What Actually Identifies a Patient in a Photo

Marks on the body that are as distinctive as a face

Skin carries identity. Tattoos are the obvious one and they are frequently left visible in images where the face has been carefully cropped, which is close to self-defeating, since a tattoo is designed to be distinctive and is often documented on the person's own social accounts. Partial tattoos are no better - a fragment of a recognisable piece is recognisable.

Beyond tattoos: scars, particularly surgical scars with a characteristic placement, birthmarks, port-wine stains, vitiligo patterns, moles in a distinctive arrangement, freckling patterns, and skin conditions with a recognisable distribution. Amputations, limb differences, contractures and healed fractures with visible deformity are all identifying, and in the context of a clinic photo they are often the very thing being photographed.

Hands and nails deserve their own mention because they appear in so many treatment images. Nail art, a distinctive nail shape, a missing fingertip, arthritic joint changes, a wedding ring with a particular design, a signet ring, a knuckle tattoo. A pair of hands is not anonymous.

Objects, aids and clothing

People carry constants. A particular watch, a piece of jewellery worn daily, a wedding band, a religious item, a distinctive phone case, a lanyard from their workplace, a branded uniform, a football shirt with a name printed on it. Any of these can pin an image to a person for anyone who knows them.

Assistive devices and medical items are strongly identifying and often unavoidable in a clinical image: a specific wheelchair model, a prosthetic, a brace, a splint with the patient's own tape job, an insulin pump, a stoma appliance, a hearing aid, a cannula site with a dated dressing. A hospital or clinic wristband is worse still, because it may carry a name and a record number directly, and it is astonishing how often one appears in the corner of a published image.

Clothing patterns matter more than people expect. A distinctive jumper, a specific pair of trainers, a printed t-shirt with legible text. If the patient was photographed on the day they were also photographed elsewhere - at work, at an event, by a family member - the clothing links the two.

• Tattoos, including partial ones and faded ones
• Scars, birthmarks, vitiligo, distinctive moles and freckling
• Amputations, limb differences and visible deformity
• Nail art, distinctive rings and watches
• Wheelchairs, braces, prosthetics, pumps and hearing aids
• Clinic or hospital wristbands, which may carry a name outright
• Printed or distinctive clothing

The background is where the mistakes hide

Behind the subject is a whole second image nobody checked. A chart on a wall with a surname on it. A whiteboard with initials and a time. A monitor showing a patient list. A pharmacy label on a bag. A referral letter on the counter. A specimen pot with a label. Any of these can be legible at web resolution even when it looked like an unreadable smear on the camera screen.

Reflections do the same job less obviously. A window at night becomes a mirror. A powered-off monitor reflects the room, including whatever is behind the camera. Spectacle lenses reflect screens. Polished cabinet fronts and stainless steel surfaces reflect the whole room. Check each of these from the exact position the lens will occupy.

There is also the person the image is not about. A colleague passing behind, a family member accompanying the patient, another patient visible through an open door. Their presence in the image is a separate identifiability question, and a family member is often the fastest route to identifying the person in the foreground.

The file itself carries information

Photographs contain metadata: the date and time the image was taken, often the GPS coordinates, the device that took it, sometimes a device name that includes a person's name, and occasionally an account identifier. A timestamp plus a location is enough to combine with an appointment record. The image looks anonymous and the file is not.

Many platforms strip some metadata on upload and some do not, and the behaviour changes without notice. Do not rely on it. Assume the file carries everything unless you have deliberately removed it, and build metadata stripping into your process before an image leaves the practice - including images sent to an agency, a designer or a directory listing.

Filenames are a related and simpler failure. An image named with a patient surname, an initial and a date, or a record number, will happily travel to a public web server and be visible in the URL. Rename files to something meaningless before they leave the practice, and check what your website actually publishes the file as.

De-identified is not the same as anonymous

These two words get used interchangeably and they mean different things. De-identification is the removal of direct identifiers - the face, the name, the record number. Anonymity is the state where the individual cannot be identified by anyone, by any reasonable means, including by combining the image with other information that is available.

The gap between them is where small communities live. A de-identified image of a knee after a specific procedure, posted the same week the patient told their team they were having that procedure, is anonymous to the internet and completely transparent to their workplace. Blurring and pixelation are also weaker than they look - heavily compressed blurs can sometimes be partially reversed, and a blurred region still preserves outline, posture and everything around it.

The practical conclusion is not that anonymisation is impossible. It is that whether a specific image is genuinely anonymous is a judgement that depends on your jurisdiction's definition, your patient population, and what else is publicly known - which is exactly why it should be made with your data protection lead and professional adviser rather than by the person preparing the post.

Why an editing tool is not the answer here

It is tempting to treat anonymisation as an editing task - crop this, blur that, paint out the tattoo - and it is worth being clear that this is a governance decision that happens to have an editing step, not the other way round. The decision about whether an image may be published, in what form, with whose permission, belongs to the practice's consent process and its advisers. Nothing you do in software creates permission that was not given.

Flora is a general photo editor for images you already have, and its honest place in a clinic is the non-patient library: reception and interior shots with a fluorescent colour cast, equipment photos with awkward lighting, team headshots that need their backgrounds evened out. You describe the change in words or apply a look, everyday looks cost around 5 credits, and results usually come back in under a minute. It is not clinical documentation software, it has no role in the patient record pathway, and it should not be part of how any image forming part of a patient's file is handled.

One rule sits above all of this. Any image used to represent a clinical result must never have the result itself edited - not skin tone, redness, swelling, contour, scar visibility or the lighting chosen to flatter one frame over another. That is true whether or not the patient is identifiable, and it is treated by many regulators as misleading advertising. Check your own regulator's position and take professional advice rather than relying on this article.

Frequently asked