Social Media and HIPAA Compliance

Abstract

Technology has made it easier and faster to communicate with each other and with our patients. Social media platforms have people connecting and sharing instant information. Hospitals and bariatric programs are using Facebook as a method of providing education and information updates. This brings up a question that was recently posed in the NABN online Forum:

Our institution is considering the use of Facebook in our bariatric program. We believe that it will help us better communicate with our patients, but we are concerned about privacy laws. How do we comply with the law, such as HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law by President Bill Clinton in 1996. HIPAA is a federal law that contains a strong privacy rule that regulates the use and disclosure of Protected Health Information (PHI). PHI is any information that concerns health status, provision of healthcare, or payment for healthcare that can be linked to an individual. Any individual who feels that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services, Office for Civil Rights. Violating HIPAA rules can result in monetary penalties.

Now that HIPAA has been outlined, let us take a look at how to be prudent when using Facebook or other social media in bariatric programs. It is a known fact that bariatric patients need support and guidance to be successful. Facebook, along with other forms of social media, has the capability to provide an instant answer to a question, give immediate direction to a help source, or it can give bariatric patients the support of being connected to others who understand their challenges. Facebook should not be feared simply because it is believed that this is a potential HIPAA violation in the making; it has the ability to enhance your connection with your patients, but it must be implemented judiciously.

Responsibilities of the Institution

Before beginning, bariatric programs should first and foremost consult the institution's legal or risk management department to obtain the needed support and guidance. The legal department may already have an established policy regarding the use of social media platforms. If a policy does not exist, ask for help to develop a policy that will meet your bariatric program's needs. Following common sense guidelines, along with an established policy and procedure, will safeguard against the risk of a privacy rule violation. Keep in mind that the same rules used in protecting patients' privacy in your practice will also apply to your Facebook use. If your program elects to initiate a Facebook page, it should be a closed and monitored group, open only to the bariatric patients in your program and their immediate families. All of the bariatric team members should be trained in the institution's social media policy before implementing a Facebook page. Key staff should be selected to serve as your program's page administrators, and these people will be the gatekeepers for access to the program's page. The page administrators will have the authority to accept “friend” requests, which, once accepted, will give the individual access. Unfortunately, some individuals are susceptible to sharing too much information; therefore, it is important to ensure that selected bariatric program staff members monitor the page at least daily for postings that need to be removed.

Responsibilities of Bariatric Program Patients

Your bariatric program's Facebook page should be explained in detail to patients in a face-to-face setting. Patients should be given an opportunity to ask specific questions about how and what information will be shared on the Facebook page. Specific guidelines for the program's page should be given to the patients who select to use it as a means to communicate with the bariatric team and/or other bariatric patients. Patients who agree to use this social media platform and want to join the group must sign a consent form. The consent form must include the bariatric program's very specific guidelines, which includes that no sharing of personal health information should ever be posted. Patients must be instructed that they can only post information that is general in nature. Inform patients that the program's Facebook page will be monitored and that all inappropriate posts will be removed. If the patient refuses to sign a consent form, they will not be given access to the page. Consent forms are necessary because in HIPAA compliance terms, there is no such thing as implied consent.

Summary

In adolescent bariatric programs, the use of Facebook is priceless. Teens use Facebook as their way to stay connected with their world. Information about upcoming bariatric program events, or support group sessions with special programs, can be posted on the program's Facebook page. When teens graduate from high school and go away to college, they remain connected with the bariatric team and their program friends, which promotes success. Adult bariatric programs that utilize Facebook also have the ability to disseminate information to program participants instantly. Facebook can be used to provide a forum for special announcements or to share recipes as well. HIPAA is a reason to be cautious in the use of Facebook, or any social media, but the use of social media, specifically Facebook, can make it easier to stay connected to patients and to share essential information.

We welcome your active participation in the Q & A feature. Please address your questions to the Managing Editor (scarey@umm.edu) and specify that they are for the Clinical Q & A section of the journal.