How do I keep medical photos out of my camera roll?

The dermatologist asked you to photograph the rash every few days. You took a picture of a wound after surgery and of a mole you want to watch. There is a pill bottle, and a lab result on a screen. Now those photos sit between your friends and your dinner. One of them showed up in a slideshow on the family TV. This page covers where medical photos travel from the camera roll and what the law covers. It also shows how to keep a record a doctor can use. We checked each fact against HHS and Apple on 2026-10-08.

Where a medical photo goes from the camera roll

A photo in Photos is not in one place. It is in several:

• Memories, Featured Photos and widgets. The phone picks photos for you. It shows them on the home screen, the lock screen and in slideshows. Our page on memories that show private photos covers how to take a photo out.
• Search. Apple says the location in each photo lets you search for it in Photos by place. Anyone holding the open phone can search.
• Every device on your account. With iCloud Photos on, the photo goes to your iPad and your Mac. It also goes to any family device that shares your Apple Account. Our page on iPhone photos showing on a family iPad explains the fix.
• The cloud. Apple’s iCloud security overview puts Photos under standard data protection, where Apple holds the keys. Only Advanced Data Protection makes Photos end-to-end encrypted. See is iCloud Photos end-to-end encrypted.
• The file itself. Apple says Camera embeds “location coordinates” in each photo when Location Services is on. A photo taken at a clinic carries the clinic’s location.

Deleting is not instant either. A deleted photo waits in Recently Deleted for 30 days. Our Recently Deleted guide shows how to clear it.

What HIPAA covers, and what it does not

Many people assume medical privacy law covers medical photos. On your own phone, it usually does not.

HHS enforces HIPAA. It says the rules apply only to “covered entities and business associates”. Covered entities are health plans, most health care providers and clearinghouses. Your phone is not one of them. HHS says the HIPAA Rules “generally do not protect” health information “stored on your personal cell phones or tablets.”

The same goes for most apps. HIPAA usually does not protect data you enter into an app for personal use. The exception, HHS says, is an app that your provider or its business associate gives you.

So the photo of your rash is as safe as the place you keep it. HHS’s own advice ends here: “limit what personal information you send and store on or through the device.”

The Health app is a different case

Apple treats Health app data more strictly than Photos. Apple encrypts all Health app data on a locked phone, except your Medical ID. With two-factor authentication and a passcode, Health data in iCloud is end-to-end encrypted. Apple says it “does not have the key”.

That protection covers what is in the Health app. It does not reach a photo of a test result in your camera roll.

Keep a record a doctor can use

A photo log of a rash or a wound helps only when the dates are right.

1. Take each photo in the same light and from the same distance.
2. Keep the original capture date. Apple Photos shows the date and time of each photo. Its guide also shows that anyone can change them with Adjust. Do not edit the dates.
3. Keep the photos for one condition together, in one album.
4. Write down what changed next to each photo: pain, size, color, medicine.
5. Bring the album, or send copies through your clinic’s patient portal if it has one.

When someone else needs to see a photo

A partner wants to see how the wound looks. A sister who is a nurse asks for a photo. A text or a chat message makes a full copy on their phone, in their backups and often in their photo library. You cannot take it back.

York Vault sends a private share link instead. The photo stays encrypted, the link ends after a set time and a set number of opens, and you can stop it at any time. On Free, a link ends after 7 days or 3 opens, whichever comes first. The person can open it in York Vault, in the App Clip on iPhone, or in a browser.

Where York Vault helps

York Vault keeps medical photos in a library with its own code, on iPhone and Android. Nothing in it appears in Memories, widgets, search or iCloud Photos.

• Take the photo inside York Vault. The private camera saves straight into your library. Nothing goes to Photos or Recently Deleted. Location is off unless you turn it on.
• Move the ones you already took. York Vault removes the originals from Photos only after it checks each copy. See import and cleanup.
• Dates stay right. York Vault keeps each photo’s capture date, camera data and original file name inside the encrypted record. It sorts by the capture date, not the day you added it.
• Notes next to the photos. Write the symptom log as an encrypted note with a checklist, or record a voice note. See notes and voice notes.
• Lab results and letters. York Vault stores any file type, and the viewer opens PDFs, with search inside them.
• One album with an extra lock. An album code keeps the medical album closed even when the library is open.

When you share or export, York Vault removes the location and camera details by default. For a doctor who needs the dates, turn on Keep details for that share. Everything backs up encrypted to your own iCloud or Google Drive. A new phone does not mean a lost record.

If you care for someone else’s health records too, read keeping a parent’s medical documents on your phone.