How to handle confidentiality when sharing photos in teletherapy

Teletherapy is a regular part of Australian speech pathology, connecting families in Sydney and Melbourne with clinicians in regional and remote parts of Western Australia and northern Queensland. A parent may upload a lip photo for assessment, then a clinician shares it with a school or supervisor. Every transfer can expose health information, so confidentiality needs a deliberate workflow.

Images can identify a child without a name. Uniforms, school badges, home interiors, documents, faces and spoken names may reveal identity; oral images can also show treatment or developmental information. Screenshots, cloud-synced folders and accidental recordings create risks that a paper file never had. The key questions are who needs the image, for what purpose, and how access and deletion will be controlled.

For many Australian health services, the Privacy Act 1988 and Australian Privacy Principles provide the privacy baseline, alongside professional, workplace and school requirements. A workable routine is to agree on consent, collect only what the task needs, use an approved transfer method, and record what was shared and when it should be removed. This keeps collaboration practical while protecting the client.

Set consent before the camera comes out

Begin with a plain-language explanation. Say what will be photographed, why it is needed for assessment or treatment, who will see it, whether the original or a copy will be used, and how long it will be retained. A picture of lips, teeth, tongue or a child’s face is health information, not ordinary homework. Offer a video observation or verbal description when clinically reasonable and safe.

For a child, seek consent from the parent or legal guardian and involve the child in age-appropriate ways without making refusal difficult. Confirm which caregivers or decision-makers are authorised; Australian families may include kinship carers, interpreters or several households. Where an Aboriginal or Torres Strait Islander child is involved, ask the family about any community or cultural protocols for images, alongside formal consent. Consent should name the purpose, recipients, storage, access and withdrawal process. Agreement to therapy does not automatically allow sharing with a school, supervisor, private provider, researcher or marketing audience, so ask separately for each distinct use and document it.

Minimise identifying details in every image

Collect only what the clinical question requires. Use a case code instead of a full name or date of birth in filenames, and crop out school logos, documents, jewellery and distracting backgrounds. For articulation work, focus on the mouth and teeth while avoiding an unnecessary full-face image. Use a neutral surface and keep incidental identity details outside the frame.

An image can carry both clinical and personal context. A review of sensitive clinical images in Wiskott-Aldrich disease and petechiae illustrates why an image should be treated as health information rather than a casual snapshot. Preserve useful lip or tongue detail while removing incidental identity cues. Check the original for location metadata and keep it only when clinically necessary. If needed, make a redacted working copy, but do not rely on editing a screenshot when a fresh, staged photograph is possible.

Choose an approved and verifiable transfer channel

Use the channel your service has approved for clinical files, not simply the easiest app available. Australian clinics may use Zoom, Microsoft Teams, Google Meet or a practice-management system, but access to a video meeting does not automatically make chat or file sharing suitable for identifiable images. A secure portal with named accounts, access controls and audit history is usually a better fit than a personal messaging app.

For an upload link, check the recipient, set an expiry date where possible, restrict downloads, and send a password through a separate verified channel. For larger files, use an organisation-approved encrypted transfer service and confirm the address before sending. Avoid family groups, personal email and consumer cloud drives, where copies and backups are hard to locate. If data is stored outside Australia, ask your privacy lead about contractual and security safeguards.

Control storage, access and deletion

Receiving a photo is the beginning of its life, not the end. Save it in the approved clinical system rather than a personal camera roll, and use a case code, date and purpose in the filename. Give access only to people who need it, turn on multifactor authentication, lock screens, and use role-based folders where available. Shared reception computers and family devices need the same care as clinic equipment.

Set a retention date consistent with your clinical record and legal obligations, then delete working copies when the task is complete, including downloads, chat attachments and copies on personal devices. Record the consent and sharing decision alongside the image rather than relying on its filename. Teams can use the SLP resource collection for training and printable blank checklists; shared materials must never contain client names, class lists or recognisable photographs. A simple disposal routine is more reliable than relying on memory.

Have an incident plan for a misdirected file: request deletion, suspend further access, notify your manager or privacy lead and document the event. Assess whether affected people or the Office of the Australian Information Commissioner must be notified, but do not delete the record of the incident itself.

Keep live sessions and screen sharing under control

Protect the live session as carefully as the file. Before joining, close unrelated tabs and documents, check what is visible behind the camera, use headphones, and tell family members not to film or post about the session. Turn off automatic recording, transcription and cloud-saving features unless the privacy settings and a specific consent cover them. Shared living spaces in Australian homes can reveal address details, school notices or other relatives.

If a clinician takes a photograph during an appointment, announce it first, explain what will be captured and make the minimum image needed. Do not use a recording as a photo library or capture a teacher’s screen without permission. If someone takes a screenshot, address it promptly, ask for deletion and follow the service’s incident procedure. Clear expectations at the start prevent a private conversation becoming a family-group photo.

Coordinate sharing with schools, supervisors and ABA teams

Collaboration provides useful checks, but each organisation may have different access rules. For school caseloads, align with the child’s school or state education department’s policies. For private care, clarify whether the team is delivering Medicare-funded telehealth, NDIS supports, private health insurance or another service. When a school clinician works with a private ABA provider, the ethical privacy guidance can help structure conversations about client information, supervision and boundaries.

Agree in writing on who may upload, who may view, whether images can be used for teaching or supervision, and when deletion occurs. Send the minimum necessary to the named recipient, not a full classroom record, and confirm receipt. If a provider uses another platform or stores data outside Australia, assess that arrangement first. If consent is refused, choose an observation, written description or live demonstration, and record the alternative so the team is not pressured to share. A practical comparison:

Sharing method	Confidentiality strengths	Main risks	Practical safeguard
Clinical portal or secure upload	Named accounts, permissions and access history	Incorrect permissions or forwarded links	Use for routine transfers; verify access and expiry
Organisation-approved encrypted transfer	Encryption and controlled sending	Link forwarding or the wrong recipient	Restrict downloads and confirm the address
Email	Familiar to many families	Misaddressing and inbox retention	Use only under policy, with minimum information and encryption
Personal messaging or consumer cloud	Convenient on a personal device	Uncontrolled copies and unclear retention	Avoid for identifiable images unless explicitly approved

Build a routine your team can actually follow

Create a one-page photo-sharing protocol for your caseload and team. Include a consent script, one approved upload route, filename rules, access limits, deletion dates and an incident checklist. Use the same wording across teletherapy, school visits and supervision, and review it when platforms, devices or service arrangements change. A folder structure of Date, Case Code and Purpose makes auditing easier without exposing names.

Start with an audit of existing photo folders, remove unneeded duplicates and check whether anyone is using personal messaging for clinical images. Train colleagues and tell families what to expect, including how to withdraw future sharing. Then put the routine into action: create the approved upload folder, issue the consent wording, record each transfer and schedule disposal. Make every client image secure, documented and consent-led from the moment it is captured.