It starts innocently. A practitioner takes a quick photo on their own phone between appointments, meaning to move it later. Months on, that camera roll holds hundreds of patients' faces, mixed in with holiday pictures, quietly copied to a personal cloud account.
Here's why that matters, and what a safer routine looks like.
Your camera roll isn't private
Most phones back up photos automatically. That means patient photos can end up in a personal iCloud or Google account, on a family member's iPad through a shared album, or in "memories" that resurface them on a lock screen. None of that is under the clinic's control.
Phones get lost, sold and shared
A lost or stolen phone with unencrypted access to photos can be a reportable data breach. So can a phone traded in without being wiped. And when a team member leaves, the photos they took leave with them.
Photos outside the record don't count
A photo sitting in someone's camera roll isn't part of the patient's medical record. It isn't linked to their consent, it isn't backed up with their notes, and it's very hard to find when the patient asks for a copy of their data, or when you need it to answer a complaint.
No log, no answer
If a patient asks who has seen their photos, a camera roll can't tell you. A clinical system should record who took each photo, who viewed it and when.
A safer routine
- Use a clinic device, not a personal phone, for every clinical photo.
- Capture straight into the record, so a photo never exists outside it.
- Give everyone their own sign-in, and lock the app when the device is put down.
- Keep photos encrypted, on the device and in backups.
- Turn off personal cloud sync on any device used for patient work.
HonestFace is built around this routine. Photos are taken inside the app, saved straight to the patient's encrypted record, never to the camera roll, and every view is logged against the person signed in.
