Risks and benefits of sharing patient information on social media: a digital dilemma

Abstract

Social media (SoMe) has witnessed remarkable growth and emerged as a dominant method of communication worldwide. Platforms such as Facebook, X (formerly Twitter), LinkedIn, Instagram, TikTok, and YouTube have become important tools of the digital native generation. In the field of medicine, particularly, cardiology, attitudes towards SoMe have shifted, and professionals increasingly utilize it to share scientific findings, network with experts, and enhance teaching and learning. Notably, SoMe is being leveraged for teaching purposes, including the sharing of challenging and intriguing cases. However, sharing patient data, including photos or images, online carries significant implications and risks, potentially compromising individual privacy both online and offline. Privacy and data protection are fundamental rights within European Union treaties, and the General Data Protection Regulation (GDPR) serves as the cornerstone of data protection legislation. The GDPR outlines crucial requirements, such as obtaining ‘consent’ and implementing ‘anonymization’, that must be met before sharing sensitive and patient-identifiable information. Additionally, it is vital to consider the patient’s perspective and prioritize ethical and social considerations when addressing challenges associated with sharing patient information on SoMe platforms. Given the absence of a peer-review process and clear guidelines, we present an initial approach, a code of conduct, and recommendations for the ethical use of SoMe. In conclusion, this comprehensive review underscores the importance of a balanced approach that ensures patient privacy and upholds ethical standards while harnessing the immense potential of SoMe to advance cardiology practice and facilitate knowledge dissemination.

Graphical Abstract

Graphical Abstract.

Introduction

Over the years, social media (SoMe) has evolved to become a major method of communication in society, with ∼4.6 billion users worldwide.¹ Social media platforms are characterized by a web-based and/or smartphone mobile app with a unique interface, which facilitates the interactive creation and sharing of information through a virtual community. Facebook, X (formerly Twitter), LinkedIn, Instagram, TikTok, and YouTube are currently among the most popular platforms and have become an established form of communication for the current digital native generation. The individual platforms allow the sharing of different forms of information (text-based, image, or video-based) with variable flexibility for the type and amount of data to be shared.

The relevance of SoMe pertains not only to mainstream media but there is also a similar trend in its utilization in the field of medicine, especially in cardiology.^2–4 Prior generations of physicians were hesitant to use SoMe out of concerns about patient privacy, liability, lack of familiarity, and insufficient time to learn and use ‘new-fangled’ gadgets.^4,5 However, times have changed and SoMe, in particular, X (formerly Twitter), has become a forum of communication for professionals who use the platform to gain exposure to new research and to network with experts and colleagues around the world.^6–8 Most importantly, it is increasingly being leveraged for teaching and learning purposes in different forms, such as challenging or exciting patient case histories, X (formerly Twitter) Journal Clubs, Tweetorials, and (virtual) conferences. Additionally, SoMe has become important for both cardiovascular journals and medical professional organizations, such as the European Society of Cardiology (ESC), to disseminate cardiovascular health information, new scientific findings, challenging case material, and education globally.^9,10

While SoMe offers obvious benefits, there are also challenges, pitfalls, and even risks associated with sharing patient information which are related to the ethical, legal, and social implications of its utilization. Whereas scientific journals use a peer-review process and have strict guidelines on consent before publication, this is not the case for SoMe. Moreover, advice on the application, deployment, and professional etiquette of SoMe is limited.¹¹ It is for this reason that the European Heart Journal—Digital Health assembled a group of experts ranging from cardiologists in different stages of their career, scientists, lawyers, policy-makers, and patients to review the current applications, legislation, and perspectives regarding the sharing of patient information on SoMe. In this review, the authors offer advice on the use of SoMe within the professional field of cardiology and future routes along which both practitioners and patients might progress.

Application of social media in education and science

Cardiovascular medicine has seen major technological advances in the last decade that have enabled us to transition from traditional methods of teaching to digital learning.¹² The COVID-19 pandemic and the subsequent disruption of daily life and traditional education catalysed the use of digital solutions and SoMe for rapid communications and dissemination of knowledge.¹³ The virtual nature of SoMe allows for attendance by anyone, from anywhere and at any time provided there is access to the internet and a smart device.¹⁴ In contrast to traditional case teaching, sharing clinical cases and images on SoMe provides rapid and dynamic feedback from a global community of peers. Discussion can be planned in specific communities or by the use of a specified hashtag and has the potential to reach a bigger, broader, and more diverse audience than a traditional meeting or lecture.¹⁵ An example is the use of the hashtag #CardioX (formerly Twitter) which refers to a community of individuals interested in cardiovascular science. It has grown tremendously over time and has been used over 1 000 000 times since October 2017.¹⁶ Another important instructional strategy is the use of a ‘Tweetorial’, which is a collection of short tweets about a given subject to teach others about a certain topic in medicine or cardiology.^17,18 Cardiologists have made this part of their online portfolio, expanding the understanding of mechanisms underlying diseases and current or new treatment options. Recently, continuing medical education or Maintenance of Certification points can be gained in some instances by participating in online learning using SoMe.¹⁷ As such, enhanced access to education may help satisfy institutional and regulatory board requirements.

Social media has also been playing a prominent role in the dissemination of medical science, boosting the reach of traditional channels of communication such as scientific journals and congresses.^5,19 Most scientific journals are posting daily content on their SoMe channels, highlighting key papers and challenging clinical cases, supported by educational images or videos. This promotes discussion among the medical community, including manuscript authors and journal editors, and attracts new audiences. Furthermore, the potential academic impact of posting scientific papers on SoMe is positive. In the ESC Journals Randomized Study, 695 papers published in the ESC Journal family were randomized to active promotion on X (formerly Twitter) or to a control arm in which no active tweeting was performed by the ESC channels. After a median follow-up of 994 days, an active promotion strategy was associated with a small but significant increase in the citation rate [Poisson regression: 1.12 (1.08–1.15)], besides an increase in the Altmetric score.²⁰ Cardiovascular conferences and congresses have adopted SoMe to spread new insights and scientific results. Disseminating the content globally quickly encourages conversations between both those present and online. X (formerly Twitter) is often seen as the most convenient platform, especially for using hashtags to segment conversations and allowing everyone to join in.⁵

The appeal of SoMe is derived from its capacity to disperse education widely and provide a stage for individuals, even outside of traditional academia. A recent survey on the professional use of SoMe by healthcare professionals concluded that most respondents use SoMe as passive users, while 38 and 19% stated that they shared content on a non-daily and daily basis, respectively.²¹ The respondents also indicated that the opportunity of being updated on recent publications (66%), networking (49%), and gaining information about rare or interesting cases (48%) were the most useful advantages.²¹ Nevertheless, there are also challenges associated with its use (Table 1). The absence of safeguards against falsehoods, misinformation, and incorrect interpretations is a significant problem.¹¹ For example, management strategies that are described may be inappropriate or contradictory to guideline-recommended best practice. Without a moderator, non-evidence-based practices can spread more easily in the virtual world, possibly leading to poorer patient outcomes. Social media provides an overload of information, which has not been scrutinized by the peer-review process to ensure its quality. As such, it is advisable to use the information learned through SoMe as an addition to a thorough analysis of the relevant literature, including society guidelines. In conjunction with these difficulties on a personal level, there are also larger ethical, social [e.g. the patient–physician relationship (PPR)], and legal implications associated with the utilization of patient information on SoMe which are described in the following sections.

Table 1.

Opportunities and challenges associated with the use of social media

Opportunities (pros)	Challenges (cons)
Shared expertise Alternative treatment options Search for dedicated centres Worldwide spread Immediate diffusion High impact Fast growth Nearly universal acceptance in younger generations High educational potential Low cost Inexpensive access Easy management …	Lack of standardized rules Lack of structured delivery control Lack of control of future content use (i.e. improper use) Lack of ethical rules (i.e. patient permission, informed consent …) Risk of breaching personal data protection Risk of de-personalizing suffering or dramatic situations Wining more ‘likes’ may encourage spectacle rather than education Risk of trivialization …

Transformation of the patient–physician relationship

The PPR is as old as the medical profession. Across the ages, PPR has tracked the social, cultural, and moral attitudes prevalent in the given era. Moving from the archaic era dominated by elements of compassion, magic, and mystery, it has become increasingly combined and subsequently dominated by rationalization. Commencing with the first Scientific Revolution of the 16th and 17th centuries, the PPR has become more structured and increasingly more regulated. In the 20th century, PPR has become understood as a relationship between two rational individuals on equal footing based on trust, confidentiality, equity, fairness, and justice. The earlier paternalistic approach has been slowly changing towards a PPR best described as a partnership. Due to the exposure to a variety of administrative invectives as well as commercial, political, and economic considerations, the PPR has been attacked and this perception has been changing over time. However, trust based on confidentiality has remained untouched and fundamental to PPR since Hippocratic writings.

In the 21st century, digital data and information processing along with global access to messaging are profoundly changing attitudes to confidentiality and privacy. Formerly considered a severe breach of trust, the sharing of private data by individuals in the public domain has now become common practice. In the open and barely regulated public domain, those changing practices may be considered private matters, as long as they do not transgress the established legality in a given society. Each participant using SoMe as a worldwide accessible platform for communication becomes evidently and legally an author who is fully responsible and accountable for the content and, to an extent, also for the resulting consequences and repercussions. In contrast, the use of SoMe in professional communication, including medicine, clearly requires further clarification. While the professional relevance, credibility, validity, and reliability of the contents of SoMe messages may eventually require control and possibly future restrictive regulations, the confidentiality of professional medical communications, considered fundamental to PPR, must be maintained. Based on the principle of confidentiality, the following rules apply. Firstly, the sole owner of health-related data, with the possible exception in criminal proceedings, is the patient. Secondly, the physician acting as the trustee and confidant may release any data attributable to the patient only with the explicit approval of the patient, regardless of the intended communication platform. The unauthorized release or dissemination of identifiable health-related data of a specific patient by medical professionals is considered not only unethical but also unlawful. The patient’s decision to allow publicization of his or her health-related data using SoMe implies an understanding of the attending benefits and potential risks broadly inherent to SoMe practices and those associated with individual outlets and platforms available in the open access and restricted professional domains. Specifically, besides addressing the pros and cons of the public data release on SoMe (Table 1), the potential need to secure the patient’s anonymity needs to be considered.

Patient data—legislation and constraints

Sharing patient data online, such as photos or pictures, can have disparate and unintended implications. It is an act of exposure of sensitive personal data to a potentially vast public, which compromises individual privacy, online and offline. Privacy and data protection are two distinct fundamental rights that are enshrined within European Union treaties, along with other rights, such as the right to dignity and the right to health and care (Table 2). The core component of the data protection legal framework is the General Data Protection Regulation (Regulation 2016/679, or ‘GDPR’).²² Sharing photos that could lead to the identification of the patient or other images, such as medical tests, X-ray scans, and MRIs with information containing the patient ID or name, constitutes ‘processing’ of personal data.

Table 2.

Rights and principles from the General Data Protection Regulation legislated by the European Union

Consumers’ rights	Lawful principles
Right of access	Lawfulness, fairness, and transparency
Right to rectification	Purpose limitation
Right to erasure (‘right to be forgotten’)	Data minimization
Right to restriction of processing	Accuracy
Right to be notified	Storage limitation
Right to data portability	Integrity and confidentiality (security)
Right to object (to processing)	Accountability
Right regarding automated individual decision-making, including profiling

The GDPR differentiates between personal data and ‘special categories of personal data’. These latter are also known as ‘sensitive data’ and include the category of ‘data concerning health’. For example, the photo of a patient sitting in a specific medical department qualifies as sensitive personal data because it may reveal details about the health status of that person. A legal basis is needed to process personal data. The GDPR requires that data processing activities happen following one of the legal bases foreseen in Article 6 of the GDPR. Additional requirements are added for special categories of personal data. Processing special categories of personal data is not allowed, unless specific conditions in Article 9 of GDPR apply. These conditions are the most relevant for the issue of sharing patient data on SoMe. Consent would be the most suitable legal basis for using patient data on SoMe—among the other legal bases provided by the GDPR. However, it should be clear that GDPR consent does not equate to research ethics consent, and that several requirements should be taken into account.

Consent

Consent must be freely given, specific, informed, unambiguous, and explicit.²³ Patients should be informed appropriately in order to make a decision about the processing of their personal data. Their decision should be specific for the sharing of sensitive information on SoMe and it must be unambiguous. The patient must be able to make a real choice, so they cannot be put in a situation where they feel forced or they know they would face negative consequences (e.g. not receiving a particular benefit or a treatment) because, in that case, consent could be invalid. Finally, consent is also about an imbalance of power between the controller {In GDPR terms, the controller is meant as ‘means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data’ [GDPR, Article 4(7)].}, the healthcare provider, and the data subject in this case the patient. Patients are vulnerable natural persons and data subjects, so it must be carefully evaluated when, how, and whether their consent can be sought. If personal data about the patient are used online without consent—the processing of personal data would be unlawful according to the GDPR (see the ‘Anonymization’ section). The controller should stop the data processing and, in some cases, erase the personal data at the patient’s request.

The unlawful processing of personal data violates several GDPR requirements, including the principle of integrity and confidentiality of data. Moreover, the unlawful or unauthorized disclosure of data is a personal data breach. A data breach of sensitive data may bring significant adverse effects on individuals, which can cause physical, material, or non-material damage. It also means that the patient could lose control of their personal data if their image is used in different places online without their consent. Suppose the picture becomes known in their social sphere. In that case, the patient could face unwanted consequences concerning their image or reputation (for instance, the photo allows the association with a certain mental health disease that is socially stigmatized), or it may lead to discrimination (e.g. the picture implies a former oncological condition of the recovered patient, which may cause the denial of health insurance, travel insurance, or life insurance, etc.) It is, therefore, important to obtain consent lawfully, as it helps ensure the right of the patient to privacy and data protection—as well as dignity and non-discrimination (as seen from the example above). Finally, it is worth noting that respecting consent requirements also means complying with data protection laws. In the case of non-compliance (including the unlawful processing of personal data), those responsible may be subject to administrative fines by a data protection authority and face charges in both civil and criminal proceedings.

Anonymization

According to the GDPR, anonymous data are ‘information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject {In GDPR terms, a data subject is defined as an ‘an identifiable natural person who can be directly or indirectly identified by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’ [GDPR, Article 4(1)].}, in this case the patient, is not or no longer identifiable’. The process of anonymization of data requires eliminating all the identifying elements from a dataset in order to irreversibly prevent the identification of the individual to whom the data refers. Consequently, when such data do not allow an individual’s identification or identifiability, they may be considered anonymous and should not be considered personal data. This further implies that the GDPR requirements do not apply. Nonetheless, data anonymization should not be taken lightly since, in practice, anonymizing data has become more and more difficult because of technological developments. For this reason, the concept of anonymized data should be interpreted strictly. When conducting the anonymization process, data controllers (in the case of SoMe the person posting the case) need to evaluate, on a case-by-case basis, the techniques that are the most effective in given circumstances. After the anonymization process and by exercising reasonable efforts, controllers should always consider that no information is left to re-identify the individual concerned. Moreover, the controller must continuously assess the risk of re-identification by considering ‘all objective factors, such as the costs and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments’ (Recital 26 GDPR). In the context of sharing patient data on SoMe, once data are anonymized, the GDPR requirements do not apply anymore, as long as the patient cannot be identified or is identifiable. This means that such data can be freely shared if other legal obligations (such as confidentiality) are met. However, anonymization needs to be monitored as conditions may change, and new technology, along with extra data, could lead to the patient becoming identifiable.

Consequences for publication and social media policy

Almost all scientific journals publish case reports, flashlights, and images that give narrative descriptions of individual patients or details of their investigations. It is generally accepted that the publication of case reports requires the patient’s consent, and there is a relatively standard approach to this process. However, published case reports often attract SoMe interest and may therefore become the subject of reception and discussion amongst medical and lay audiences. Most journals do not specifically address this type of dissemination or require that consent should be obtained for this. It is clear that work needs to be done to lift the practices of facilitating the patients’ autonomy in the context of print publishing into the contemporary setting of dissemination to a SoMe audience.

We propose that whilst the regulatory requirements on consent (in particular when read in conjunction with the most recent data protection legislation) provide a clear framework for good practices in relation to obtaining consent, the context of SoMe use may provide an opportunity to rethink this field, and to acknowledge that a different balancing of rights and interests is required. In addition, the patient’s ability to accurately gauge the consequences of exposure to SoMe may be much more developed than in conventional contexts of case study publishing.

Consent for the publication of case reports

Authors frequently assume that consent to undergo an investigation or for inclusion within a clinical study is sufficient consent for the publication of a case report. Other authors claim that advice from their local ethics committee or institutional review board is that consent is not required. However, the International Committee of Medical Journal Editors, Committee on Publications Ethics (COPE), and CAse REport (CARE) guidelines state that it is mandatory that specific consent is obtained for the publication of the details of an individual or small group of patients in a case report or case series.^24–26 From an ethics perspective, it is common that where the sphere of confidence in relation to a patient’s private health information is expanded (without the objective being the patient’s best interests), it is a requirement to obtain informed permission to do so (consent). Formally, consent should be a witnessed and dated statement from a patient after viewing and preferably reading the case report and having had an opportunity to ask and have answered questions about the report. A possible procedure on how to ask for consent for a case report is included in Table 3. There is a controversy about whether the signed consent should be included with the manuscript when submitted for publication. For example, BMJ Case Reports insists that the consent form is sent to the journal, whilst most other journals do not. Receipt of the consent form may reassure the editor that consent has been obtained but also identifies the patient. The journal must arrange a mechanism whereby handling editors do not have the opportunity to review the consent and that any journal staff involved in any of the SoMe activities of the journal remain blinded to the identity of the patient. The consent form must be stored safely. COPE discourages journals from reviewing consent forms.²⁴ An alternative approach that should reassure the journal that consent has been obtained is the mandatory inclusion in the publication of a statement from the author that ‘written consent has been obtained and stored with the medical records of the patient’. There are obvious but exceptional circumstances when consent cannot be obtained such as when a patient has died and has no relatives. However, it is not satisfactory to waive consent simply because the patient is ‘lost to follow-up’ unless the report is of substantial significance. In such a case, after agreement with the editor, the author should insert a statement in the publication that ‘written consent has not been obtained because …’.

Table 3.

Procedure to obtain consent to publish patient data as case report in a journal or on social media

Obtaining consent for a case report

Provide the patient with an oral and/or written explanation of the consent process and the reasons for seeking consent Reassure the patient that all identifying marks have been removed from the material and that the patient will remain anonymous so far as is possible Provide the patient with a copy of the case report so that it can be viewed and, if possible, read; questions from the patient should be encouraged and addressed Provide a written/typed/printed consent form (not merely oral consent); journals may provide a consent form template Include the title of the case report Obtain a dated signature from the patient (or legally responsible relative) Obtain a dated witness signature; the witness is usually the responsible physician or delegate File the consent form in the patient’s medical record State in the manuscript that written consent has been obtained and that the consent form has been lodged in the patient’s medical record

Consent for social media consequences of case report publication

Case report journals encourage SoMe reporting of material published in the journal since it will spread educational knowledge and add to its Altmetric score, an important indicator of the impact of the publication and the journal.^27,28 The journal usually appoints a team of SoMe editors to systematically promote material on SoMe. The author(s) of the case report is usually asked to participate. Author participation, however, introduces a ‘wild’ element regarding the anonymity of the subject of the case report since additional material relevant to the patient, not seen or edited by the journal and possibly not thoroughly checked regarding patient de-identification, may be introduced. This important concept should be mentioned in the ‘instructions to authors’, letters of acceptance, letters confirming publication, and any communication from the SoMe editorial team. It should also be covered in the reassurances made to the patient about SoMe exploitation.

Neither COPE nor CARE gives any consideration to consent for SoMe stemming from a case report but the BMJ Case Reports consent letter contains the following statement: ‘The article, including the Material, may be the subject of a press release, and may be linked to from SoMe and/or used in other promotional activities’.^24,26,29 Other than stating that the article will be posted on the BMJ Case Reports website, no further explanation is given.²⁹ By example, European Heart Journal - Cardiovascular Reports does request consent for SoMe activity stemming from the report, but its sample consent form does not mention this.³⁰ A statement affirming that consent has been obtained should be stated by the author(s) in the manuscript. The form should also alert the patient to probable interest from SoMe participants, particularly, other healthcare professionals and also, perhaps from journalists and others who take an interest in medical issues. The patient should be reassured that every effort has been made by the journal not to publish any material that could identify the patient, but that may not be completely protected. In this regard, it would be appropriate but difficult to afford patients significant levels of control in relation to the disposition of their personal data, in the form of a SoMe publication, over the internet. One approach would be to seek broad consent (between the healthcare professional and the patient) to prepare a SoMe publication. The author can provide the patient with a copy of the publication and an assessment of its potential reach.

Consent for social media activity not related to case report publication

Physicians participating on SoMe may introduce information about their patients, whose cases have not been reported in the literature and for whom no previous consent has been obtained, in several ways. Firstly, many medical conferences have sessions where physicians present patient case reports to largely, but not exclusively, medical audiences. Aspects of these case reports frequently attract SoMe attention. Since these events are planned well in advance, there is ample opportunity for physicians to obtain consent for the presentation and for possible SoMe ramifications. The consent form and its content should be similar to the consent form used for case report publications. The poster or presentation should state that consent has been obtained for the presentation and the possible SoMe consequences. The consent should be included in the patient’s medical records. Second, it is easy for physicians when accessing SoMe to discuss their patient’s care, to believe that they are joining a medical conversation with professionals who are bound by the rules of patient confidentiality. This is not correct since many, with no genuine medical reason, may easily join the exchange. It is therefore imperative that the physician does nothing to disclose information from which a patient may be identified. Whenever feasible, for example, when initiating a conversation about a patient who can be readily contacted, the physician should also obtain consent from a patient to share their medical information over the internet. The consent should be filed with the patient’s medical records. However, when this is not possible, and if there is an important and justifiable reason to share patient data, there is a heavy responsibility on the physician to safeguard the identity of the patient.

The patient perspective

From a patient perspective, seeing a multitude of cases being shared on SoMe raises a lot of the same questions which are addressed above. Many patients believe that the assumption that if patient data is anonymized, it is permissible to share it on a public platform without patient consent, is wrong. Patient identification risks remain, especially, for rare and complex conditions. Posting of personal information on a public forum could potentially lead to unwanted consequences such as discrimination, stigmatization, or even harm to their reputation. Furthermore, no anonymization alters the fact that it remains the patient’s data; he or she owns the right to the data as it pertains to their body. As described above, consent to the test or treatment does not itself imply consent to share. The latter might undermine the trust of the patient in their doctor and harm the PPR which could lead to a patient being less likely to disclose sensitive information or seeking medical treatment altogether.

A further question relates to the purpose of posting a patient case. Undoubtedly, there is a huge educational potential from sharing cases while also allowing interaction and discussion from the global cardiology community. However, many cases shared lack any educational element and others tend to be complex and/or dramatic which some patients may view as sensationalist and or ‘entertaining’ rather than educative. This could partially stem from the language used in SoMe posts, which results from a sensationalist approach. Guidance on how to approach a SoMe post respectfully can be found in the following section. Moreover, patients may perceive cases shared as ‘extreme examples’, and while useful, we must always remember that there are people behind the visuals and statistics. When questions such as: ‘How would you manage this condition?’ are asked, there may be consequences. Especially, if patients identify themselves in the post, they may wonder if their fate is at the hands of the X (formerly Twitter) audience and questions about the physician’s competence may arise. X (formerly Twitter) thread comments suggesting a different approach than the one the attending physician chose might raise doubts about whether the patient received the right treatment, and comments such as ‘did the patient make it?’ can sit very uncomfortably. For this reason, the informed consent of the patient and preparing the patient for the discussion that the post might initiate is critical.

Patient representatives have suggested that closed groups should be preferred to share and discuss patient cases for educational purposes. Closed groups have strict rules and regulations to ensure that patient privacy and confidentiality are maintained. Professional societies could manage an online group that is accessible to members who have verified credentials and have agreed to confidentiality rules. This would provide a secure and private platform for doctors to discuss complex cases in an educational manner without compromising patient privacy and exposing them to the risk described above. It is important to note, however, that even in closed groups, doctors must still follow strict ethical guidelines and obtain informed consent from patients before sharing any information about their cases. Still, open platforms such as X (formerly Twitter) could be used to share patient data, especially by professional societies and journals, when complying to current legislation and when informed consent is obtained, given the benefits mentioned above. However, the use of these open platforms should be aided by the development of formal guidelines to ensure patient protection which could include mechanisms to report cases shared without consent.

Code of conduct on social media

As mentioned earlier, SoMe lives from spontaneous posts and it tempts those using it to share something from their daily life rather hastily and possibly thoughtlessly. With regard(s) to the discussion of patient cases, this leads to healthcare professionals sometimes hurriedly posting what first comes to their mind: patients are being compared with ‘whack-a-mole’ games; the spontaneous coronary artery dissection that nearly cost the patient his/her life being called ‘beautiful’; or the huge thrombus in their left ventricle transiting to the aorta and in the next second causing a potentially life-threatening stroke is being used as ‘scariest’ patient case at Halloween. Examples like these call for a code of conduct for discussing patient cases on SoMe.

Thorough preparation not only of the data being shared but also of the language used to present them or comment on them is strongly recommended. While titles like ‘Case of the day or week’ seem sensational and are meant to catch people’s interest, we should question whether such titles are appropriate. Words used to describe patient cases should always be respectful towards and avoid dehumanizing, blaming, and stigmatizing patients. Cases of the day, week, and month are very often extremes, and they do not always have a ‘happy ending’. We should keep in mind that ‘our case of the week’ might have been the patient’s worst day of their life. Although we acknowledge that there is some form of ‘competition’ between posts, we would recommend using the same terminology used by journals in titles such as ‘case report’, ‘case presentation’, ‘case challenge’, or ‘image challenge’.

When drafting a post for SoMe or commenting on one, healthcare professionals should always maintain a professional and respectful tone even when discussing controversial topics or complex cases. Offensive and derogatory language must be avoided and participants should refrain from comments that could be interpreted as discriminatory or unprofessional. While this should be the case for all posts on SoMe, this especially holds true for educational posts, including patient information. As SoMe also attracts patients, a language commonly used in a closed medical community (in a medical journal or at a conference) might not be right for these channels. Therefore, commonly used phrases such as speaking of ‘managing’ a patient, saying ‘the therapy failed the patient’ or defining a patient by their condition as, for example, ‘heart failure patient’ should also be carefully reconsidered within the context of SoMe. In this respect, the American Society of Clinical Oncology published guidance in a ‘Language of Respect’ document intended for their annual conference, which can be applied to SoMe posts as well.^31,32 Moreover, one could consider letting the patient or a colleague review the drafted SoMe post to ensure the data shared and the tone of the post are appropriate. Both might be difficult as SoMe thrives from spontaneous and reactive posts leaving little time for delays. However, our objective should always be to provide high-quality, respectful, and educational cases.

Recommendations

From the information described within this article, we have the following recommendations regarding sharing patient information on SoMe (Table 4).

Table 4.

General recommendations regarding use of social media

Before posting patient data make sure the post is compliant with GDPR. It is important to remember that anonymization is not enough to prevent the identification of the patient. As a result, stay away from contemporaneous posting and use caution when using uncommon presentations as they may be easily identifiable Abide by institutional codes, if available, of conduct regarding the use of SoMe Procure written consent from patients to use their clinical information for educational purposes including SoMe Use respectful language when posting about a patient. If any emoticons are included these should also reflect respect towards the patient Maintain a professional attitude in your online presence; the reputation of the doctors, their institutions, and the larger medical community may be tarnished by aggressive or insulting discussions on SoMe. Moreover, they may also offend and confuse patients SoMe should be used as a discussion forum in adjunct to the relevant and available literature including societal practice guidelines Refrain from offering medical advice on SoMe Learn from discussions regarding areas of unfamiliarity but refrain from claiming any expertise in these fields Ensure the quality of the discussion and/or scientific evidence presented on SoMe Avoid any form of plagiarism

Recommendation regarding consent for the publication and associated SoMe activities

Journals that accept case reports, flashlights, or images should require written patient consent A template consent form should be provided All identifying marks should be removed from patient reports and any illustrations Patient consent forms should be filed with the medical records of the patient A statement that written consent has been obtained from the patient and filed in the medical record of the patient should be contained within the printed manuscript If patient consent cannot be obtained the report should be declined or the failure to obtain consent should be justified, agreed with the editor and stated in the manuscript The patient consent form should include consent for SoMe triggered by the report and by the activity of the journal and the author(s) Presentation of case reports at meetings should require a similar consent process to that required for journal publications; patient identifiers should be removed from the presentation Patient-related SoMe activity by a responsible physician should require a similar consent process to that required for journal publications; patient identifiers should be removed from the activity Patient-related SoMe activity by a responsible physician in the absence of patient consent is not encouraged, but if undertaken for an important justified reason the patient’s identity should be protected

Recommendations regarding essential elements on SoMe in the consent form

Consent includes the possibility that the case report may stimulate global SoMe attention Case reports will be published online and, if in an open-access journal, will be freely available to all Case reports may be advertised by the journal on its website and information from the report may be disseminated on SoMe, such as X (formerly Twitter), by the journal editors/staff Physicians interested in the case may further disseminate the report or parts of the report and add to the discussion of the case; the physician must not introduce further data from which the patient may be identified The report may stimulate non-medical interest from, for example, newspaper journalists The author and the journal have done their best to retain the anonymity of the patient(s) and will continue to do so during SoMe discussions, but anonymity cannot be guaranteed

SoMe, social media; GDPR, General Data Protection Regulation.

Future perspectives

The future use of SoMe for the sharing of patient information is likely to be shaped by technological advancements, ethical considerations, and changes in healthcare policy. The unprecedented pace at which our technology is developing will inevitably influence the evolution of SoMe and how content is used and delivered to and from healthcare professionals. Current platforms such as X (formerly Twitter), Facebook, and LinkedIn will most likely be surpassed by new platforms driven by changes in policy, new technologies and the demands of consumers. An example of the former is the current debate regarding X (formerly Twitter) with a significant proportion of users switching to Mastodon. Regarding the latter, we have already seen a lot of attention being drawn by new platforms such as the Metaverse. The Metaverse represents a blend of digital environments that use augmented reality and virtual reality to create an immense online world. Within the Metaverse, users can interact using avatars and perform various activities, from shopping to attending virtual events, creating an immersive dimension to SoMe. While still being under construction, we see it already making its inroad into healthcare with examples in medical education (e.g. anatomy lessons), virtual conferences, remote consultation in the post-pandemic healthcare ecosystem, and the field of rehabilitation.^33–35 Furthermore, technological advancements such as blockchain and artificial intelligence (AI) may provide solutions to some of the current challenges described in this article. Blockchain is a decentralized digital ledger technology that provides a secure and tamper-proof platform for storing and sharing data. Healthcare could use this to create a decentralized platform for patient data on SoMe. This would help address the privacy and security concerns associated with the use of SoMe for the sharing of patient information. In fact, patients could control who has access to their information, and the information could be encrypted and distributed across a network of computers, making it virtually impossible to alter or tamper with without detection. Patients would have more control over their health information, with their privacy and security protected. Additionally, AI could monitor SoMe platforms for accuracy and reliability. Secondly, ethical considerations will also be a key factor in shaping the future use of SoMe for the sharing of patient information. Healthcare providers and organizations will need to ensure that patient privacy and confidentiality are respected and that patients are adequately informed and have given consent for their information to be shared. Patient empowerment and engagement will also need to be considered, as patients become more involved in the management of their health and will use SoMe to actively share experiences and possibly seek medical advice. Lastly, it is likely that there will be increasing regulation and oversight regarding the use of SoMe for sharing patient cases. Stricter rules for obtaining patient consent may be enacted, and penalties for violating patient privacy could be imposed. Furthermore, healthcare organizations and professional associations, including the ESC, are likely to develop best practices and eventually guidelines for the responsible use of SoMe in the healthcare setting. These may include advice regarding obtaining patient consent, de-identification of patients, and how to maintain appropriate boundaries between healthcare providers and patients. The recommendations made within this article are to be seen as a first step towards this guidance but should be further refined in the future.

Conclusions

The cardiology community has increasingly embraced the use of SoMe as a platform to share their clinical experiences. It offers unparalleled opportunities for open communication on a global scale, enabling rapid knowledge dissemination, particularly, when it comes to sharing patient information. However, this practice may expose sensitive personal data to a potentially extensive audience, compromising privacy both online and offline. To safeguard patients’ rights, the GDPR serves as a crucial legal framework, addressing key aspects such as ‘Consent’ and ‘Anonymization.’ Furthermore, ethical considerations and social responsibilities associated with utilizing SoMe for this purpose deserve due acknowledgement. These factors highlight the necessity of developing formal guidelines to ensure responsible usage. The recommendations presented in this article should be considered as an initial stride towards creating such a comprehensive document, acknowledging the importance of protecting patient privacy while leveraging the benefits of SoMe in the cardiology community.

Funding

This work was funded by the European Society of Cardiology.

Data availability

No data were used.