The 1–2–3 Case Study Privacy Standard
Oct 07, 2026A meaningful clinical case study needs enough detail to teach. It does not need every detail you have.
For providers, instructors, and students, I believe the strongest approach is a simple triple-protection standard:
Get full, informed written authorization for the potential educational use of the case. Then de-identify everything you can, and share only what is truly needed for that specific audience and learning outcome.
Plan Ahead With an Education-Ready Authorization
I developed this standard for the NNHH Airway & Sleep Medicine Certificate Program™ capstone project and am sharing it because there is still confusion about what may—and may not—be shared legally, and ethically in a case study.
Verbal permission may be common, but it does not provide the same clear record of a patient’s understanding and agreement as written authorization. I encourage NNHH students and members to think beyond where they are in their careers today. Early in my career, I never imagined that my path would expand from daily clinical care into professional education. When that opportunity came, I realized how valuable it was to have well-documented cases and written permission to share them appropriately in courses, study groups, presentations and lectures.
Capture and document meaningful cases as they happen, and routinely obtain written permission for appropriate educational use. You never know when your clinical experience will become an opportunity to teach.
As dental hygiene expands, we will continue to expand. A case that begins as a dental case study may later become a sleep medicine or myofunctional teaching case. A cropped mouth or jaw image may be enough for the first presentation, while a full-face or profile image may later be needed to demonstrate posture, facial pattern, head-and-neck relationship, or another relevant finding.
That is why I recommend obtaining a written authorization that is broad enough to cover full face and profile image sharing and foreseeable educational use from the beginning, including:
- Certificate programs and continuing education
- Courses, study groups, lectures, workshops, conferences, and webinars
- Recorded or online education
- Professional or academic publications
The authorization should clearly describe what may be shared, including relevant clinical details and any limited identifying information that may be necessary—such as a first name or a full-face or profile image. It should also identify the educational purpose, the people or audience categories who may receive the information, the duration of permission, and the patient’s rights.
Broad does not mean unlimited. Patients should understand the educational settings in which their case may appear. Advertising, marketing, social media, and unrelated public uses should require separate permission.
Permission Does Not Replace Privacy
Even with a signed authorization, I recommend using the least-identifying version of the case that still teaches the point.
Start with these options:
- Eye blocks when the eye area is not relevant
- Cropping to the clinical area being discussed
- Focused images of the mouth, jaw position, head and neck, posture, or another relevant feature
- Age ranges and generalized details instead of dates, locations, or personal history that do not add clinical value
- No name at all unless a name reference is genuinely necessary
A first name and a full-face photograph are identifying information. Under HIPAA’s Safe Harbor method, names and full-face photographs or comparable images are identifiers that must be removed for information to qualify as de-identified. That is why best practice requires both written permission and privacy minimization.
When a Full Face, Profile, or First Name Is Needed
Use a more identifiable detail only when the case study would be less accurate, less understandable, or unable to meet its learning objective without it.
For example, a full profile may be essential in an airway or myofunctional case if a focused mouth or jaw image cannot show the relevant relationship. In that situation, the provider may use the full image because the patient gave clear written permission for that educational use.
The same rule applies to a first name: use it only when it adds something essential to the educational situation. If individual distinction matters—for example, when comparing twins—use the least-identifying label that still makes the point. “Twin A” and “Twin B” may be enough; use first names only when they are truly necessary. When in doubt, leave them out.
A Quick Note About Referrals
This 1–2–3 standard applies to educational sharing with people who are not treating the patient.
A referral or treatment consultation with another provider involved in the patient’s care is different: the purpose is patient care, and the receiving provider may need identifiable records, images, and clinical history to evaluate or treat the patient. HIPAA generally permits provider-to-provider sharing for treatment without a separate written HIPAA authorization.
Follow your organization’s referral process, use approved communication methods, and share information that is relevant to care.
The 1–2–3 Case Study Privacy Standard
- Get full, informed written authorization first. Make sure it covers foreseeable educational settings, identifiable images that may be needed—including full-face and head/torso profile views—the audience categories, and the duration of permission.
- De-identify everything you can. Use eye blocks, cropping, focused images, and nonidentifying case details whenever they still show the clinical point.
- Use only what the case truly needs. Include a first name, full-face image, or profile image only when it is necessary for the learning objective and permitted by the patient’s written authorization. Different audiences may require different amounts of information. Always audit yourself to ensure your are putting patient privacy at the forefront.
That is the balance: protect the patient as much as possible while preserving the clinical information needed to make the case study effective.
References
- U.S. Department of Health & Human Services, Office for Civil Rights. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule.
- 45 CFR § 164.508 — Uses and Disclosures for Which an Authorization Is Required.
- 45 CFR § 164.506 — Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations.
This article provides general educational information and is not legal advice. HIPAA applies to covered entities and business associates. Employer policies, professional requirements, state laws, and contracts may impose additional obligations.
AUTHOR
Jamie Dooley, BIS, RDH, CWDP
Jamie is the Program Director at the National Network of Healthcare Hygienists (NNHH), leading the movement to position dental hygienists as essential, high-impact members of interprofessional healthcare teams. With a background in dental public health, coaching, and workforce development, Jamie champions a vision where hygienists expand their professional identity as oral-systemic experts within the broader healthcare landscape. Under her leadership, NNHH launched the world's first ANSI-accredited certificate program for dental hygienists, establishing a global benchmark for post-licensure excellence. A recognized thought leader in medical-dental integration, Jamie is dedicated to empowering RDHs to bring their specialized expertise into diverse medical settings, transforming patient outcomes through collaborative, person-centered care.
