Safety Knights

Legally, yes. Since you're not the treating medical facility (e.g., hospital, clinic, etc.) and/or a TPA, then HIPAA (and the protected health information (PHI) requirements) doesn't legally apply to you as a "normal" employer. With that being said - should it be done? It depends. I try to refrain from any PHI as much as possible (even if HIPAA doesn't legally apply to me), so if discussing the person's name, showing their face, or any other revealing information isn't necessary, always try to refrain from doing so. As a best pratice, if the pictures are going to reveal any PHI, always try to get some form of consent (expressed consent is acceptable, but written is prefered) from the injured/ill employee and tell them that you're simply using the photos for incident investigation purposes, worker's comp. claims, etc. Essentially, keep everything on a "need to know" basis.

As far as the law, you could read the HIPAA regulations and see who HIPAA applies to (and doesn't apply to). You'll see that most "normal" employers are legally exempt from the HIPAA requirements.

There are also privacy protection laws. Look them up for your country and state. They are concerned with personally identifiable information (PII). The law will tell you what specifically is protected.

#1 Strictly "yes" I basically agree with Drew. HIPPA may have some applicability but again Drew has it right! There may be some state laws to be concerned (nothing in WI, MI, or MN that I know). You may have corporate or company policies to follow too! I did! My corporation had very strict guidelines on who was privy to confidential employee information.

#2 However, just because something is legal does not make it "right". I do not want my personal information spread all over, why would I allow it on someone else (as an HR Manager)?

#3 My company requires A3s on all Recordable incidents. By definition that means a cross-functional team is formed to investigate and implement corrective action (and follow PDCA). There is a fine line on what you share with the Team. So I might tell the team, "Joe had a severe laceration due to the injury." I would try not to tell them he had 15 sutures, although most would somehow know (maybe from Joe). I would definitely NOT tell them, "Most people would have been sent home with the sutures, but Joe had to stay over the weekend for IV anti-biotics due to his increased risk of infection because of diabetes". Although some or all the team will know that, but it came from Joe not me or the company!

#4 I like to prepare my own Safety Training. Sometimes taking pictures I get an employee in the picture. if the employee can be recognized I will always ASK the employee if I can use their image before I use it! If I cannot ask or they refuse I block their faces and anything else that might ID them.