Ethical HOF Portfolio: Document Cases Without Exposing Patients

Every orofacial harmonization (HOF) professional accumulates, over time, hundreds of photos of faces. They are your clinical repertoire and, at the same time, the most sensitive material you hold. The temptation to turn them into a portfolio is strong, because well-documented cases teach, persuade colleagues and help calibrate expectations. The problem is that a face identifies the person, and the relationship between image, consent and publicity has layers. This guide proposes a way to organize a portfolio ethically, at a review level. Advertising rules vary by professional board in Brazil, and data protection rules come from the law. Check the current rules before deciding.

What is the difference between clinical record, portfolio and publicity?

Three different things are often treated as one.

The most common mistake is assuming that a photo taken for the patient record can be used anywhere. It cannot. Each purpose has its own authorization. See consent and LGPD for photos.

Why does a facial image require so much care?

The LGPD (Brazil's general data protection law) treats health data as sensitive personal data. A clinical face photo is both health data and potential facial biometric data. The law requires an appropriate legal basis for processing, a specific purpose and security measures. The LGPD legal basis for the patient record does not automatically extend to use in publicity.

Beyond the data protection law, there is professional confidentiality and your professional board's rules. A leak or misuse of an image can bring ethical, civil and administrative consequences, and the harm to the patient is hard to repair.

How do you obtain useful consent?

Well-made consent is specific, written and revocable. Avoid the generic clause "I authorize the use of my image" buried in the middle of the treatment form. The ideal is a separate document that the patient can accept for each purpose.

The full reasoning is in image use consent form, and the list of authorization situations appears in image authorization for promotion: how to bring it up and image authorization for the patient record only. The case of minors has its own rules, in image authorization for minors.

How do you organize a portfolio in practice?

An ethical portfolio is, above all, a well-organized one. The structure below works for internal use and as a basis for any future publicity.

1. A folder separate from the patient record. Selected copies, with specific authorization recorded, not the original file.
2. An internal identifier, without a name. Use a code only you can link to the patient, stored elsewhere.
3. Minimal metadata. Area treated, date, interval between photos, clinical notes. No contact details.
4. Authorization record. For each case, the signed form and the permitted purpose.
5. A fixed photographic standard. Same light, distance and expression. See standardized clinical photography.
6. Controlled access. Password, encryption and backup, avoiding sending images through personal apps without protection.
7. Periodic review. Delete what no longer has a purpose or authorization.

Patient record retention follows its own timeframes, set by legislation and your professional board's rules. See patient record retention. A portfolio, being an additional use, should be reviewed more strictly.

What should you do when the patient does not authorize?

Not every case goes into the portfolio, and that is fine. There are three ways out:

• Use the case internally only, for study and discussion with colleagues, if the patient authorized that purpose.
• Describe the case in text, without an image, in language that does not identify the person.
• Use a fictional person or a simulation, clearly labeled, to demonstrate the method.

The third option is the safest for public promotion. An illustrative simulation exposes no real patient, as long as it makes clear it is not a result.

How is publicity regulated?

Each professional board has its own rules on advertising procedures, using before-and-after images, mentioning techniques and products, and permitted language. CONAR also gives guidance on advertising in general. There is no single rule for all professionals. The starting point is in what you can advertise: CFO and CONAR and in your professional board's current guidance.

Some principles that usually apply, without replacing the rules:

• Do not promise results. An image is not a guarantee.
• Do not induce consumption with price appeals, giveaways or special conditions, according to the applicable rules.
• Do not expose a patient in an embarrassing situation or in a vulnerable state.
• Say that results vary from person to person.
• Make the nature of the image clear, especially if it is a simulation or an edited image.

What about AI-generated images and simulations?

AI-generated images and result simulations have a different status: they are not the record of a real procedure. That solves part of the privacy problem but creates another, leading the public to think it is a result. The care is to label clearly and never present the simulation as the result of a procedure. See illustrative simulation and AI in facial harmonization.

How do you protect images day to day?

Avoid leaving patient photos in your personal phone gallery, synced to clouds and apps without control. If the device is lost or the messaging app is compromised, the leak is yours. See also security incident for what to do if the worst happens.

Which mistakes show up most often?

1. Assuming treatment consent covers publicity.
2. Posting with a bar over the eyes thinking it is anonymized.
3. Using a patient's photo in a course, conference or message group without authorization.
4. Storing images in personal apps without protection.
5. Not recording the authorization and later being unable to prove it.
6. Ignoring a removal request from a patient who changed their mind.
7. Mixing real cases with simulations without labeling.

What to take into your routine

An ethical portfolio starts before the photo: with the right form, the right question and the right folder. Separate clinical record, study and publicity; ask for authorization by purpose; treat the face as identifiable; store securely; review from time to time; and, when you need to demonstrate without exposing, use a fictional person or a clearly labeled simulation. It is extra work, and it protects the patient and your career.