As other users mentioned, these screenshots are almost certainly not being transmitted as screenshots as the bandwidth costs would be enormous. The screenshots are converted to a hash on the user’s device before being sent to a server where the hash is compared to a database of known hashes. A user’s x-ray would just appear as a hash. This might still constitute a HIPAA violation, but I doubt it.
I’m not sure what relevance there is to other providers?
I work with a lot of small medical offices, and they do use consumer Smart TVs in some contexts. I typically limit their network access for other reasons, and displaying X-rays isn’t something I’ve personally facilitated, but it wouldn’t shock me to discover it’s being done in other clinics, and the popularity of cloud-based ePHR software has left a lot of smaller clinics with very limited internal I.T. services.
The destination isn’t relevant, if the image leaves the clinic at all without consent, that’s a HIPAA violation. Fortunately, I think it’s more likely that the images are sampled and/or hashed in a way that means the full image isn’t technically transmitted, but considering the consequences and costs of a data breach, I’d definitely be wary of it.
