAA), or unless the patient grants permission for the information to be disclosed. A physician or other covered entity that discloses PHI outside of those protected settings has committed a HIPAA violation. The Office for Civil Rights is tasked with enforcing HIPAA and may investigate and take action against anyone suspected of violating the HIPAA Privacy Rule. Although only the federal government is able to prosecute an alleged privacy violator under the HIPAA law, attorneys representing individual patients in civil litigation may use the fact of a HIPAA violation to support litigation alleging an intrusion of privacy or a breach of the standard of care by the physician.²⁹  Moreover, HIPAA is a federal law that provides a baseline standard that all states must uphold; it does not, however, prevent states from creating higher standards or more stringent criteria regarding patient privacy. It is critical for pathologists to vigorously protect patient privacy for both ethical and legal reasons and to understand the precise requirements of the HIPAA Privacy Rule and any additional state or local laws (or institutional rules) regarding patient privacy that may apply to individual practice settings.

Incomplete knowledge of what is allowed or prohibited under HIPAA can lead to confusion; unfortunately, on occasion, an acceptable request for patient information is inappropriately denied.³⁰  That confusion is not surprising because the combined HIPAA regulation text is long and unwieldy, written in technical, legal language. The “simplified” version of the combined HIPAA regulation text (General administration requirements, Administration requirements, and Security and privacy, codified at 45 CFR §160, 162, and 164, respectively), a 115-page PDF file containing more than 65 000 words, is available for download from the US Department of Health & Human Services Web site (http://HHS.gov).³¹  One key HIPAA principle is deidentification:

Thus, if patient data are deidentified according to that standard, the data are no longer considered protected health information by federal law. The deidentification rule includes patient photographs (as long as they are not full facial photographs or otherwise identifiable). Deidentified patient data are no longer private and may be shared publicly, such as in, for example, a textbook, a platform presentation at a national pathology meeting, a Web site, a newspaper, a Twitter account, a Facebook group, or a YouTube video.

Only 2 years after Louis Daguerre took the first known photograph of a human being in 1838, photography found its way into medicine. A French physician, Alfred François Donné, took the first known medical photographs in 1840. His subjects, in fact, were pathology specimens: sections of bone, cellular debris, and cells in body fluids. Donné, a fascinating figure and an unsung hero of pathology, was the first to describe Trichomonas vaginalis and platelets and was also likely the first to microscopically discover leukemia in 1839 (although leukemia was not described in a publication until 1845 by John Hughes Bennett, who had trained in microscopy under Donné and, independently, at the same time, by Rudolph Virchow, who gave the disease its name).^30,32–36  Donné recognized the immense value of the microscope for the study of human disease; other branches of science had adopted microscopes long before, but the senior leaders of medicine in his day were still adamantly opposed to using microscopes or other disruptive new technologies. Despite established medicine's hostility toward Donné and its attempts to obstruct medical and educational progress, Donné persisted. He conducted courses at his own expense to teach microscopy to other physicians, and after learning about Daguerre's photography techniques, he began to use microscopic photographs to educate his students.³²  Daguerreotype photographs eventually evolved into lantern slides. Then came a succession of photographic technologies: analog cameras, Polaroid cameras, digital cameras, and finally the high-resolution digital cameras present in essentially all modern smartphones.³⁷  The technology may have changed dramatically, but the act of acquiring and sharing pathology images dates back to the time of the founding fathers of our specialty. One hundred seventy-eight years later, pathology and photography remain inextricably linked, interwoven into the cultural fabric of pathology education and practice. Images are at the very heart of anatomic pathology; capturing and sharing those images are important aspects of a pathologist's daily work.

The first publication of a medical photograph in a peer-reviewed medical journal occurred in 1849.³⁰  Since then, the publication of medical photographs, including pathology photographs, has proliferated dramatically to the point that it is now a standard feature in most anatomic pathology publications. Pathology images are a key component of pathology reference textbooks, pathology meeting posters and platform presentations, and educational lectures for students, residents, fellows, and practicing pathologists. It is extremely difficult to imagine how the art and science of modern anatomic pathology could be taught or learned without the extensive use of pathology photographs.

Despite the longstanding ubiquity of taking photographs of patients and patient specimens, several legal and ethical questions have arisen in recent years, primarily concerning copyright law, patient privacy, and patient consent. These questions must be addressed to determine whether pathology images can be shared on social media and whether there is any significant risk for pathologists who do so.

Copyright law dictates who owns a given photograph and what rights the owner has regarding that photograph. In general, whoever takes the photograph owns the copyright of that photograph.³⁰  Copyright may be registered with the US Library of Congress (Washington, DC), but that is not required; in fact, copyright exists automatically from the instant the photograph comes into being (digitally or otherwise).^30,38  One exception to this rule is when a photograph is taken as “work made for hire,” meaning that photographers are hired specifically for the purpose of taking the photographs or that taking the photographs is part of their expected job duties per the written agreement or contract they have with their employer. For photographs taken as work made for hire, the party who hired the photographer to take the photograph holds the copyright. Whoever holds the copyright of a photograph is granted ownership rights to that photograph, including the right to reproduce the photograph and the right to display it publicly.³⁰  Physicians who take medical photographs of patients or specimens (unless such photos are specifically mandated by their employment contract as work for hire) own the copyright to those medical photographs.

Copyright ownership does not provide a free pass to do anything one wishes with photographs, even outside the medical setting. In certain situations, publicly sharing a photograph of an identifiable individual may constitute an intrusion into that person's right to privacy. Identifiable patient photographs represent PHI. Some authors have suggested that obtaining consent is mandatory before taking a photograph of a patient and/or before publicly sharing or using a photograph of a patient, even if the patient is not identifiable in the image.^38–40  Some medical journals require patient consent before publishing a patient image, even if the image is deidentified. Informed consent is a routine part of the medical diagnosis and treatment of patients. It involves explaining the diagnosis to the patient, providing treatment options, and explaining the risks and benefits of those options. Clearly, these things are not applicable to taking a medical photograph, which is neither a treatment nor a medical intervention. Taking a photograph poses no medical risk to the patient. Thus, obtaining consent for medical photography is likely not legally analogous to the medical informed-consent process. Although some authors may recommend it and some journals may choose to require it, the law does not. There is no explicit legal requirement for patient permission to take a medical photograph or to share a deidentified medical photograph.³⁰ 

There is broad cultural support for the concept of using medical photography for educational purposes, provided patient privacy is respected.³⁰  Obviously, in the clinical setting, asking the patient for permission before taking his or her photograph is common courtesy, if nothing else. How that translates to the pathology laboratory setting, namely whether patient consent is required before taking a photograph of a patient's pathology specimen or before sharing that photograph publicly, must, however, be addressed. There are key differences between clinical photographs and pathology photographs, which must be considered.

Clinical photographs are often obtained for documentation for primary patient care purposes and are, many times, added to the patient's medical record. In contrast, pathology photographs are usually taken voluntarily (rather than as a mandatory part of the pathologist's employment) and are often not included in the electronic medical record. The General Medical Council (London, England), a UK-based nonprofit organization focused on patient protection and improved medical education and practice, has published explicit guidance regarding consent and photography of microscopic pathology slides, noting the following:

This guidance is appropriate given the significant logistic problems that would arise were specific consent required for obtaining or sharing pathology photographs.

Clinical photography involves taking photographs of a patient, whereas pathology photography involves taking photographs of gross or microscopic specimens. Many hospitals have patients relinquish property rights in specimens as part of the routine consent process before treatment. Even if that is not the case, to many bioethicists, the patient is considered to have “abandoned” tissue specimens submitted to the pathology laboratory for diagnostic purposes.⁴²  Therefore, specimen ownership issues should not cause any problems regarding pathology photography. As the specimen is clearly distinct and separate from the patient, many of the potential ethical and legal concerns related to photography of patients are not applicable to photography of pathology specimens.

Further, archival diagnostic pathology materials are often used for research, for creating immunostain controls, and for a variety of other purposes, all without specific patient consent. Institutional review boards, operating under the stringent laws and ethical principles governing human subject research, do not require specific patient consent to allow research studies to be performed on archival pathology specimens that were originally sent to the laboratory for diagnostic patient care purposes. Taking pathology photographs for educational purposes is an unregulated, simple activity that does not require institutional review board approval and does not constitute human subject research. As such, it is unreasonable to expect that specific patient consent must be obtained for taking or using deidentified pathology photographs if such consent is not even required for human subject research involving archival pathology specimens.

Courts in the United States and the United Kingdom have upheld the interpretation that sharing (and even selling) deidentified patient information without patient permission is legal and is not a violation of patient privacy. In Steinberg v. CVS Caremark Corp (899 F.Supp.2d 331, 2012), the plaintiffs (customers of CVS pharmacy [CVS Health, Woonsocket, Rhode Island]) filed suit against the pharmacy for selling their deidentified patient information. The court rejected the plaintiffs' claims and dismissed the case, upholding the right of CVS to sell patient data because it was deidentified and thus in compliance with HIPAA.⁴³  The R v Department of Health, Ex Parte Source Informatics Ltd (All ER [D], 563, 1999) case dealt with a similar situation in the United Kingdom regarding the disclosure of anonymous patient prescription data for commercial purposes. The court held that because the information was deidentified, it did not breach the duty of confidence to the patients or violate their privacy rights.⁴⁴  The crux of the issue was whether the data were identifiable or not. If patient data are properly deidentified, it is legal not only to publicly disclose it but also to sell it for profit without the patient's permission. If that activity is legal, we and other authors find it difficult to imagine how a court could rule against the free sharing of deidentified pathology images for educational purposes.⁴⁴ 

Using precedent ethical principles and legal statutes as standards, we have argued that patient consent is not required for photography of pathology specimens or for public sharing of those photographs, provided they are fully deidentified per HIPAA. In our opinion, these are sound arguments. Legal cases centered on medical photography are infrequent. Most such cases that have been tried or settled involved clearly inappropriate scenarios in which identifiable, embarrassing clinical photographs were shared in attempts to humiliate or mock a patient.^30,38  Previous authors were unable to identify any case law regarding the educational use of deidentified clinical photographs.³⁰  Regarding pathology specifically, we were unable to discover any previous legal cases in which a pathologist or other party was sued for sharing deidentified gross or microscopic pathology images in any public setting, including social media. We are also unaware of any legal case in which a pathologist was sued specifically for any type of activity involving Twitter, Facebook, or other social media.

Because the copyright of a photograph is owned by the person who took the photograph, sharing the photograph on Facebook, Twitter, or other social media does not transfer ownership of the copyright. As the Twitter terms-of-service (TOS) agreement clearly states in plain language:

Similarly, the Facebook TOS states:

Both the Twitter TOS and the Facebook TOS go on to explain that by tweeting/posting content, the user is granting a nonexclusive license for Twitter/Facebook to use, display, share, etc that content.^45,46  This makes perfect sense, because without granting that permission to the social media platforms, Twitter and Facebook would be unable to allow users to upload or share photographs or other content on their sites, and social media as we know it would be unable to function. These nonexclusive licenses granted to social media platforms are similar to the license a pathologist grants to a pathology organization when she or he presents a course at an annual meeting. The organization has a right to use or share images or information from the pathologist's presentation materials, but the pathologist still fully owns those materials and can do anything else he or she wants to with them. This differs from publishing an image in a peer-reviewed medical journal or a textbook, in which the pathologist transfers copyright of the image to the publisher.

Taking and sharing photographs of pathology specimens is embedded into the culture of the specialty of pathology and has been for more than a century. Patient consent is not legally or ethically required to take or use deidentified photographs of pathology specimens. The pathologist who takes the photograph owns the copyright to it. Moreover, HIPAA permits public sharing of deidentified pathology photographs without patient consent, even on social media. To our knowledge, there is no case law of action taken against pathologists for sharing deidentified pathology images on social media or elsewhere. If there is any legal risk for pathologists or risk of patient harm in sharing pathology photographs, it is very small.

Both of the authors have abundant experience with the professional use of social media and are among the most followed pathologists in the world on Twitter. We cumulatively have tweeted/retweeted more than 140 000 times. These are merely statistics, yet they are evidence that we have a great deal of personal experience with social media. We have spent numerous hours in this space, and yet, neither of us has personally observed an example of serious breach of patient privacy by other pathologists sharing images on social media. One of us (J.M.G.) volunteers in multiple support groups on Facebook for patients with rare cancers and interacts with many patients and patient family members on multiple social media platforms. He has been posting pathology photographs daily for years, in full view of many patients, yet he has never received a complaint from a patient about sharing those images. On the contrary, Haller et al¹⁹  describes the many patients who have expressed heartfelt appreciation for his participation in their groups and his attempts to provide education about rare disease. Many patients from the Facebook groups described by Gardner have even sent clinical photographs of their own tumors and invited him to share them for educational purposes.¹³  Although not representing all patients, this is strong evidence that patients desire their pathology images to be used for education. We have occasionally encountered physicians and other professionals on social media who express well-intentioned (but often misinformed) concerns about the ethics or legality of sharing deidentified pathology photographs without patient consent, but interestingly, we have not encountered actual patients who have expressed those concerns online (despite there being a large group of very vocal and active patients and patient advocates on Twitter). This is a strong indication that pathologists have done well in being respectful and helpful on social media and have been appropriately deidentifying images before sharing them. It is crucial that pathologists continue to maintain social media activities that are above reproach, teach our pathologists-in-training how to use social media correctly, and continue to be positive role models to our nonpathologist colleagues, to patients, and to the public. Recommendations on sharing pathology images on social media in an appropriate manner that respects patient privacy have been discussed in detail by Crane and Gardner.⁶ 

Given its recent privacy situation, Facebook may face enhanced scrutiny, and it may be governed by new regulations in the near future protecting user privacy and controlling the use of personal data.⁴⁷  Such regulations are unlikely to significantly affect pathologists who use Facebook or other social media professionally. Pathologists are end users of Facebook and other social media platforms just like nonmedical personal users; any new regulations or laws concerning social media and user data privacy are likely to be for our protection, regulating the activities of the social media companies and platforms rather than regulating our activities as users of those platforms. The physician-patient relationship already has robust privacy laws, including HIPAA, which carefully regulate physician professional conduct, specifically the use of patient data. Sharing deidentified pathology photographs on social media is held to the same general ethical and legal standards as publishing those images in a medical journal or sharing them at a national meeting. Thus, social media companies may be subject to new privacy regulations in the near future, but it is reasonable to assume that those regulations will have no or very little effect on pathologists' use of social media for educational purposes.

We have attempted in this article to provide an in-depth examination of the ethical and legal issues surrounding the concept of posting deidentified pathology images on social media. Historic precedent, the law, and ethical principles all reasonably support this as a legitimate professional activity. We hope this firmly answers the questions and concerns expressed by some pathologists about this educational use of social media. Although we have focused on Facebook and Twitter here, the same principles apply to any social media platform, including new platforms and those that will surely be created and used by future generations of physicians. As noted, there is very little risk to patients when sharing fully deidentified pathology images on social media, and yet, there are immense potential benefits for other pathologists, for patients, for our specialty, and for society in general.

The Hippocratic Oath mentions the importance of something else before mentioning patient privacy: teaching. Both the ancient and modern versions of the oath contain mandates that physicians must honor and respect the physicians who have come before them and taught them, and that physicians must pass on their knowledge to the next generation of physicians.^26,27  Social media is a very powerful tool for medical education not only of physicians but also of patients and the public at large. It allows medical knowledge to be disseminated around the globe in a fraction of a second at essentially no cost. It enables learning even in resource poor settings.^{7,8,11,12,16,19,20}  One of us (J.M.G.) surveyed his followers in 2016 to evaluate the effect and quality of his social media–based educational activities. Most physicians who responded to the survey (89%; 681 of 762 physician respondents) agreed or strongly agreed that “[the pathologist's] social media posts about medicine or pathology have helped me improve the way I practice medicine (enabling me to better care for or diagnose my own patients in real life).”⁴⁸  If one pathologist's social media activity can have such a strong, positive impact on the lives of so many others, imagine the potential benefits if most practicing pathologists were active on social media.⁴⁹  The authors regard our own professional use of social media as a duty and obligation to our profession, to patients, to society, and to future generations of physicians. It amplifies our educational efforts. It enables us to help colleagues, patients, and many others, both near and far. It breaks down social hierarchies and geopolitical barriers that still impede medical education and patient care.⁵⁰  Pathologists may be important, but we are only a very small portion of the medical community. Social media is the essential “force multiplier” that enables pathologists to maximize our reach and our positive impact, despite our small numbers.⁵¹  It gives us a public voice to educate other physicians, patients, and the public about the value and importance of pathologists in modern medicine.⁵²  So, please, keep calm and use social media professionally to engage and educate!