Wound care is the part of podiatry where the record has to show change over time.

The RealityCapture belongs inside the chart

⚠️

The Problem

The photo exists in three places.

One copy in the chart, one in a camera roll, one in whatever was used to move it. Only the first is governed, and the other two are the ones that walk out of the building.

🔧

The Solution

Capture into the chart, not into the device.

Use the EHR vendor’s capture app on a practice-owned device so the image uploads and the local copy is removed, with no intermediate step to forget.

✅

The Resolution

Comparable images, one copy, one owner.

Serial photographs that can actually be compared, filed against the right encounter, on a device inventory somebody maintains.

Mobile device capture and where the image actually lands

The mobile device question is the whole problem in miniature. A phone is the right tool clinically and the wrong tool administratively, unless the path from lens to chart is designed.

Three paths, in descending order of preference

First, a capture application published by your EHR vendor, running on a practice-owned device, which uploads directly into the encounter and does not retain the image locally. Second, the same application on a personal device under a documented arrangement with containerization, which is workable but harder to prove. Third, the camera app plus a messaging step, which is what most practices actually do and which creates copies in places nobody inventories.

HHS guidance on remote use is old and still exactly on point. OCR guidance on portable devices sets out risk strategies across accessing, storing and transmitting electronic protected health information offsite, including hardware inventory with custody records, device locking, encryption of appropriate strength on portable media, and certified deletion before disposal. Read it as a checklist for the phone in the exam room, because that is what it describes.

Encryption, access control and the technical safeguards

the Security Rule sets out technical safeguards covering access control, audit controls, integrity controls, authentication and transmission security, alongside administrative and physical safeguards. Implementation specifications are either required or addressable, and addressable does not mean optional. It means you either implement it or document why an alternative achieves the same purpose.

Applied to wound images, that translates into a short list. Device-level encryption on anything that holds an image even temporarily. Authentication on the capture application, not just on the device. Transport encryption for the upload. Audit logging that records who viewed an image, which most practices never check and every EHR provides. And role-based access, because a clinical photograph of an ulcer is not something every user with a login needs to open.

The Security Rule does not name photographs, which is precisely why they slip through. They are electronic protected health information like any other, and the safeguards apply without modification. If you want a structured way to work through this, the Security Risk Assessment Tool published by ONC with OCR is aimed at small and medium providers and is free.

Image metadata: the part nobody strips

A photograph taken on a phone carries more than pixels. Image metadata routinely includes the capture timestamp, the device make and model, camera settings, and frequently the geographic coordinates where the picture was taken if location services were enabled.

Most of that is harmless or useful. The timestamp is genuinely valuable for a serial wound record. The location is the one to think about, particularly for home visits or a patient’s workplace, because it is precise and it is invisible unless somebody looks for it. It travels with the file into the chart, and it travels out again with any copy released.

Two practical steps. Turn off location tagging on practice-owned devices used for clinical photography, which is a setting rather than a project. And ask your EHR vendor what the system does with metadata on upload, because some platforms strip it, some preserve it, and very few practices have asked. Neither answer is wrong. Not knowing is.

Wound measurement and what makes a photo clinically useful

A photograph without a reference scale is a picture, not a measurement. Distance, angle and lens all change apparent size, and a series taken without discipline will show a wound that appears to grow and shrink for reasons that have nothing to do with healing.

Wound measurement from images has been studied. In one comparison of methods, one comparison of photographic and tracing methods reported no statistically significant difference between transparency tracing and photographic measurement of wound surface area, while both differed from simple linear measurement. The same authors note the obvious limitation: a two-dimensional image does not capture depth, and depth still has to be recorded separately.

The practical protocol is short and it is the thing to standardize. A disposable ruler or adhesive scale marker in frame, in the same plane as the wound. A consistent distance and angle, with the camera perpendicular to the surface. Consistent lighting, which usually means the room light rather than the flash. The same anatomical view each visit. And depth documented by measurement rather than inferred from the image. Getting the whole practice onto one protocol is where rebuilding the workflow around it pays off, because the value of serial images comes entirely from their comparability.

Retention policy and release of information

Once an image is in the chart it is part of the record, and it follows the record’s rules. That sounds obvious and produces two questions practices rarely answer in advance.

The first is release. When records are requested, are photographs included by default? A wound image is clinically relevant and frequently central to a disability or liability question, so the answer matters and should be a policy rather than a judgement call made by whoever processes the request. The second is retention. Images are large, and practices sometimes archive or purge them on a different schedule from the rest of the chart, occasionally without a written retention policy saying so. That is a documentation gap that only surfaces when somebody asks for a photograph from four years ago.

Write both down. Then check that any images held outside the EHR, on an old workstation or a departed employee’s device, are accounted for, and either brought into the record or securely destroyed. That sweep is usually worth doing inside a wider cybersecurity compliance review rather than as a standalone exercise, and the devices themselves belong under managed device support so the inventory stays current.

A podiatry wound photo documentation consultant is not what most practices need here. What they need is a written capture protocol, an inventory of devices, and half a day of training. Qventive does this work as part of our podiatry EHR and IT support and a broader podiatry practice management engagement, and the imaging path belongs in your HIPAA risk analysis from the day it goes live.

Wound imaging: common questions