@jdick, however, look what I accidentally found while randomly reading on Talk. This note about 2.0 compatibility mentions a REST resource living in EMR API: PersonImageResource.
Your use case suggests that a non-obs could perhaps do the trick, so you may want to investigate that one then! I would be curious to hear about your findings.