Hospitals and health care professionals have quickly embraced social networking as a way to interact with patients, market their practices and share information with the health care community. Every day more providers are going online to connect with colleagues, post updates on medical topics, share health tips with patients, attract participants for research studies, track medical trends, issue press releases and announce exciting developments in their practices. The explosion of social networking has built online communities for people to communicate, interact and share information.
Some of the more popular of the social networking sites include:
– A number of hospitals have created channels on YouTube, the video sharing site that allows users to upload videos.
Facebook.com,
LinkedIn.com – These social networking sites allow users to create personal pages where they can upload messages, pictures, videos and other content and connect with friends and groups. Facebook has been deemed more social, while LinkedIn’s intent is professional networking.
Blogs – Doctors and patients are using these online diaries and journals to talk about their medical experiences and share their thoughts on health care issues and treatments.
Twitter.com – This micro-blogging service allows users to send 140-character messages (called "tweets") to their personal home page, where they can be read by followers. Earlier this year, surgeons at Henry Ford Hospital in Detroit tweeted real-time updates about a surgical procedure; video of the surgery was later posted on the hospital’s YouTube page.
However, when using such technology, health care providers must be aware of certain legal risks. The most obvious challenge for networking providers is compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which provides for the protection of the privacy of health information and regulates how certain covered entities use and disclose patients’ protected health information (PHI). HIPAA-covered entities are obligated to develop and implement appropriate safeguards designed to ensure that patients’ or clients’ PHI is adequately protected and is not used for any purposes in violation of the Privacy Rule.
In certain circumstances PHI disclosure is permitted, including: if the information is used to advance the patient’s treatment, if the information is related to the payment for the service, or if the patient consents to the specific disclosure. Additionally, a covered entity may determine that health information is not individually identifiable health information if certain identifiers are removed, including the patient’s name, address, birth date, admission date, discharge date, e-mail address and photographic images.
Providers should be extremely cautious in deciding what information to share on their social networking sites, as violations of the Privacy Rule often incur severe civil and criminal penalties. The risk of improper PHI disclosure is especially high where many employees are permitted to post to the sites or where visitors to the sites are permitted to ask detailed, personal questions or add anonymous comments to the postings.
Health care providers looking to increase their online presence should consider taking the following steps to help safeguard their online interactions:
Create Internal Social Media Policies
Providers should enact policies with guidelines and requirements for their employees’ online interactions. These policies should make employees aware of the risks of posting confidential or proprietary information and should set standards for appropriate and professional communications.
Include Appropriate Disclaimers
Providers who blog should be sure that their postings cannot be interpreted by visitors as providing diagnosis or treatment, which could violate the prohibition against unlicensed practice of medicine as well as restrictions on corporate practice of medicine. All Web pages should therefore contain appropriate, noticeable disclaimers informing visitors that the Web sites are for informational purposes only and do not provide medical advice, diagnosis or treatment. Site visitors also should be instructed to contact the physician directly for personal questions or to call 911 for medical emergencies.
Enact Networking Safeguards
Facebook and other social networking sites allow users to regulate the security features on their individual pages. Users should be careful about accepting "friend requests" and other invitations to connect with users or groups. Additionally, physicians with Facebook pages should be wary of accepting invitations from patients or posting personal images and videos, and all providers should closely monitor, or disable altogether, the comment feature on their YouTube, Facebook and Twitter sites.
Train Employees on Proper Usage
Providers also should be aware that their employees’ personal pages can be linked to their practice’s official sites. See Pepper Hamilton’s recent Labor and Employment Law Update for further guidance on monitoring employees’ online conduct: http://www.pepperlaw.com/publications_update.aspx?ArticleKey=1573.
As social networking continues to grow as a valuable health care marketing and educational tool, it becomes increasingly vital for health care professionals to remain aware of the related legal risks.
Andrew J. Siegel
