Here's an interesting article on the topic- bringing in the idea of disaster victim photos on the news, and how they could be considered unethically violating the spirit of this ideahttp://academicobgyn.com/2010/02/04/hipaa-medical-case-reports-and-unbalanced-benefit-in-news-reporting/
In the article they list what HIPAA considers to be identifying info
HIPAA specifies 18 elements that cannot be published without express patient consent:
2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
4. Phone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social Security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints;
17. Full face photographic images and any comparable images; and
Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)
And a comment from the author "As such, the publication of a de-identified medical image along with general comments about the case, whether on the internet or in print, is a HIPAA compliant activity, and therefore should be kosher."
I like that he stated he is taking down any photos that the patient could identify as themselves, even if other could not. I think that's a fair standard to hold to- as if even the patient could not ID the photo- it is as anonymous as anything in the life can be.