Clinical photography consent form: a rooms workflow

Why photography needs its own consent

A general consent to examination or treatment doesn't cover photographs. The Medical Council's Guide to Professional Conduct and Ethics (9th edition, 2024) deals with it directly, in paragraph 31, "Photographic, video or audio recording of a patient by a doctor":

• recordings may be needed as part of a patient's care, but you need to take care with how they are stored and shared (31.1);
• you "must explain this to the patient and obtain their consent to both the making and any proposed sharing of a recording" (31.2);
• recordings must be kept confidential as part of the patient's record. If you want to use one for education or training beyond the care team, the patient must not be identifiable, unless they have consented to being identified (31.3);
• take particular care when sharing recordings electronically (31.4).

A short, separate form makes that conversation easy to have and easy to prove later.

Consent under the Medical Council and the legal basis under GDPR

These are two different things, and the HSE explains the difference in its guidance on the legal basis for using personal information.

• Consent to the photograph is the professional and ethical consent the Medical Council requires.
• The legal basis for processing the image under GDPR is a separate question. Photographs taken for a patient's care are health data, a special category of personal data. Processing them for diagnosis and care by a health practitioner can rely on Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018, rather than on GDPR consent.

For uses beyond care, such as teaching, publication or anything public, the position is different. Practices usually rely on the patient's explicit agreement for each use. If the form bundles those uses into one signature, it risks failing the GDPR test that consent be freely given and specific. The Data Protection Commission's case study on processing health data shows how seriously it treats health data.

If you're unsure which basis applies to a particular use, ask your data protection adviser before you change the form.

What to put on the form

1. What will be photographed

Write it in plain words the patient will understand. Then say whether anything identifying could be in the frame: the face, tattoos, birthmarks or distinctive scars. Note how you'll keep the image tight to the area, or crop it, to leave those out.

Framing	Identification risk	What to note on the form
Close-up of the area only	Low	The area, in plain words
Wider view, for orientation	Medium	The area, plus any tattoos or marks that may be visible
Face or full body	High	That the patient may be identifiable, and that they have agreed to this

If, during the consultation, you want to photograph another area, ask again and note it on the form. Don't assume the first agreement covers it.

2. What the image will be used for

Give each use its own tick-box, so the patient can agree to one without the others.

• Care and the patient's record: seen by the treating consultant, colleagues covering their care, and rooms staff who manage the record.
• Multidisciplinary meetings and clinical audit: shared within the treating team or hospital.
• Teaching and publication: used in training or in a journal, with the patient not identifiable unless they tick a separate box agreeing to be identified.
• Website or promotional use: many practices leave this off altogether. If you include it, put it on a separate form.

3. Withdrawal

Tell the patient they can change their mind, and say what that means for each use:

• In the record: the image can be restricted from routine view. Whether it can be deleted depends on your practice's record retention policy. Ireland has no single statutory retention period for private records. See our guide on how long to keep medical records in Ireland.
• Shared with someone else: if the image was sent to another clinician or service, the rooms will tell them about the withdrawal.
• Published: a sentence such as "You can withdraw consent for publication up until the article or presentation is submitted. After publication, copies that have already been shared can't be recalled."

4. Signatures

The patient signs and dates the form, and the person taking the photograph countersigns it. The form goes into the patient's record.

A rooms workflow, before and after the photograph

Before:

• Check the patient's identity against the record: full name and date of birth.
• Go through the form with the patient and let them tick each use separately.
• Note whether anything identifying will be in the frame.

After:

• File the image in the patient's record on the same day, with the date and who took it.
• Delete it from the camera, phone or tablet once it's filed, including any cloud backup.
• Note in the record where the image is stored and which uses the patient agreed to.
• If the image is sent to anyone, note who, when and why, and send it through a secure channel.

Practice phones are the main risk. If anyone takes photos on a phone, agree a written rule: practice device only, no personal photo library, no messaging apps, deleted once filed.

Where Ask Brigid fits

Ask Brigid keeps the patient record, signed forms and documents in one place, hosted in AWS Dublin (eu-west-1), and can send digital forms for patients to complete. You stay in charge of what is photographed, why, and who sees it. For related consent wording, see our post on recording consultations and patient consent in Ireland.

Next step: draft a one-page photography consent form for your rooms this week, using the four sections above, and ask your data protection adviser to read it before you use it.

Ask Brigid is looking for a small number of founding consultant practices. Explore the sample practice (the real app, invented patients, no sign-up) or request early access.