Patients have a right to privacy that should not be violated without informed consent. Identifying information, including names, initials, or hospital numbers, should not be published in written descriptions, photographs, or pedigrees unless the information is essential for scientific purposes and the patient (or parent or guardian) gives written informed consent for publication. Informed consent for this purpose requires that an identifiable patient be shown the manuscript to be published. Authors should disclose to these patients whether any potential identifiable material might be available via the Internet as well as in print after publication. Patient consent should be written and archived with the journal, the authors, or both, as dictated by local regulations or laws. Applicable laws vary from locale to locale, and journals should establish their own policies with legal guidance. Since a journal that archives the consent will be aware of patient identity, some journals may decide that patient confidentiality is better guarded by having the author archive the consent and instead providing the journal with a written statement that attests that they have received and archived written patient consent. Nonessential identifying details should be omitted. Informed consent should be obtained if there is any doubt that anonymity can be maintained. For example, masking the eye region in photographs of patients is inadequate protection of anonymity. If identifying characteristics are de-identified, authors should provide assurance, and editors should so note, that such changes do not distort scientific meaning.
-International Committee of Medical Journal Editors (ICMJE) Recommendations for the Conduct, Reporting, Editing, and Publication of Scholarly Work in Medical Journals, updated December 2013.