Publishing information about a patient’s diagnosis online is a growing mystery to those overseeing HIPAA’s privacy and safety rules. In 2018, a pediatric nurse at Texas Children’s Hospital lost her job after posting details about an infant’s measles diagnosis on an anti-Vaxxer Facebook page. Since then, numerous clinicians and nurses have lost their license to post private information on social media. Often times, these cases lead to lawsuits and settlements from health care providers.
“In some cases, clinicians have been charged with criminal charges. But that happens in the worst cases, when a nurse or helper posts videos on social media, shows older people showering, or even having sex, ”said Diane Evans, editor of MyHIPAA Guide, an advisory and subscription service for HIPAA compliance management .
While these are the worst-case scenarios, she added, even seemingly innocuous posts from employees on social media with proprietary health information could lead to violations. Evans said she would like to see the federal government disseminate guidelines on social media, just as they have done on other HIPAA-related topics such as dealing with business partners. According to Evans, it is important for all healthcare providers to have a social media policy with clearly formulated requirements.
Continue reading
Beware of what you post
Evans recognized the potential benefits of using social media. For example, healthcare providers can attract new patients through social media websites. However, posting reviews can be a mistake. In 2016, Dallas-based Elite Dental Associates agreed to pay $ 10,000 to the U.S. Department of Health’s Office for Civil Rights (OCR) and adopt a corrective action plan to resolve potential HIPAA violations. The OCR received a complaint from an elite patient alleging the practice responded to a social media review by disclosing the patient’s last name and details of his health status. OCR’s investigation found that in response to patient reviews on the Elite Yelp reviews page, Elite improperly disclosed the proprietary health information (PHI) of several patients. Elite, a private dental practice offering general, implant, and cosmetic dentistry, did not have a policy or process for disclosing PHI.
Home care
The social media HIPAA compliance problem is particularly widespread in the care sector, Evans said. To combat the problem, it is recommended that all clinicians attend refresher training at least once a year to ensure that HIPAA social media rules are strictly followed. However, this is not commonly practiced. “This is in large part due to a lack of quality training programs and a lack of knowledge in general about the full scope of HIPAA compliance,” said Evans. “Check-the-box training once a year is not enough. This can be remedied by a social media guideline that prohibits any work-related postings on social media by employees without written permission. A sanctions policy is also a must. And it has to be well communicated so that employees know the consequences of violating an organization’s guidelines and the privacy of the people involved. “
James A. McGurk, social media manager at the University of North Carolina (UNC) Health in Chapel Hill, North Carolina, said the HIPAA privacy rules should apply to all forms of communication, including oral, written, and electronic. The handling of information in social media is particularly critical with regard to the protection of personal rights due to the wide range of social media.
“UNC Health has a formal social media policy that covers all teammates. All 13 hospitals affiliated with UNC Health have social media executives who provide basic advice to employees and executives on the appropriate use of social media channels, ”said McGurk.
This information is provided during employee orientation and onboarding and is covered in UNC’s online HIPAA training required by all teammates. Department heads interested in exploring social media usage should contact the UNC communications and marketing team before launching new social media channels. They will then be informed of privacy and HIPAA considerations.
Avoid personalized medical advice
“Our doctors and employees are advised not to offer individual medical advice via social media. However, doctors and nurses may be able to respond very broadly to questions on social media in order to properly navigate the platforms, ”said McGurk. As a social media manager, he uses various social listening tools to actively monitor all of the UNC’s social media channels and consults with a management team if there are any concerns.
This article originally appeared on the Kidney and Urology News
