Lessons Learned: Avoiding Risks When Using Social Media

Social media is an increasingly common resource for people to learn about medical care and their health conditions. Patients can find healthcare professionals actively posting on Twitter, Facebook, Instagram, TikTok, and other social media platforms, offering their expertise, debating policies and practices, promoting patient care and education, and raising awareness of new health-related developments. With this wealth of resources readily accessible to patients, it is not surprising that a study has revealed that one in five Americans turn to TikTok before calling their own doctor.¹ To ensure that information being shared via social media is doing the general public and the practitioner good, however, attention should be paid to a few regulatory and industry recommendations, which if not followed, can lead to costly legal problems.

Pay Attention to HIPAA Pitfalls

It should go without saying that healthcare professionals must comply with privacy and security requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”),² as modified by the Health Information Technology for Economic and Clinical Health Act,³ if they are using and disclosing protected health information on their social media platforms.

Unfortunately, many providers are unaware of how broadly the term “protected health information” can be construed. Under HIPAA, protected health information encompasses any individually identifiable health information, which relates to a particular patient.⁴ Consequently, in addition to details of a patient’s past, present or future treatment, all names, photos, and other tidbits about a patient (including things like tattoos) should be kept off a practitioner’s social media unless they have first obtained a valid authorization from the patient. Among other things, such authorization must meaningfully describe the information the provider intends to use and disclose and their reasoning for doing so.⁵ That said, healthcare professionals on social media should also know that HIPAA does not restrict the use or disclosure of “de-identified” health information, which “neither identifies nor provides a reasonable basis to identify an individual.”⁶ To de-identify information, the healthcare provider can either receive a formal determination by a statistician or, more commonly, remove all specifics related to the individual, including their family history, household members, employer information, and any other recognizable depictions.⁷

As a dental practice in Texas found out not too long ago, express patient authorization is a standard that cannot be ignored, no matter the situation.⁸ In responding to a patient’s negative Yelp review, the dental practice disclosed the patient’s last name and details of the patient’s health condition.⁹ The Office of Civil Rights (“OCR”) of the Department of Health and Human Services (the federal agency which oversees HIPAA) issued the dental practice a fine of $10,000 for the unconsented disclosure of the patient’s protected health information.¹⁰ Similarly, in June 2023, the OCR fined a New Jersey healthcare provider $30,000 for impermissibly disclosing patient information, including the patient’s mental health diagnosis and subsequent treatment, while responding to the patient’s negative online review.¹¹ And, in neighboring Rhode Island, the Department of Health Board of Medical Licensure and Discipline (the “Board”) fined a physician $500 and required attendance at a confidentiality course for revealing personal identifiable information about her patients on Facebook.¹² According to the Board, the physician described the patients’ injuries with such depth, that the patients could be identified by unauthorized third parties.¹³

These civil fines, though serious in nature, do not come close to the maximum permissible amounts. There are four tiers to the sanctions available under HIPAA, each of which ratchets up with increasing levels of culpability (Table 1).

Table 1.

2022 penalty chart for HIPAA violations under 45 C.F.R. 102

Penalty Tier	Level of Culpability	Minimum Penalty Per Violation	Maximum Penalty Per Violation	Annual Penalty Limit
Tier 1	Lack of Knowledge	$127	$31,987	$31,987
Tier 2	Reasonable Cause	$1,280	$63,973	$127,974
Tier 3	Willful Neglect	$12,794	$63,973	$319,865
Tier 4	Willful Neglect (not corrected within 30 days)	$63,973	$63,973	$1,919,173

Additionally, criminal penalties can come into play if a person knowingly obtains and discloses protected health information in violation of HIPAA’s requirements.¹⁴

These examples underscore the importance of understanding where HIPAA protected health information begins and ends and the perils of failing to obtain appropriate authorization. To combat HIPAA risks associated with their use of social media, it is critical that healthcare providers implement policies, which discourage all types of specific patient references and spell out procedures for obtaining valid authorizations. In addition, training on what is and is not permitted under HIPAA should be rolled out across the entire practice—even to those personnel who are not typically interacting with patients and their information.

Counter the Spread of Medical Misinformation

One of the benefits and banes of social media is that it offers the rapid dissemination and consumption of information. But the on-demand nature of social media also gives rise to concerns of accuracy, credibility, and reliability—concerns which are often neglected before information is published but can lead to significant liability exposure when they are called out afterwards.

The COVID-19 pandemic magnified the problem of medical misinformation on social media. One study found that nearly eight in ten adults heard of or consumed medical misinformation related to the pandemic.¹⁵ One chiropractor notably found himself faced with a federal lawsuit resulting from his failure to verify the accuracy of the content he promoted on social media. During the pandemic, the chiropractor marketed vitamin D and zinc products, claiming they were more effective at treating COVID than vaccines.¹⁶ Shortly thereafter, the Federal Trade Commission sued the chiropractor for violating the COVID Consumer Protection Act of 2021.¹⁷ Finding that the chiropractor engaged in deceptive advertising, a federal judge ordered him to pay an $80,000 fine and permanently restrained him from promoting his products as ones that prevented, treated, or reduced the severity of COVID.¹⁸

An important takeaway from this enforcement action is that medical misinformation has the power to negatively impact the general public, the reputations of individual practitioners and the larger healthcare community. As such, providers must be diligent in ensuring that all their healthcare-related social media posts contain scientifically accurate content.

Avoid Potential Conflicts of Interest

Many social media users have built lucrative online careers. For healthcare professionals, social media stardom and paid marketing campaigns carry risks and must be thoroughly considered and vetted.

As a current case in point, a licensed nurse practitioner specializing in dermatology gained notoriety as a social media influencer by posting skincare and beauty content.¹⁹ Achieving popularity, the nurse practitioner began offering virtual consultations and announced a “Skincare Expert Course,” which provided lessons to healthcare providers and skincare enthusiasts about acne, healthcare routines, and dermatology principles used to treat patients.²⁰ The nurse practitioner’s employer terminated her employment, finding that she breached her employment contract by competing with the employer’s business and overall “hurting the field [of dermatology] more broadly by sidestepping having to refer to a dermatologist altogether.”²¹

As this situation shows, when using social media, healthcare professionals must consider not only their ethical and regulatory compliance obligations, but also the duties owed to their employers and the profession at large.

Develop and Maintain Social Media Policies

As a nursing facility in Winston-Salem recently learned the hard way, social media policies provide an effective tool to address unprofessional online conduct. The nursing facility employed a nurse who regularly posted about her job on TikTok,²² amassing a following of more than 38,000 active viewers.²³ In one video, the nurse is seen holding a pill bottle, with an overlay caption stating, “me making sure all my patients sleep all night cause they kept me up last night.”²⁴ Other videos included purported jokes of lying about vital signs and unplugging a patient’s ventilator to charge her phone.²⁵ The nurse claimed that her TikTok videos were merely “just dark humor.”²⁶ While none of the videos identified patients or disclosed any patient health information, the nursing facility nonetheless terminated the nurse’s employment for violating the company’s code of conduct and harming society’s perception of the nursing profession.

To sidestep these lapses in behavior, healthcare employers should develop and maintain up-to-date polices that acknowledge the importance of social media, but also contain clear statements regarding the entity’s culture and expectations for professionalism. Such policies should also specify the types of information that can and cannot be shared on social media and identify those who are authorized to post on behalf of an employer—making clear that employee posts reflect the personal opinions of the employee and not the employer. Finally, any social media policy should comply with the National Labor Relations Act,²⁷ which gives employees the right to join together to improve their working conditions. This “right to join” includes activities occurring in cyberspace, such as on Facebook, Twitter, Instagram, or even TikTok.²⁸ In this way, regardless of whether they are represented by a union, employees have the legal right to engage in discussion with each other about their pay, benefits, and working conditions with coworkers on social media and any policy must not have a chilling effect on such protected activities.

Once drafted, the employer should provide the social media policy to all employees, obtain employees’ express acknowledgement and agreement to comply, and ensure employee understanding through robust and regular trainings.

Conclusion

Deployed wisely, social media can greatly benefit access to and delivery of healthcare by creating connections, offering on-demand information, and promoting innovation. To achieve these aims, however, physicians and their employers must manage the risks social media poses by establishing policies and training programs, which assure patient confidentiality and safety and foster professional online presences that enhance the reputations of individuals and the industry alike.