Fishing For ‘Likes’ Could Get A Bite

by: Keyur G. Shah

Few things are as synonymous with the millennial generation as social media, a close second being avocado toast. As millennials proliferate into the work force, and into healthcare facilities, social media and internet commentary presents a greater risk for HIPAA breaches than ever before. Regardless of whether facilities are utilizing the internet for marketing or community engagement, educating staff on HIPAA and the dangers of a breach are paramount, and also required by federal regulations.

It is estimated that 80% of internet users utilize social media in some form, including to research healthcare facilities and providers as well as reading and leaving reviews. Employees need to be educated on HIPAA compliance as it relates to their personal social media posts and their activity on business social media accounts. A lapse in judgment could costs a provider hundreds of thousands of dollars as internet users can easily screenshot webpages and have evidence at hand.

Social media is not just limited to Facebook, Twitter and Instagram; Google and Yelp are also popular review sites. It is important to keep in mind that how a healthcare facility interacts with the internet is not dissimilar to speaking directly with the media or sending fliers out to the community. A good rule of thumb is to refrain from posting things that you would not say out loud in a crowded elevator. The risk of not maintaining the confidentiality of protected health information is great, and the Office of Civil Rights has many enforcement actions that demonstrates this. An article published November 16, 2018, by the Department of Health and Human Services describes a case where an allergist settled an allegation of a HIPAA breach with a $125,000 payment. The press release indicates:

“In February 2015, a patient of Allergy Associates contacted a local television station to speak about a dispute that had occurred between the patient and an Allergy Associates’ doctor. The reporter subsequently contacted the doctor for comment and the doctor impermissibly disclosed the patient’s protected health information to the reporter.

OCR’s investigation found that the doctor’s discussion with the reporter demonstrated a reckless disregard for the patient’s privacy rights and that the disclosure occurred after the doctor was instructed by Allergy Associates’ Privacy Officer to either not respond to the media or respond with “no comment.” Additionally, OCR’s investigation revealed that Allergy Associates failed to take any disciplinary action against the doctor or take any corrective action following the impermissible disclosure to the media.”

A Google review or a Facebook post could yield the same results. Providers need to take care in how they respond to internet users who may leave reviews or posts online regarding their facility. Even when a review is not complimentary and may seemingly call for a response, it is important to refrain from using any protected health information in violation of HIPAA online, or in any forum.

It is imperative that all staff members receive HIPAA training and understand the potential pitfalls of posting things to the internet. If you need assistance with training or help with responding to a potential HIPAA breach, please do not hesitate to contact any member of our post-acute care team.

Fishing For 'Likes' Could Get A Bite

Key Contacts

Related Services