HIPAA, Social Media, and Patient Privacy in Healthcare

Introduction

The advent of advanced communication technology platforms — such as smartphones and social media sites — has made global communication fast and effective. The seamless flow and exchange of information has been fundamental to business growth, consumer insight about products available in the market, and much more. Innovations in communication technology have had a significant impact on every sector of the economy, including healthcare, manufacturing, sales, and government. Close to 74% of people who access the internet and 80% of people who use social media sites use these platforms to research medical information, news, hospitals, and doctors (HCP, 2018). Social media is a powerful communication tool in general healthcare, impactful in the creation of professional networks and in the sharing of experiences. That said, giving and sharing excessive information through social media platforms may cause devastating consequences for employees and healthcare organizations when patient-specific information is disclosed (HCP, 2018).

This research paper analyzes a scenario based on a likely outcome and evaluates the HIPAA, legal, and regulatory framework governing the use of social media and cellphones in healthcare. The objective of this analysis is to determine whether violations occurred and, if so, what consequences the nurses in question would face. Through the study of this scenario, it becomes clear that both nurses violated patient privacy by taking a patient's pictures and personal details and sharing the information via social media and cellphone.

Professional blogs and social networks have 800 million active users at any given time. It comes as no surprise that nurses may at times be tempted to violate HIPAA regulations, causing major concerns in medical practice (HCP, 2018). With better employee education concerning the detrimental consequences of mistakes involving medical blogs and social media, it would be possible to reduce rampant HIPAA violations. Research findings by Denecke et al. (2015) indicate that most issues concerning the application of social media in healthcare involve privacy and confidentiality, which must be carefully preserved. The relationship between physician and patient can be compromised by information gained on either end, because private consumer and healthcare provider information can be accessed through internet platforms. Physicians must safeguard and maintain a clear separation between their professional and private selves (Denecke et al., 2015). Patient anonymity must be upheld when citing any internet content during a research study.

The use of social media in healthcare must be carefully considered (Denecke et al., 2015). The responsibilities and roles of social media platforms must be unambiguous. According to Denecke et al. (2015), the preservation of confidentiality and privacy is the central issue.

HIPAA, Legal, and Regulatory Discussion

HIPAA was enacted prior to the emergence of social media networks such as Facebook. Today, there are no explicit social media rules stipulated within HIPAA (HIPAA Journal, 2018). Nevertheless, existing HIPAA standards and rules are applicable to social media use by healthcare institutions and their staff. Healthcare institutions are required to enforce HIPAA policy on social media in order to reduce the risks associated with privacy violations (HIPAA Journal, 2018). Social media offers many benefits: social channels enable healthcare entities to connect and engage with patients, thereby involving them in their own healthcare. Healthcare institutions can also quickly and easily disseminate information about their services and attract more users through social media platforms. It is therefore important for healthcare institutions to understand the boundaries within which to use social platforms without violating HIPAA rules.

The first HIPAA rule for healthcare institutions is to never disclose privileged health details on any social media platform (HIPAA Journal, 2018). Secondly, healthcare institutions must never disclose protected information on social media. HIPAA privacy regulations prohibit the use of private health information on social media platforms. This includes information about a patient, as well as videos or images that could allow other people to identify the patient (HIPAA Journal, 2018). Protected Health Information (PHI) may only be shared on social platforms with the written consent of the patient (Hosek et al., 2013). Even with consent, the information may only be used for the specific purpose for which the patient gave that consent (HIPAA Journal, 2018). Social media platforms may be useful for sharing health tips, staff bios, medical research, and marketing messages, provided that no PHI is disclosed.

Healthcare staff require mandatory training on HIPAA rules regarding the use of social media. In 2017, approximately 71% of internet users also used social media platforms. Given social media's popularity and the ease and speed with which information can be shared on these platforms, HIPAA training is essential (HIPAA Journal, 2018). Where employees lack HIPAA training on social media use, violations are highly likely to occur. HIPAA training should be provided before healthcare employees begin their work obligations following appointment, and employees should also undergo refresher training once every year to ensure that HIPAA rules are neither forgotten nor undervalued.

The results of a 2015 investigation into HIPAA violations on social media were published by ProPublica (HIPAA Journal, 2018). The investigation focused on videos and photos of patients caught in unflattering situations and patients who were being abused. ProPublica identified 47 violations since 2012 — a figure that represented only a fraction of the many violations that had gone unreported. Common social media violations include posting videos and images without consent, posting patient gossip, and posting information that could allow a patient to be identified (Hosek et al., 2013).

As discussed above, HIPAA violations on social media are widespread (HIPAA Journal, 2018). The nurse who did not get a chance to attend to Jerod should not have taken his pictures, because he was not at the hospital as a celebrity but as a patient requiring immediate medical attention. Jerod was not in a position to provide written consent for the use of his photos on any social media platform, let alone Instagram or Facebook. Based on HIPAA rules as articulated by the HIPAA Journal (2018), it was wrong and unethical for either nurse to consider sharing Jerod's photos with anyone, as his information constituted PHI. Such problems can only be mitigated through detailed training on HIPAA social media regulations. In addition, healthcare practitioners should be permitted only restricted internet use within the healthcare facility, limited to supporting patient wellbeing.

Social Media and HIPAA Rules

Instead of being distracted by her friend, the nurse on duty should have been attending to her patients. According to HIPAA enforcement guidelines, healthcare employees who violate HIPAA rules can be fined anywhere between $100 and $1.5 million depending on the gravity of the violation. Healthcare employees can also face termination, lawsuits, jail sentences of up to ten years, and loss of medical licenses depending on the severity of the violation (Techadvisory.org, 2018). This indicates that the nurses in the scenario were either untrained on HIPAA regulations or perhaps assumed their violations would go unnoticed.

The use of social media and smartphones in healthcare carries both notable benefits and significant risks. Understanding both sides is essential for developing sound institutional policy.

Advantages:

1. Building strong professional networks and connections (HCP, 2018).
2. Getting patients involved in their personal wellbeing and health (HIPAA Journal, 2018).

Disadvantages:

1. HIPAA violations (HIPAA Journal, 2018).
2. Medical errors due to divided attention, as evidenced in the scenario (George, Rovniak & Kraschnewski, 2013).

Conclusion and Reflections

Hosek, S. D., Straus, S. G., Arroyo Center, & RAND Health. (2013). Patient privacy, consent, and identity management in health information exchange: Issues for the military health system. RAND.

Scripps. (2018). Patient safety, rights and privacy. Retrieved October 1, 2018, from https://www.scripps.org/patients-and-visitors/patient-rights-privacy

Techadvisory.org. (2018). Social media and HIPAA compliance. Retrieved October 1, 2018, from https://www.techadvisory.org/2018/05/social-media-and-hipaa-compliance/