Photography and media consent

How do we capture a patient's consent for clinical photography or media use with the scope defined, signed, and stored with the record so every later use is checked against it?

Separate the clinical photograph from the other uses, and make each use a scope the patient chooses. When clinical photos, video or audio are needed, or a marketing, teaching or publication use is proposed, Callvu classifies the purpose (treatment documentation, teaching inside the organization, external education or publication, marketing or media, research), presents the consent on the patient's phone or a secure screen with each scope as a separate choice and the right to revoke, captures the signature, routes a use that needs a marketing authorization, a minor's consent or a representative's authority to the privacy office in the Decision Desk, writes the consent with its scopes to the EHR against the images, and checks every later request to use the media against the scope on file.

In scopeSimpleCallvu moves: write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The wound photo taken for the chart appeared in a conference slide, and the consent on file covered treatment only.

Today, without Callvu

Clinical photographs are part of care: a wound's progress, a rash, a surgical field. They are also valuable for teaching, publication and marketing, and each of those is a different use. The consent on file, if there is one, was a line in the general consent to treat. A surgeon's slide, a marketing video shot in a ward, a resident's teaching file: each is a disclosure the patient did not authorize, and the organization finds out from the complaint.

The Privacy Rule treats full-face photographs and comparable images as identifiers, allows their use for treatment without authorization, and requires a written authorization for marketing and for most uses outside treatment, payment and operations; state laws add rights of publicity and recording consent; the organization's policy adds teaching and research rules. The consent has to say which uses the patient agreed to, and the record system has to hold that against the images.

A consent with scopes is a record; a line in a packet is a liability.

How it runs

From the requestto the system of record.

A clinician needs clinical photos or recordings, or a teaching, publication, marketing or media use is proposed. Callvu classifies the purpose and opens the consent.

Patient or personal representative: Chooses each scope, signs on a secure screen, and may revoke later.
Clinician or requesting department: States the purpose and the media, and takes or uses the media within the scope.
Privacy office: Decides marketing authorizations, minors and representatives in the Decision Desk.
Callvu: Classifies the purpose, presents the scopes, captures the signature, routes, writes and enforces.

Classify the purpose and the media
The request's purpose (treatment documentation, internal teaching, external education or publication, marketing or media, research), the media type (photo, video, audio), whether the patient is identifiable (full face, distinctive features, voice), and the patient's age and status classify the consent needed: no authorization for treatment, the organization's consent for internal teaching, a written authorization with the marketing elements for marketing and media, the research authorization for a study.
Present the scopes and capture the signature
The consent is presented on the patient's phone or a secure screen with each use as a separate choice the patient can accept or decline, the identifiability explained in plain terms, whether remuneration is involved, the right to revoke and what revocation can and cannot undo; the patient or their representative signs.
Decide
A treatment-only consent and an internal teaching consent proceed by rule; a marketing or media authorization, a minor under the state's rules, a representative whose authority is not on file, or a patient who declines a use the request needs goes to the privacy office or the requesting department in the Decision Desk with only the allowed outcomes.
Write back and enforce
The consent with its scopes, the media description, the signer and the date is written to the EHR against the images or recordings, every later request to use the media (a slide, a publication, a campaign) is checked against the scope on file before release, and a revocation updates the scope and stops future uses.

Where it ends: Clinical media were taken under a consent that names each use the patient agreed to, the record holds the scopes against the images, and no later use left without a check against them. The Decision Trace shows the classification and any decision; the Audit Trace shows the signature, each use check and any revocation with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

HIPAA Privacy Rule on identifiable images and marketing (45 CFR 164.514(b), 164.508(a)(3) and 164.501): Full-face photographs and comparable images are identifiers that make the media protected health information; use for treatment needs no authorization, but a use for marketing requires a written authorization that states whether remuneration is involved, and uses outside treatment, payment and operations (external education, publication, media) require an authorization with the 164.508 elements; the patient may revoke in writing except to the extent the organization has acted in reliance.
State rights of publicity, recording consent and minor consent laws: States protect a person's likeness from commercial use without consent, some require all-party consent to audio or video recording, and the state sets who consents for a minor; the classification applies the state's rule to the scope.
Organizational policy and accreditation standards on patient privacy and media: The organization's policy sets the rules for clinical photography (devices, storage, teaching use) and media activity on its premises, and the accreditor requires respect for patient privacy during care; the consent's scopes implement the policy.

Company policies

Treatment photography and other uses are separate scopes; a patient can agree to one and not another.
A marketing or media use needs the written authorization with its elements, decided by the privacy office.
Every later use is checked against the scope on file before release.
The EHR is the system of record for the consent against the media.

Controls

Purpose and identifiability classification.
Scope-by-scope consent presentation.
Secure signature capture.
Decision Desk for marketing, minors and representatives.
EHR write against the media.
Use check and revocation handling.

Clocks and deadlines

Consent before capture: A non-treatment use waits for the signed scope.
Revocation: Effective on receipt for future uses, with reliance uses recorded.

Documents and checks

The purpose classification
The consent with its scopes and signature
Any privacy office decision
The EHR record against the media and the use log

In the Decision Trace

The classification and the authorization type.
Any decision and the person.

In the Audit Trace

The signature with time and device.
Each use check with time.
Any revocation.

The handoff

Between the front doorand the back office.

The front door

The patient's phone or a secure screen in the department.

The back office

Clinicians, teaching and marketing request a use and get a check against the scope; the privacy office decides only authorizations and unusual cases.

The Decision Desk

A marketing or media authorization, a minor, an unverified representative or a declined scope the request needs goes to the privacy office or the department in the Decision Desk with only the allowed outcomes.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

Is consent needed for a wound photo in the chart?

Treatment documentation needs no HIPAA authorization, but the organization's policy sets the consent and the scope is recorded so the photo is not used for anything else without a check.

What does a marketing use require?

A written authorization with the HIPAA elements, including whether remuneration is involved, decided by the privacy office before capture or use.

Can the patient change their mind?

Yes. A revocation takes effect for future uses on receipt; uses already made in reliance are recorded.

Related processes

Procedure and treatment consents by type HIPAA authorizations Research informed consent General consent to treat Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.