Social Media as a Privacy Risk
Social media use by healthcare employees creates significant risk of inadvertent or intentional disclosure of protected health information. RHIA candidates should understand that even posts without a patient's name can constitute a HIPAA violation if the patient could reasonably be identified from context, such as a description of a unique injury, room number, or unusual circumstance.
Common Violation Scenarios
Typical violations include employees photographing patients or their charts without authorization, discussing patient cases in a way that reveals identifying details, or posting images taken in clinical areas that inadvertently capture patient information in the background, such as a whiteboard listing patient names and diagnoses.
Elements of an Effective Social Media Policy
- Clear prohibition on posting any patient information, images, or identifiable details without proper authorization
- Guidance on personal social media use during work hours and on hospital premises
- Rules regarding employees "friending" or communicating with patients through personal social media accounts
- Requirements for using organization-approved channels when responding to patient reviews or complaints online
- Disciplinary consequences clearly outlined for violations, up to and including termination
Marketing and Authorized Use
Healthcare organizations may use patient stories or images for marketing purposes, but only after obtaining a valid, specific authorization that meets HIPAA requirements, distinct from a general treatment consent. The authorization should specify how the content will be used, where it will be posted, and how long the authorization remains valid.
Training and Enforcement
Compliance programs should incorporate social media training into new employee orientation and annual refresher training, using real-world case examples of enforcement actions to illustrate the consequences of violations, which have historically included significant financial penalties and termination of employment.
Monitoring and Incident Response
Organizations should establish a process for monitoring public social media mentions of the organization and a clear reporting pathway for employees who witness a colleague's inappropriate post, feeding into the organization's broader breach investigation and sanction process.
Exam Tip
Remember that identifiability, not just the absence of a patient's name, determines whether a social media post constitutes a privacy violation under HIPAA.