Patient photos in a dermatology clinic: consent, consistency and storage

In most specialties the record is words: a history, an examination, a diagnosis. In dermatology the most useful record is often a photograph. Whether acne is improving, a vitiligo patch is repigmenting, melasma is fading or a psoriasis plaque has thinned is far easier to judge from two photos side by side than from two notes that both say “improving”.

The same photographs are also the most sensitive thing a skin clinic keeps. They show faces, bodies and sometimes intimate areas, and in most clinics they are taken on whatever phone is nearest. This article covers three things: consent, taking photos you can actually compare, and where the photos should live. It is written for dermatologists and clinic managers.

Why photos end up on phones, and why that is the problem

Phones are always at hand, the camera is good, and sending a photo to the doctor on WhatsApp takes seconds. So photos are taken on a staff member’s phone, shared in a chat group, and maybe printed or attached to the file later.

The problems are quiet until they are not:

• The photo sits in a personal gallery, next to family pictures, and is backed up to that person’s personal cloud account.
• It is not linked to the visit. Six months later, nobody can say with certainty which visit, which side or which treatment it belongs to.
• When the staff member leaves, the photos leave with them.
• A lost phone is a lost set of patient photos.
• Comparing visits means scrolling through a gallery or a chat history.

None of this needs bad intent. It is simply what happens when the convenient tool is not the clinic’s tool.

Consent: two kinds, recorded

There are two different uses for a clinical photo, and each needs its own consent.

For the medical record. Photos taken to document a condition and follow it over time are part of care. Explain what will be photographed and why, and record that the patient agreed, with the date and who took the photos.

For anything else. Teaching, conference talks, publications, the clinic’s website and social media are all different uses. Each needs separate, explicit consent, given knowing exactly where the photo will appear. A photo taken for the record should never be reused for marketing without asking again.

India’s Digital Personal Data Protection Act, 2023 applies to both. A photograph of a patient is personal data. The Act expects consent that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and lets the person withdraw it, after which the data should no longer be used for that purpose. For anyone under 18, consent comes from a parent or legal guardian.

In practice, that means:

• a short, plain consent form with separate tick boxes for clinical use and for each other use you might want;
• consent recorded in the patient’s file, not on a loose sheet;
• a way to record withdrawal, and a habit of checking consent before a photo is used outside the clinic;
• for intimate areas, a chaperone and photos taken only on clinic equipment.

Taking photos you can compare

A photo is only useful as a record if the next one can be compared with it. Most “it looks better” disagreements between patient and doctor come from photos taken in different light, at different distances.

Agree a simple protocol and keep it near the camera:

1. Same place, same light. One spot in the clinic, with diffuse light and no window behind the patient. Avoid the flash for close-ups, where it bleaches redness and pigment.
2. Plain background. A matte, neutral wall or sheet, nothing patterned.
3. Standard views. For the face: front, left and right at 45 degrees, and both profiles. For the body: agreed views per region, the same every visit.
4. Same distance. Mark the floor, or use a fixed setting on a dedicated device.
5. Scale and colour. A small ruler or colour card in the frame for close-ups, so size and colour can be judged across visits.
6. Label the site. Record the body site and side with each photo. “Left cheek” is a record; “cheek” is a guess.
7. Dermoscopy separately. Dermoscopic images are their own series and should be filed against the lesion they show.

Where photos should live

The photo should end up where the rest of the record is: in the patient’s file, against the visit and the body site, visible to the doctor at the next visit without a search.

Things to expect from your clinic software:

• photos uploaded straight to the patient’s record and filed against the visit;
• access limited by staff role, so a photo is seen by the people treating the patient and not by everyone with a login;
• photos from different visits that are easy to put side by side;
• a consent record next to the photos;
• photos removed from the device once they are uploaded.

If your clinic takes photos on staff phones today, the single biggest improvement is a rule that photos are uploaded to the record the same day and then deleted from the phone. The software should make that the easy path.

Where 92health fits

92health is an EMR used by clinics, hospitals, pharmacies, labs and optical shops in India. Its dermatology workspace is built around the points above:

• A front and back body map: a click on the map records the region and the side.
• A lesion register that belongs to the patient, not the visit, so each lesion carries its own history, with this visit’s observation shown beside the last one.
• Clinical photos uploaded against the visit, streamed only to signed-in staff.
• PASI and DLQI scores worked out from the grids as you fill them.
• Diagnoses, history and a clinician’s note, printed on the visit summary.

Around it, the rest of the clinic:

• Patient documents uploaded to the patient’s record and filed against the visit, visible according to the staff roles you set.
• Registration and the OPD queue, including QR self check-in, where patients register on their own phone and upload their documents before they reach the desk.
• E-prescriptions that reach your in-house pharmacy counter, with batch-wise stock and billing at the counter.
• Procedures and packages from your own service catalogue, such as a course of peels or laser sessions billed as one package.
• Billing and payment collection, including payment links, with clean day-end reports.
• Records that can be linked to the patient’s ABHA where they have one.

To see it on your own clinic’s workflow, book a demo.