“Not all my friends need to know”: a qualitative study of teenage patients, privacy, and social media

Abstract

Background

The literature describes teenagers as active users of social media, who seem to care about privacy, but who also reveal a considerable amount of personal information. There have been no studies of how they manage personal health information on social media.

Objective

To understand how chronically ill teenage patients manage their privacy on social media sites.

Design

A qualitative study based on a content analysis of semistructured interviews with 20 hospital patients (12–18 years).

Results

Most teenage patients do not disclose their personal health information on social media, even though the study found a pervasive use of Facebook. Facebook is a place to be a “regular”, rather than a sick teenager. It is a place where teenage patients stay up-to-date about their social life—it is not seen as a place to discuss their diagnosis and treatment. The majority of teenage patients don't use social media to come into contact with others with similar conditions and they don't use the internet to find health information about their diagnosis.

Conclusions

Social media play an important role in the social life of teenage patients. They enable young patients to be “regular” teenagers. Teenage patients' online privacy behavior is an expression of their need for self-definition and self-protection.

Introduction

The growing number of online health communities, patient blogs, and patient portals shows that many people are active in social media as patients. The sharing of personal health information, such as information about diagnosis and treatment, has demonstrated benefits,^1–4 but also presents risks—for example, such disclosure may negatively affect relationships, job opportunities, and insurance options.^5–7

However, there has been a contradiction between people's attitudes toward privacy and their online privacy behavior, the so-called privacy paradox, which is well recognized.^8–10 For teenage users of social media, studies have found that they simultaneously seemed to care about their privacy but did not act on that concern, revealing personal information that can be used and disclosed by governments, marketers, and predators.¹¹

While there has been a growing body of research on the use of social media in the healthcare sector, a review of the literature on patients and social media showed that only 71 studies surveyed or interviewed patients (see appendix 1, available as an web-only supplement). Of these, only five studies focused on teenage patients^12–16 and four studies^17–20 included adolescents in their sample. None of the studies had privacy as a main topic.

There is evidence that concerns about who would get access to their health information or learn about their medical consultation affects actual or intended healthcare seeking behaviors by adolescents.^21–27 This shows that adolescents adopt privacy protective behaviors because of health privacy concerns.

In this paper we present a qualitative study to examine the privacy concerns and behaviors of teenage patients when using social media. Our objective is to understand how chronically ill teenagers manage their privacy on social media.

Background

Research supporting a privacy paradox among adolescents shows that only a minority of young social media users changed the default privacy settings from public to private,^{9 28 29} and that there seems to be a discrepancy between stated privacy concerns and the disclosure of private information.^30–32

However, there is more recent contradictory evidence and alternative mechanisms that can also explain this apparently paradoxical behavior. A PEW report³³ on American teenagers and social network sites documents heightened privacy awareness: 62% of the teenagers have changed their network's privacy settings to friends-only and 55% stated that they did not post something if it might reflect badly on them in the future. A Canadian report on social media use found that 65% of the youth had changed their privacy settings.³¹ A report on European youth found that only 27% of teenagers have their privacy settings on public.³⁴ These studies suggest that teenagers and youth are actively trying to manage their privacy on social media.

There is also evidence that young social media users care about their privacy, but can't act upon these concerns because of the design of social media. Research on the usability of privacy settings shows a mismatch between users' expectations of their privacy settings and the actual outcome of these settings.³⁵ The difficulty of managing privacy through privacy settings has led some teens to ignore a site's privacy settings.³⁶

There may also be a control paradox,³⁷ whereby the more control users feel they have over the publication of personal information, the more they are willing to disclose it, even if the risks associated with disclosure haven't changed. Teenage users of social media may think they have control based on a lack of knowledge about privacy and the illusion of control over personal information through friends lists and privacy settings.^{33 38 39} Regan and Steeves⁴⁰ warn, however, against simple models indicating that young people willingly trade their privacy for participation on social media—teens guard their online privacy, even from their friends.

Consistent with qualitative research investigating how users seek privacy,^41–44 we distinguish different dimensions of privacy that may explain the seemingly contradictory results. Building on Burgoon's⁴⁵ privacy framework, known from studies on patient privacy,^46–49 we distinguish social, informational, and psychological dimensions of privacy. Burgoon defined social privacy as having control over the actual interaction with others, and the frequency, length, and content of that interaction. Psychological privacy protects the individual from intrusions upon one's thoughts, feelings, and values, and the freedom to decide to whom to disclose certain personal thoughts and feelings. Informational privacy refers to the ability to control who gathers and disseminates information about oneself or one's group and under what circumstances.

Much of the current literature has focused on external threats to privacy, rather than the users' own perceptions of privacy.⁵⁰ However, children tend to seek privacy as a means to an end, not for privacy's sake.⁵¹ Teenagers are often not interested in informational privacy, the collection of personal information by governments and companies, but they are very concerned about their social privacy.^{41 42} Trepte and Reinecke⁵² argue that social media users feel threatened in their informational privacy, but they benefit in their social and psychological privacy. Mechanisms for controlling access to personal information, such as privacy settings and content management, allow users to experience social and psychological privacy. It is not known whether teenage patients have similar privacy behavior as other teenagers, and if so, whether some of the mechanisms described above can explain it.

Methodology

The study is based on qualitative description, an approach to qualitative research which focuses on describing the experiences of the participants in everyday language.^53–56 Qualitative description is often used in healthcare research^55–58 and qualitative methodologies are extensively used in research on patients and social media (see online appendix 1). We take as a point of departure the following questions:

1. Do teenage patients use social media and do they share their personal health information on social media?

2. When teenage patients choose not to use social media, or not share personal health information on social media, are they motivated by privacy concerns?

Sample, site, and recruitment

The sample consisted of teenage patients with a chronic illness receiving treatment at the Children's Hospital of Eastern Ontario (CHEO), a tertiary care pediatric institution in Ottawa, Canada. CHEO serves a population of approximately 600 000 children and youth in parts of Ontario, Western Quebec, and Nunavut.

CHEO offers its patients access to a wide variety of technologies for information, communications, and entertainment. The distribution and use of these technologies is integrated in the work of the child life specialists.ⁱ CHEO provides television in patient rooms plus desktops, game consoles, and printers in the playrooms attached to each ward. Patients receiving treatment at CHEO's day unit have a room with a television, desktop, and sometimes a game console. All patients can borrow a laptop. All patients and their visitors have free, 24 h access to CHEO's wireless guest network throughout the hospital.

CHEO also offers patients accounts to Upopolis, a closed social network for young patients in Canada offering a more private and secure Facebook-like environment.ⁱⁱ Access to Upopolis is controlled via the participating children hospitals. The site offers email, chat, discussion forums, photo album, blog, and age-appropriate medical information. Patients can connect with young patients in other hospitals in Canada, as well as invite important others, such as family members, school friends, and teachers, to become member of Upopolis.

In order to generate the necessary quality of description, it was critical that a sample of informants be selected in part on the basis of their experience. To this end, a purposeful sampling technique was used.^{59 60} Purposeful sampling involves selecting information-rich participants in part based on the relevance of their experience for the research focus of the study.

Sample size differs widely in qualitative research.^{59 61 62} Holloway and Wheeler⁶¹ suggest that 4–6 data units are sufficient for a homogeneous group and 14–20 data units for a heterogeneous group, in order to provide the basis for a meaningful analysis. Also gender balance and the health situation of the participants played a role in the CHEO sample.⁶² Patients with mental health problems or in the terminal stage of their disease were excluded from selection.

Based on these considerations, selection criteria were (1) ability to use CHEO's information and communication technologies such as its wireless network, laptops, and desktops; (2) ability to participate in a 30 min interview; (3) being a long-term patient at CHEO; and (4) having the ability to have a conversation in English. Use of social media was not a selection criterion, because hospital staff were not always aware of how patients were using the computers. It was expected that non-users of social media could contribute to the study, as they could be motivated by privacy concerns.

The patients were recruited by the hospital's child life specialists in consultation with the researcher. They were between 12 and 18-years-old: 11 girls and nine boys. Written informed consent was obtained from all participants and their parents (for participants younger than 16 years). The study was approved by the CHEO research ethical board. The patients were informed that participation was voluntary and that the interviews would be de-identified before analysis.

Data generation

The interviews were conducted in the fall of 2011. They were semistructured, based on a set of primary and secondary semistructured questions (box 1). Each interview started with the first question. Depending on the answers, a conversation developed around favorite things to do on the internet. If the patient mentioned social media, such as Facebook, YouTube, Twitter, etc, they were asked the third question about sharing personal health information. All patients were asked about Upopolis.

Box 1. Interview questions.

Primary and secondary semistructured questions:

1. Did you bring a laptop, phone or a MP3 player to the Children's Hospital of Eastern Ontario (CHEO) and do you use the internet while you are at CHEO?

   • 1.1 What are your favorite things to do on the internet?

   • 1.2 How often are you online each week and for how long?

2. What is the reason you are not active in social media?

3. How do you talk or write about your diagnosis or treatment in social media?

   • 3.1 Who can read what you write and what do you do to control that?

   • 3.2 How do you communicate with your best friend(s)?

4. Do you have an account on Upopolis?

   • 4.1 Why would you be interested in an Upopolis account?

   • 4.2 How do you use your Upopolis account?

Aided by the answers on these questions, a conversation followed, focusing on sharing information about diagnosis, treatment, and hospital stay on social media. Throughout the interview, prompts were used to elicit more specific answers or clarifications. Since no detailed questionnaire was used, each interview had its own flow, allowing issues such as privacy and disclosure of personal information to come up in a way that made sense to the young patients,^63–65 and that was less influenced by the preconceptions of the interviewer. An experienced interviewer with a background in qualitative research and interviewing patients conducted the interviews, which were recorded digitally on an audio recorder. The average interview was 30 min and was fully transcribed before analysis and reporting.

Analysis

Content analysis is widely used in qualitative descriptive studies.^{53 57} This study used Braun and Clarke's framework for content analysis, in which codes and themes are derived inductively from the interview transcripts and notes. This framework supports the qualitative description approach through a reporting of the experiences, meanings, and reality of the participants.⁶⁶

Manual data analysis started after the first three interviews and was conducted concurrently with data collection. Initial codes were generated by labeling data extracts with a code reflecting the meaning of the extract. These codes were then collated into potential themes. This coding was followed by an iterative process, in which the themes were reviewed with the coded extracts and the entire dataset. This review was conducted to ensure the consistent application of codes and themes, and to generate a thematic map of the analysis and clear definitions and names for each theme.

Results

Technology and social media use

All patients brought additional technologies for use in the hospital (see table 1). The majority of the patients had their own laptop and cell phone. About half of the cell phones and MP3 players were also used to access the internet.

Table 1.

Technology in use at the Children's Hospital of Eastern Ontario (CHEO)

Technology in use at CHEO	Owned by patient	Owned by CHEO	Used for internet access
Desktops	NA	2	2
Laptops	12	6	16
Cell phone	17	NA	8
MP3 player	11	NA	7
Tablet	2	NA	2
Totals	42	8	35

All patients were active on social media (table 2). Research for homework was the second most popular activity on the internet. All had a Facebook account and used their real name and date of birth on their Facebook profile.ⁱⁱⁱ Eighteen of them had changed their privacy settings to friends-only and two had friends-of-friends.^iv Eighteen teens had a profile picture in which they are recognizable.

Table 2.

Comparing facebook and Upopolis

Social network	Number of accounts*	Account expired or not in use because of lack of interest†	Preferred social network
Facebook	20	1	19
Upopolis	8	6	0

^*Twelve teenagers had never heard about Upopolis.

^†An Upopolis account expires when it has not been accessed for a month. One patient had not accessed her Facebook account for almost a year, but the account still continues.

Some use Twitter, mainly for following favorite celebrities, while YouTube is popular for watching videos. Two patients are active on Upopolis and one patient has a Tumblr account. Several patients used to be active on MySpace, but none of them was using MySpace at the time of the interview. None of the patients maintained a publicly accessible blog.

All teenagers mentioned that because they were in the hospital and couldn't spend time at school and with friends, they spent more time on the internet at CHEO than at home. Ten of the patients mentioned they used it “all the time” when they were not with hospital staff or visitors.

Themes from content analysis

Five themes emerged from the content analysis. The first two themes describe indirect influences on the privacy-protective behavior of the patients and help to explain the teenage patients' online activities. The other three themes explain their online privacy behaviors.

Online information-seeking behavior

The vast majority of teenage patients don't look for information about their diagnosis, medications, or treatment; they don't search for people with a similar diagnosis; and they don't participate in social media maintained by patient organizations (box 2).

Box 2. Online information seeking.

Finding 1. Most patients are not looking for diagnosis-related information on the internet—they believe that they know everything they need to know from their doctors:

“Well I know a lot because it has been since 2007, so I have learned. And the doctors here explained it very well.” (F/17)

Finding 2. Patients do not search online for patients with a similar diagnosis.

“I am doing fine on my own. I don't see it as a necessity.” (M/17)

“I actually haven't [looked for people with similar diagnosis on Facebook]. It never crossed my mind.” (F/16)

There was one exception, one teenager, interested in ice hockey, mentioned the strength it gives him to read on the internet about ice hockey players, who have had the same type of diagnosis,

“I sort of look up to them and say ‘If they can do it, maybe I can do it’. (M/13)

Online communication

The majority of the patients use Facebook for most of their online communication. Through its private messaging system, Facebook provides them with an effective replacement for email. Status updates (including photos and embedded audio or video) as public postings on their Facebook wall; private chats (text-only or video) with one or more friends; posting photos (photo albums), and tagging photos form the teenage patients' principal media of online communication (box 3).

Box 3. Online communication.

Finding 3. Facebook (FB) replaces email:

“No I don't use email, I usually use FB if I want to speak with someone.” (M/17)

“I think on FB the message is easily passed around, while with email, not many people have email. Comparison between Facebook and email, Facebook takes the top.” (M/17)

“I do, but no one uses email anymore. We use Facebook chat. It was such a big thing and all of a sudden it is left behind… I use email just for school so from a business perspective, not a social perspective.” (M/18)

“Email? No one uses email” (M/17)

Finding 4. Facebook is the place where patients stay up-to-date about life outside the hospital:

“It allows me to see what is going on in my school. I won't miss anything social or anything like that. It allows me also to keep updated with schoolwork so a couple of my friends they are in my classes so I message them and they will say oh you have this homework, you have to do. So I think it is really important.” (M/16)

“I did not mention anything on Facebook, but I have used my inbox on Facebook to set up how people can come to visit and stuff like that.” (F/17)

“Well Facebook helps a lot because you can keep in touch with what is going on at school, because I can't go to school, so this is how I check new updates between my friends.” (F/17)

“[Facebook] was kind of the only way I got to talk to friends and coordinate visits.” (M/18)

Finding 5. Facebook is used to check medication:

“Nurses [are my Facebook friends], but that is because I have known them like for a long time, so it actually is a lot of help. Like in the morning … I had asked, oh my medication changed … I usually get an answer right away.”(F/17)

Finding 6. Facebook is where the patients' different social networks merge:

“All people I know. Like that go to my school or that I have met. People I met at places where I worked and stuff. Family that doesn't live close to here.” (F/15)

Finding 7. Facebook is a place where patients at the Children's Hospital of Eastern Ontario (CHEO) meet:

“Hmm sometimes we do, like about doctors and stuff like he has a funny hairdo or like medication or stuff like that like we compare you know oh did you take like what happened when you did that. We kind of compare but apart from that we don't say like oh yeah I am going for surgery for nanana, it is not like professional, it is just for fun.” (F/15)

“We also say: ‘Oh I have this appointment, when do you have that’ and we try to meet up, to plan something on Facebook and we call sometimes.” (F/17)

“I don't think I really talked about anything like [diagnosis] through Facebook. I talked about stuff because of like just in general any friend.” (F/17)

Finding 8. Most online activities of patients are concentrated on Facebook:

“I am mostly on the (Facebook) games, a lot, and I edit my own pictures and stuff like that”. (F/15) “I put it on, it is always on, but not very many people use MSN anymore because Facebook has everything.” (F/17)

“And that is a great way to keep in contact with them like most of them are long distance so it is easier to talk on Facebook rather than calling and having airtime.” (F/17)

Applied privacy awareness

Privacy awareness is a person's attention, perception, and understanding of privacy issues. Teenage patients apply their privacy awareness using five different privacy techniques (from high incidence to low incidence of application) (box 4):

Box 4. Applied privacy awareness.

Finding 9. Restrictive privacy settings:

“My sister told me to put it on the highest level and all my friends agreed that was the safest.” (F/16)

“They are quite strict. What most people can see on my profile is my picture, my name, and my school.” (M/17)

Finding 10. No public status updates:

“[…] I am pretty careful with what I say. Because I understand that once it is up there you can't really take it back. Even if you delete it or whatever but it is there.” (F/17)

“I still want to maintain privacy toward myself, I don't want everybody to know why I am here.” (M/16)

“I tell my friends in real life you know, like when I talk to them in person, but not on Facebook.” (F/17)

“[My parents] don't let me.” (M/12)

Finding 11. Selective befriending of people online:

“Another thing I look for is mutual friends. If that person has no mutual friends with me I assume they don't know me.” (F/16)

“I don't add random people that ask me to be their friends, because I don't know them.” (F/17)

Finding 12. Different media for different groups of people:

“I only have one group of close friends and they are usually on MSN. So I don't have these extensive 1000 people groups [on Facebook].” (M/17)

[About Facebook chat] “I use it, I think it is more private and nobody really looks at it.” (M/16)

“No, because some of them did not tell their friends what is really wrong with them. Like all my friends know, but not all of them know. We keep some things quiet, so we go inbox.” (F/17) ^v

Finding 13. Audience segregation:

“I think it is important, it gives you I guess more privacy, like you wouldn't want your friends to know what you and your family are doing. You also don't want your family to know what you and your friends are doing. Because you want to be private about that, it is part of your life. I kind of have some boundaries because I don't have that much family and friends on my account. I use it because I don't want them to know what I do every minute.” (M/16)

• Restrictive privacy settings

• No public status updates

• Selective befriending of people

• Different media for different groups of people

• Audience segregation

Self-protection

Self-protection is behavior that seeks to prevent or reduce the likelihood of embarrassment, difficult questions, and feelings of vulnerability. Self-protection results in teenage patients avoiding mention of their diagnosis and treatment in their activities on Facebook. Self-protection has also a temporal dimension, as the need for protection changes over time (box 5).^v

Box 5. Self-protection.

Finding 14. Protection against uncaring Facebook friends and unwanted questions:

“Well, I don't really think it is anyone's business on Facebook. When I post it, everyone can see it. I don't think 350 people care if I am CHEO or not and I don't want to deal with their questions. Not that they are bad, but why do they need to know that much about me.” (F/16)

“No, not really, because I don't like to answer their questions about it that much because I find that people don't understand. Because you have to like be here and see everything and I am not too sure, I don't want to like mess with them up and they think it is something else. So I try not to mix my school life and hospital.” (F/15)

Finding 15. Diagnosis and treatment are not a secret, but teenagers only share it with family and best friends:

No it is not a secret. It is just that I don't go around telling everyone. If someone asks or finds out and asks, I will tell them. But I just don't go around telling everyone. I don't want to brag about it or complain about it. I don't need people's pity is my kind of thing.” (F/17)

“No, not a secret, but I am not telling it to everyone. My friends know that I have it” (M/17)

“No, no, only my family knows and some of my friends, so I don't really like to post it” (F/17)

Finding 16. Creating a virtual self in which one is healthy and strong is a form of self-protection:

“It is another world. […] I go to the [game] and there is someone else playing a character and I go to that character that he is controlling and say ‘hello’. And he sees I am saying to him ‘hello’. It is like being yourself in another world.” (M/17)

Finding 17. Meeting with patients with a similar diagnosis may increase one's own pain:

“[I don't like talking to someone who has the same] …. I don't know. I feel happy to know I am not the only one, but I also feel sad that someone else is suffering as bad as … .” (F/16)

Finding 18. Topic avoidance on Facebook:

“If they don't ask, I don't bother telling them” (F/15)

“I don't need everyone knowing where I am” (F/16)

“Facebook is not a place to talk about that stuff” (F/17)

“No, there is no clue [on Facebook] that I am sick” (M/17)

“I just think that if people want to know, they should ask me. They should not just read it [on Facebook]” (F/17)

“I don't put it out there: Oh I have that or how I feel” (M/17)

Finding 19. Self-protection has a temporal aspect:

“Only at the start [I mentioned that I was in CHEO], but not any more.” (M/13)

“I was still in the acceptance stage, you know, but now, I am pretty open about it when people ask me. I am not going to scream it to every one, I wait until someone wants to know. I am not ashamed of it” (F/15)

“I find that a lot of people lack the maturity to understand that there are bigger risk associated with it, then what they actually think. One example is with your job. You can ruin your job by putting something out there you will regret. I also find it is not a healthy relationship to just talk to someone over Facebook to openly have a conversation that everyone can see. It takes away a bit of the intimacy. Being a patient I think it does change my perspective, it changes my view.” (M/17)

“Some of my friends had put up some inappropriate pictures, so I wrote under them ‘Good luck with finding a job with that photo.” (F/16)

Self-definition

Self-definition is about identity, one's needs and attitudes, and the presentation of the self to others. Teenage patients present themselves on Facebook as regular teenagers. They do not write public status updates about their stays at CHEO or the treatments they receive (box 6).

Box 6. Self-definition.

Finding 20. Self-definition means being in control over how you present yourself on Facebook:

“There is no point of me saying on Facebook ‘Oh I am going to cry’. I just make everybody else worried. My problems are my problems and not everyone else’s.” (M/17)

“I don't really want people thinking like I was going to be sick all the time. I rather showcase the parts where I am doing better, where I feel good rather than feeling bad” (M/18)

“No, there are no pictures from the hospital [on Facebook]. I mean it is like … I don't know… showing my weakness. I would not show that to anyone.” (M/17)

“I don't talk too much about too many personal things on Facebook … I am not someone who likes exposing stuff” (M/17)

“I like to be as regular as I can, so I don't want to talk about it.” (M/13)

“I just don't like people to think I am complaining, like ehh ‘Oh I am sick’, because it is really not that bad compared what other kids have …. So I try to keep it private.” (F/17)

Finding 21. Some don't want to be identified as a patient offline as well:

I take my [diagnosis] on my own. I don't want to talk to other people who have the same thing as I have. I spoke to people that have the same thing as I do. I understand what they are going through, but … I don't like to talk about it. As I said, I try to live my life without being remembered that I have it. Speaking about it is a way of remembering. That is what I don't want to do; that is why I don't want to talk about it.” (M/17)

“I guess I just pretend I am normal and I don't have it when I am outside the hospital.” (F/17)

Finding 22. Upopolis is a social network where you can be a patient:

“In Upopolis it is people that share a hospital experience. In Facebook it is just normal … well it is not a good word, normal, but you know what I mean. I think that sharing my story without them knowing exactly who I am, can be helpful to another person, who has just found out she or he has the same sickness as me. And because it is something rare, hmmmm it is just I think it is nice if I can help someone.” (F/17)

“Yes, [Upopolis] is a great network to talk to other patients who have the same diagnostic as you do. So, since I am new at this, people that are not can explain how they dealt with it.” (F/17)

Finding 23. Facebook and Upopolis fulfill different needs:

“I think Upopolis would be good and Facebook at the same time because if you like to talk to other people that have the same what you have, so you can ask them a question like ‘have you been through this’ or ‘what do you think will happen’. You can't do that on Facebook.” (F/17)

“[…] it is mostly because its other sick kids that share experiences like I have. […] It is more of a connection that I don't have with my Facebook friends.” (F/17)

Discussion

Use of social media

Teenage patients spend many hours a day on the internet, but they don't define themselves as patients: they are not interested in reading about their diagnosis or finding peers with a similar diagnosis. Facebook is the most popular internet site for the majority. It fulfills an important need: it provides the patients a place to be regular teenagers. It enables them to stay up-to-date about their social life—like any other regular teenager. Facebook is about life outside the hospital, not about their lives in the hospital or as a patient.

Facebook is a space for online social networking with “strong link” relationships (parents, family, best friends) and “weak link” relations (school friends, friends-of-friends).^{67 68} It is also teenagers' preferred site on which to send and receive email (private messaging or “inbox”), to stay up-to-date about homework, and to share photos. The patient's social support network^69–71 of parents, siblings, other family, best friends, schoolteacher, and special medical personnel has merged with the teenager's Facebook-based online social network. This explains why some of the patients, who have known their nurses for years or for most of their lives, are Facebook friends with their nurses. As Facebook fulfills most of the patients' information and communication needs, it is not surprising that one patient uses Facebook to be in contact with nurses when she has a question about her continuously changing medication (although this communication is prohibited by hospital rules).

Managing disclosures of personal health information

Teenage patients are selective about sharing their personal feelings and thoughts about their diagnosis, medications, treatments, and prognosis and often avoid talking about it.^{72 73} Motivated by their need for self-protection, as a chronically ill patient, and self-definition, as a regular teenager, teenage patients apply a variety of techniques to manage with whom they communicate (privacy-settings; friends-list; audience segregation^{74 75}) and how they communicate (choice of media; public and private communication on Facebook). This becomes apparent in public status updates. Many of the patients are in and out of the hospital. Some patients are in the hospital a couple of times a week; others stay for weeks or months at a time, often repeatedly. Facebook users often let each other know where they are or what they are doing. However, 18 out of 20 teenage patients do not write status updates on Facebook when they are at CHEO or return to CHEO.

These measures lead to the situation that the majority of patients have a subjective experience of privacy because they feel in control of their personal health information on Facebook. Most teenage patients also express confidence in their Facebook privacy settings and check those settings regularly. They experience high levels of social privacy and psychological privacy as a result of their privacy-protective behavior.⁷⁶ For example, they decide who can be their Facebook friends (social privacy) and what kind of personal health information they share with certain friends in private messages and chats (psychological privacy).

All patients, including the two patients who regularly share personal health information publicly with all their Facebook friends, feel they are in control over their privacy on Facebook. This might be called a control paradox,³⁷ especially when this information can be accessed by third party applications,⁷⁷ but it is not a privacy paradox. Their experience of social and psychological privacy is genuine, even if it is, from an informational privacy perspective, an illusion of control.⁵²

The intentional sharing of personal health information on Facebook can also be explained by the privacy dilemma.^{44 78} For example, one patient, who has friends-only privacy settings and normally doesn't write about her diagnosis on Facebook, made a public status update on her Facebook wall when her favorite hockey team visited CHEO. Again, the privacy paradox, understood as caring about privacy but not acting upon that concern, does not explain her behavior. Disclosing the fact that she is ill and in the hospital, while writing about her meeting with famous hockey players, is better understood as a dilemma—she has to choose between two unfavorable alternatives: less (psychological) privacy or less social interaction. There is no third choice: not participating in social media is not an option.^{79 80}

The feeling of being in control over their social and psychological privacy is challenged every time Facebook changes its privacy policy. Some of the teenagers express irritation with Facebook's regular changes, which require them to recheck their privacy settings, but don't seem worried about Facebook's privacy policies. Thus while other studies found concerns among teenagers and adolescents about their informational privacy,^{41 42 52} teenage patients did not express such a concern. Their applied privacy awareness⁸¹ results in a high level of privacy-sensitive activities to restrict the disclosure of their personal health information to some selected individuals in private communication, but at the same time obscures possible threats to their informational privacy, such as third-party access to their profile information.⁸² Only one patient questioned Facebook's access and use of personal information for targeted personalized advertisements:

“I feel you can never be really sure, like I have, I think I have pretty good privacy settings on my Facebook but at the same time like I know that advertisements on the side are like catered to me and so there has to be somebody like some headperson-like advertiser on Facebook that like sees my profile and sees my hobbies like things I listen too and stuff like that and then draw from that to meet the advertisers.” (F/17)

Multiple needs—multiple social networks

The interviews also make clear that both Facebook and Upopolis fulfill different but significant roles and goals. Facebook is about maintaining an existing social network (home, family, school, club), while Upopolis is for building a new social network as a patient. This doesn't mean that all patients will be active on Upopolis if given an account: the interviews make clear that for at least six patients their self-protective behavior and their self-definition will militate against being active on Upopolis. They aren't interested in meeting peer patients online or offline, as they don't want to be reminded that they are ill or are in pain or that others are. The social and psychological privacy they seek is not so much expressed in terms of controlling access to personal health information by people they know,^42–44 but about being in control of defining who they are and how they want to be perceived.⁵²

Limitations of this study

In order to increase the validity of the teenagers' self-reporting on the privacy and disclosure of their personal health information, they were assured, both in writing and verbally, that the interview data would be de-identified and all reports would be based on anonymized data. Second, all teenagers were told that the interviewer had no access to their medical records and that their diagnosis was not a topic in the interview. Nevertheless, it remains a limitation of this study that the self-reported data could not be checked against the teenagers' actual behavior on Facebook or other social media.

Further research

This is the first study focusing on teenage patients and privacy on social media. To deepen the understanding of teenage patients' disclosure of personal health information on social media, research could depart from the teenagers' activities on social media. Interviews can be combined with participatory observation in social network sites. This will also largely resolve the limitation resulting from self-reported data.

Further research could also consider the temporal dimension of privacy. Personal privacy needs may change after a teenager is diagnosed. The patient's disease development may also affect the need for privacy or disclosure. The diagnosis of the patients may therefore become an important factor in the analysis of patient privacy and social media.

Lastly, online privacy concerns may be an extension of offline privacy concerns. Further research on the relation between online and offline privacy concerns may contribute to understanding how patients manage their personal health information on social media.

Conclusions and implications

This study demonstrates the central role of social media in the lives of teenage patients with long-term or chronic illnesses. It also documents the patients' privacy awareness through a mapping of their privacy-protective techniques. This applied privacy awareness is not always expressed in terms of a monolithic view of privacy. Rather, self-definition and self-protection intersects with privacy awareness and results in their privacy-protective behavior. Also a temporal dimension of privacy becomes clear. Privacy needs change over time.

All patients use the Facebook privacy settings and only a few intentionally disclose personal health information to all their Facebook friends. By acting upon their privacy awareness, these patients feel secure within their friends-only Facebook environment. The study found that the disclosure of personal health information in social media is best explained by the control paradox and the privacy dilemma, rather than the privacy paradox.

Some patients seek social support in Upopolis, a closed social network for young patients in Canada. The majority of the teens identify the different needs Facebook and Upopolis fulfill. It is to be expected that the need for social network-based communications between (teenage) patients and between patients and healthcare providers will increase.

The implications of the results of this study point to the need to strengthen age-appropriate privacy-awareness education, social media with strong default protections of informational privacy, usable and transparent privacy settings, and recognition of teenage patients' social and psychological privacy needs.

An interesting observation from the interviews was that teenage patients do not use email. While healthcare institutions and professions^83–85 have policies governing interactions between patients and providers via email, we are not aware of any governing interactions using messaging systems in social media. There is a need for guidelines on such communications.