Where to Store Patient Photos: Camera Roll, Drive, Dropbox, or Something Else?

Most practices don't decide where patient photos live. It just happens. Someone takes a picture on their phone, texts it to a coworker, and by Friday it's in four places.

This guide walks through the places photos usually end up, which ones can work, and what to ask before you trust any of them.

The short answer

Patient photos can live anywhere that has three things: a signed Business Associate Agreement (BAA) with the company that stores them, access controls that limit who can see them, and a way to remove them when a patient asks. A personal phone, a free cloud account, and your website's image library usually have none of the three.

Why photos count

HIPAA protects health information that could identify a patient. A photo of a face does that on its own. The rules for removing identifiers from health data specifically list full-face photographs and comparable images. Photos of a body can also identify someone through a tattoo, a scar, or a birthmark.

The safe assumption: if a patient could recognize themselves in the photo, treat it as protected health information until you know otherwise.

What a BAA is

A Business Associate Agreement is a contract between your practice and a company that handles patient information for you. The company agrees to protect the information, limit how it uses it, and tell you if something goes wrong.

If a vendor stores your patient photos, that vendor is generally acting as your business associate. You want the BAA signed before the first photo goes in, not after.

A BAA is one piece of the picture. It doesn't replace written patient permission to use a photo in marketing. That's a separate step, covered in our guide to getting patient consent for before and after photos.

Where photos usually end up

A few of these deserve more detail.

Google Drive and Dropbox

Both can be used with patient information, but only on the right accounts.

Google will sign a BAA for paid Google Workspace customers, and the agreement lists Drive as a covered service. Free consumer accounts aren't eligible. Even with the BAA, Google's own guidance puts the responsibility for using its services correctly on the customer. That means turning off public links and restricting outside sharing.

Dropbox works the same way. It offers a BAA only on certain paid business plans, and personal accounts don't qualify. Plan names change, so ask Dropbox which plans are covered today.

Two cautions apply to both. A BAA covers the vendor's own service, not the apps you connect to it. And "we signed a BAA" isn't the same as "our setup is safe." Default sharing settings on most tools are looser than a medical practice should leave them.

Your website

This one surprises people. A photo that appears on a public web page is public. When a gallery is built from your website's own media library, those image files can be loaded by anyone who finds the address.

Some platforms also don't offer agreements that cover patient photos. Squarespace's BAA, for example, applies to its Scheduling product, not to the rest of the platform. Ask your website platform directly, and don't assume.

Phones and texts

Phones are the real problem, because they're how most photos get taken. A photo snapped on a personal phone usually lands in a camera roll that backs up automatically. From there it can reach a personal cloud account, a family tablet, or a laptop nobody at the practice manages.

If your team takes photos on phones, move them out the same day into a system you control, and delete the originals. A dedicated photo app that sends images straight to secure storage is better than relying on discipline.

Four questions to ask any vendor

Before you upload a single patient photo, ask:

1. Will you sign a BAA before I upload anything? If the answer is no, or "we're working on it," you have your answer.
2. Where are the photos stored, and who at your company can see them? You're looking for private, encrypted storage and a clear answer.
3. What happens when a patient withdraws permission? You should be able to take the photo offline right away, and the vendor should be able to explain when it's fully deleted.
4. Do you remove location data from photos? Phone photos can carry GPS coordinates and device details inside the file. You don't want those published.

Proova strips location and device data from every photo on upload. Cases stay offline until patient consent is confirmed, and withdrawing consent takes a case offline immediately.

One thing to know up front: Proova is a public showcase, not a records system, and it doesn't offer a BAA right now. Keep your clinical photos in a system that has one, and use Proova only for photos patients have signed off on showing publicly. Upload a case after the patient has signed, not before. Ask your attorney whether that setup works for your practice. If they say the company hosting your public gallery must sign a BAA, Proova isn't the right fit yet. Proova is a small company built by one person, so you'll reach the person who built it.

What to do with photos that are already in the wrong place

You probably have some. Almost every practice does. Don't panic, and don't delete anything before you've moved it.

1. List where photos live now. Phones, shared drives, email, old hard drives, your website.
2. Pick one approved home. One place for clinical records, and one for the public gallery.
3. Move the photos. Confirm the copies opened correctly in the new place.
4. Delete the originals. Phones and personal accounts first.
5. Write a one-page rule for your team. Where photos go, who can take them, and what's off limits. Put it in your onboarding.
6. Check for patients you can't reach. If a photo is already public and you don't have written permission, take it down and talk to your healthcare attorney.

Frequently asked questions

Can I keep patient photos on my phone? It isn't a good idea. A personal phone usually has no agreement behind it, and photos often sync to personal cloud accounts you can't control. Move them to approved storage quickly.

Is Google Drive okay for patient photos? It can be, on a paid Google Workspace account with Google's BAA signed and sharing locked down. Free personal Google accounts aren't covered.

Do I need a BAA for my gallery tool? If the tool stores photos of identifiable patients for you, generally yes. Ask for it before you upload anything. A healthcare attorney can confirm what applies to your practice.

Does a BAA mean I can post any photo I want? No. A BAA covers how a vendor handles the photos. You still need written permission from each patient before using a photo in marketing.

What about photos where you can't see the face? Be careful. Tattoos, birthmarks, and scars can identify someone. Treat the photo as protected unless a professional tells you otherwise.

---

Proova keeps your results in private storage, strips location data on upload, and tracks patient consent on every case. Start free, no credit card. This post is general information, not legal advice. Your healthcare attorney can tell you what applies in your state.