HIPAA and Social Media – The Basics of Being Social and Ethical

Social media is everywhere. Facebook, Twitter, Instagram, Snapchat and blogging, chat rooms and discussion forums, not to mention the comment sections on numerous websites, have irreversibly changed the world of communication. Social media platforms have greatly expanded our ability to share information and exchange ideas while providing a global platform for bringing people together.

The ubiquity of social media has not, however, been free from some significant problems, many of which are related to privacy rights, ethical issues, or both. Health care is one area where these complications abound, where privacy and confidentiality are constantly subject to unlawful (as regulated by federal and state law) and/or unethical disclosure. As a result, much has been said and written about legal issues as they relate to The Health Insurance Portability and Accountability Actand (HIPAA) and social media. The basics of being ethical when dealing with HIPAA and social media, however, have not been examined to nearly the same extent. 

Resources such as npr.org and pbs.org provide general information regarding ethical factors that impact the use of social media. They do not, however, address the considerations unique to health care providers, facilities and insurers. 

HIPAA and state privacy laws alike provide some direction and guidelines to parties who have access to confidential and/or private patient information and the means by which to disseminate that information. Of course, regardless of how well the applicable legislation may have been drafted, no law can contemplate all the possible circumstances that may arise when dealing with information regarding the identity, diagnosis, treatment or prognosis of a medical patient. Situations often arise that require an ethical rather than legal assessment. 

Given the potential liability (both civil and, in some cases, criminal) for unauthorized release of the confidential and/or private medical information of a patient, HIPAA and social media considerations should always err on the safe side. In other words, think of HIPAA as the minimum standard of what you can or can’t do.

Say, for example, that you believe the Act permits the action you’re contemplating taking but you’re not entirely sure. Or perhaps the Act appears silent on your set of circumstances. What to do? 

First and foremost, you need to evaluate the information to determine whether it could, with any effort, enable the reader to identify the patient and/or patient’s family. Successful integration of HIPAA and social media requires that any disclosure related to a patient may not contain sufficient information that would enable a reader who has no need to know be able to recognize the patient either directly or indirectly.

For example, providing enough information that someone could pinpoint a specific hospital ward or family and, with a little investigation or extrapolation or correctly “guess” who the patient is might be would considered a violation of applicable law or a breach of ethics. 

So what if you really aren’t sure? Is there any guiding principle that would keep you from running afoul of any ethical considerations in the context of HIPAA and social media? Perhaps.

Remember that the primary responsibility of any health care provider is “to do no harm.” Ask yourself, then, whether posting a heartwarming tale about a patient on Facebook (even if you don’t include the name), an Instagram photo of a glorious floral arrangement delivered to a hospital room, or sharing a short video story on Snapchat could possibly let others know who your social media post is about. If so, then potential harm exists and you should probably not send it.   

If you have any question about HIPAA and social media as it relates to sharing information about someone in your care, the answer is fairly simple: When in doubt, don’t.

–

Elliot Health System uses social media regularly. Make sure to like us on Facebook and follow us on Twitter.