Protecting Patient Information in a Facebook World

By Will Smith
Monday, February 1, 2016

Social media offer great potential for engaging with patients. But with Facebook, Twitter and other social media forming an integral part of both the professional and personal lives of high numbers of young medical professionals in particular, opportunities for disclosing protected health information (PHI) have multiplied.

“It’s one thing to say, ‘Don’t post PHI on social media,’” says Daniel Shay, JD, Esq., Associate at Alice G. Gosfield & Associates in Philadelphia. “Everybody gets that in a broad, conceptual sense and says, ‘Of course. I’d never do anything so stupid’ — and then they take a selfie at work and there’s a patient walking by in the background.”

Without consent, a picture taken of a patient by a provider in a healthcare facility is PHI because it identifies the patient and, most likely, the location of the photo. But the potential to publicize the fact that a particular individual received treatment can take many other forms as well.

Mississippi TV station WLBT reported one such incident. After then-Gov. Haley Barbour posted a question on Twitter in 2009 asking for ways to trim the state budget, an administrative assistant at the University of Mississippi Medical Center (UMMC) tweeted a response reading, “Schedule regular medical exams like everyone else instead of paying UMC employees over time [sic] to do it when clinics are usually closed.”

The tweet referred to Barbour’s allegedly scheduling an after-hours checkup. Though it didn’t mention him by name or provide details of care, the woman says UMMC suspended her for three days and pushed her to resign. She soon did.

In a letter to the station, UMMC stated: “Disclosing a patient’s protected health information is a policy violation that we take very seriously.”

Ethics Education

Training healthcare providers to avoid divulging PHI is a complex endeavor.

“Our focus in the education of health professionals needs to be on guiding students in navigating the practical and ethical challenges presented by social media,” says Daniel George, PhD, Assistant Professor in Medical Humanities at Penn State Hershey College of Medicine. “How do you remain mindful of changing privacy settings and make sure you are protecting yourself? What is your thought process if a patient tries to friend you on Facebook?”

“When the instinct is, ‘Post first and think later,’ you really need to be training people in the training process, not just once they’re in the workforce. You need to be training them to think about the legal realities and to get them familiar with the fact you can get in serious trouble if you go posting information you shouldn’t be posting.”
— Daniel Shay, JD, Esq., Associate at Alice G. Gosfield & Associates

As medical and nursing schools graduate the first generation of students who were exposed to social media from childhood, helping those young providers view social media usage in a starkly different light is vital, observers say.

“Students who are growing up with social media now are not growing up with it in the context of professional lives,” says Bradley Crotty, MD, MPH, Instructor of Medicine at Harvard Medical School and on staff at Beth Israel Deaconess Medical Center. “This is something students will need to work through: how they translate their personal social media life and identity into a professional identity.”

Best Practices

The American College of Physicians (ACP) and the AMA have both issued position papers regarding healthcare professionals’ ethical use of social media. In addition to cataloging potential benefits and dangers, the recommendations highlight practices that can help administrators, providers and those responsible for creating health organizations’ social media policies avoid certain pitfalls.

Key recommendations include:

  • Establish rules for patients’ friend requests or requests for medical recommendations, and direct patients to use your preferred method of contact.
  • Obtain consent before posting any patient information online, even a posed picture or a private, online discussion of a patient’s condition with another physician.
  • Provide employee training on less obvious examples of PHI disclosure and improper social media use.
  • Never post anything online you wouldn’t want next to your name on the front page of a newspaper.
  • Take advantage of platforms’ privacy settings.

Some entities may be tempted to create blanket rules against employee use of social media. However, such policies are likely to be ignored. Outright bans may also violate workers’ rights: The National Labor Relations Board has ruled, for instance, that employers’ social media policies may not prohibit employees from discussing working conditions.

Caution, Not Avoidance

A little wisdom and discernment can go a long way, Dr. Crotty notes.

“Consider every post public and indefinite,” he urges. “Don’t avoid social media, but be thoughtful about engagement.”