PowerPoint

HIPAA Violations on Social Media: THINK Before You Post!

by Dorothy Bouldrick

44 Unfortunately,

students are often

unaware of the

professional

repercussions

unprofessional

conduct on social

media can have on

their careers/'

In tro d u c tio n Social networks such as Facebook

and Twitter are used by healthcare professionals and students pursu­ ing health careers to communicate, collaborate, network with col­ leagues, market healthcare ser­ vices, and share personal and pro­ fessional experiences. Social media technologies have provided users with new and engaging communica­ tion tools such as Instagram, Vine, and blogs that have changed the way people communicate. This change provided a platform to enable its users to reach large audi­ ences in a matter of seconds! However, the ease with which users can transmit information to the masses has presented challenges in the form of unauthorized disclosure of patients’ health information on social media sites. The increase of patient privacy violations on social media has healthcare and academic leaders struggling to find ways to combat the problem. After all, HIPAA (Health Insurance Portability and Accountability Act) training is a staple in allied health programs and the healthcare industry; yet, unau­ thorized disclosure or protected health information on social media continues to make headlines (see Table 1).

Healthcare professionals and scholars (Kwoh, 2012; Chretien et al, 2011; Ressler & Glazer, 2010; Thompson & Bell, 2007) have framed the conversation surround­ ing patient privacy violations on

social media. Some have expressed the need for social media policies to be developed and implemented by institutions of higher learning (Chretien et al, 2010; Thompson & Bell, 2007). Subsequently, Chretien et al (2010) stated “finding balance in expression of free speech and medicine’s social contract with society may require consensus gathering among all stakeholders: the public, practicing physicians, medical educators, and students.” Unfortunately, students are often unaware of the professional reper­ cussions unprofessional conduct on social media can have on their careers. In some cases, a student’s career can be over before it gets started (Woodley, C., & Silvestri, M., 2014).

H IP A A V io la tio n s v ia S oc ia l M e d ia A re on th e R ise!

There have been several well-pub­ licized cases of HIPAA violations regarding patient privacy breaches on social media sites such as Facebook and Twitter. While previ­ ous incidents were found to be unintentional, the more recent cases are showing signs of mali­ cious intent and that the problem is escalating. In a case involving a community college in Kansas, one of four students was dismissed from a nursing program for posting photos of themselves in a lab with a human placenta on Facebook. The student that posted the photo pro­ claimed that she was given permis-

24 AMT Events March 2015

sion by her instructor; however, the instructor denied the allegation. The student sued the college for viola­ tion of her due process and was reinstated into the program. The judge’s ruling in this case favored the student on the grounds that the college failed to clearly define that the student violated professional conduct (Chronicle of Higher Education, 2011). This ruling high­ lights the importance of discussing social media do’s and don’ts with students before beginning a practicum/ intemship/extemship. It also revealed a need for allied health faculty and administrators to develop social media policies with clear guidelines for its use both in and out of the clinical setting along with clear conse­ quences for violators.

HIPAA’s Privacy Rule HIPAA’s Privacy Rule set the guidelines for the use and

disclosure of protected health information. The Privacy Rule protects all “individually identifiable health infor­ mation” held or transmitted by a covered entity (e.g., health providers, health plans, healthcare clearing­ houses) or its business associate, in any form or media, whether electronic, paper, or oral. (HHS, 2006). This identifiable information can relate to (a) the individual’s past, present or future physical or mental health or con­ dition; (b) services provided to the individual, or, the past, present, or future payment for services rendered to the individual. Unauthorized disclosure of this informa­ tion can lead to a breach of HIPAA’s Patient Privacy Rule (HHS, 2006). A breach is impermissible use or disclosure of protected health information that can cause signifi­ cant risk to the affected individual.

Consequences for Violators Healthcare facilities that do not comply with HIPAA

regulations can be excluded from participation in the Medicare/Medicaid programs, disciplinary action by the hospital board, and other professional licensing and cer­ tifying agencies. The unauthorized disclosure of protect­ ed health information (PHI) knowingly or unknowingly on social media or any other form can result in civil and criminal penalties with fines and possible imprisonment. Penalties are:

• $100 per violation, up to a $25,000 maximum per year for repeat offenders

• $50,000 per violation; 1.5 million dollar maximum • Certain offenses can result in up to 5 -10 years in

prison if the information obtained is found to be used for personal gain or commercial profit.

Please visit the American Medical Association’s HIPAA Violation and Enforcement website for more detailed information on fines and penalties.

Table 1 Cases of HIPAA Violations via Social Media

Institution Case Overview University of Cincinnati Medical Center

Patient claimed a financial ser­ vices employee posted a screenshot of her medical re­ cords including diagnosis and other identifying information on social media

Johnson County Community College

One of four nursing students dismissed from nursing pro­ gram for posting photos of themselves in a lab with a human placenta on Facebook

Westerly Hospital in Rhode Is­ land

Emergency room doctor termi­ nated, reprimanded by the state medical board, and fined $500 for posting information online about a trauma patient

St. Mary Medical Centers in California

Four staff members terminat­ ed, three disciplined for post­ ing photos of a dying patient on Facebook. Two of the em­ ployees involved were nurses

Tri-City Hospital in California Employees utilize social media to post personal discussions of patients

Mercy Walworth Medical Cen­ ter in Wisconsin

Nurses were terminated for posting photos of a x-ray showing a sex device lodged in the patient’s body on Face- book

University Medical Center Nursing School Mississippi

Administrative Assistant termi­ nated for a tweet expressing her dislike for the Governor having the facility staffed on Saturday when it is normally closed, instead of scheduling an appointment during normal operating hours.

Richmond University Medical Center Staten Island

EMT posted picture of a mur­ der victim who had been strangled with a hair-dryer cord on his Facebook page

Is it a HIPAA violation if my post does not include patient identifiers (nam e, address, DOB, medical record number, etc.)?

A common misconception concerning unauthorized disclosure of protected health information involves HIPAA’s Privacy Rule de-identification methods. To avoid privacy breaches using de-identification, “the removal of specified individual identifiers (as well as absence of actual knowledge) that the remaining infor­ mation could be used alone or in combination with other information to identify the individual must be utilized to prevent unauthorized disclosure of health information (HHS, 2013). Therefore, if a post contains snippets of information such as place of incident, date, and time of incident where others in your network familiar with the incident can determine the patient’s

(continued on page 26)

AMT Events March 2015 25

HIPAA VIOLATIONS (continued from page 25) identify, a breach has occurred (Cromwell, 2011). These types of privacy violations often occur during times of catastrophic events such as major accidents, natural disasters, or other unusual medical events that make headline news. Other instances of unauthorized disclosure of protected health information occur during clinical rotations by students who inadvertently disclose protected health information on personal social networks, class blogs using proprietary hosting sites, instead of the firewall protection of the college’s learning management system (LMS) (Chretien et al, 2009).

Best Practices for Social M edia Use The enormous potential of social media technologies

for dissemination of health information, marketing healthcare services, patient feedback and community building is extremely valuable in healthcare. There are hundreds of blogs, wikis, Facebook pages, and other social networking sites that focus on medical and health topics. The most popular health websites reported by eBizMBA (2013) are Yahoo! Health (21.5 million), National Institutes of Health (20 million), WebMD (19.5 million), MedicineNet (10.5 million), MayoClinic (7 mil­ lion), and Drugs.com (6 million). The Mayo Clinic Center for Social Media is the leader in demonstrating how the appropriate use of social media can foster collaboration, patient education, professional development, and improved patient outcomes. By all means, utilize social media to foster good patient outcomes, but consider the following to safeguard patient privacy:

1. Review your college and/or employer’s social media policy to become aware of the do’s and don’ts of social media use. If your college and/or employer do not have a social media policy, review “Professionalism in the Use of Social Media” by American Medical Association and/or “A Nurses Guide to the Use of Social Media” by the National Council of State Boards of Nursing (NCSBN). Although these guidelines are geared toward physi­ cians and nurses, they encompass the professional behaviors expected of all healthcare professionals using social media. You may also review the NCSBN Social Media YouTube channel for videos to gain a clearer understanding of appropriate and inappro­ priate use of social media.

2. Review your privacy settings and get a clear under­ standing of privacy policies before posting content. Deleting a post does not mean it was not read and shared with others online.

3. Identify yourself. If you communicate via social media about a healthcare provider, disclose your connection with the provider and your role at the facility. Use good judgment and be accurate.

4. Although you may have a personal social media page, remember that you share a connection with your employer and anything you post about your workday or patients can be linked back to the pro­ vider.

5. Do not post photographs of patients, healthcare set­ tings, lab procedures, specimens, or anything involv­ ing patient care on social media.

6. Do not use social media to discredit or air grievanc­ es with your employer. Resolve conflicts in-house with the help of your supervisor and human resources.

7. If you become aware that another extern has posted patient information on a social media site, report it to your clinical coordinator and program director immediately!

8. Think before you post! Ask yourself, how would I feel if I were the patient? How would my family feel? The Golden Rule always applies!

The Takeaway... Incidences of unprofessional conduct via social media

by students present continuous challenges for allied health faculty and administrators. Some have expressed the need for social media policies to be developed and implemented by institutions of higher learning (Chretien et al, 2010; Thompson & Bell, 2007). As providers of care, clinicians and administrative staff are charged with not only delivering quality care and services, but being an advocate for patients. Students and healthcare work­ ers must display professional, ethical behavior at all times. Unauthorized disclosure of patient information on social media is not only a HIPAA violation; it is a vio­ lation of TRUST between the patient and the healthcare provider. Students performing practicums/intemships for program completion must demonstrate the high pro­ fessional standards expected of healthcare workers by protecting patient privacy and report incidences of pri­ vacy breaches found on social media to their supervisor or clinical coordinator to determine the appropriate course of action. Remember, the Department of Health & Human Services (HHS), Office of Civil Rights (OCR) is responsible for investigating complaints of privacy breaches. For more information about filing a com­ plaint, visit HHS at http://www.hhs.gov/ocr/privacy/ hipaa/complaints/index.html. ■

26 | AMT Events March 2015

References American Medical Association (2011) Professionalism in the Use of Social

Media. Retrieved from http://www.ama-assn.org/ama/pub/physician- resources/medical-ethics/code-medical-ethics/opinion9124.page?

American Medical Association (2009). HIPAA Violations and Enforcements. Retrieved from http://www.ama-assn .org/ama/pub/physician-resources/ solutions-managing-your-practice/coding-billing-insurance/hipaahealth- insurance-portability-accountability-act/hipaa-violations-enforcement. page?

American Society of Registered Nurses. (2010). When Facebook Goes To The Hospital, Patients May Suffer. Retrieved from http://www.asm.org/joumal- nursing/july-2010.html

Chretien, K. C. MD, Faman, J. M. MD, Greysen, S„ MD &; Kind, T. MD (2011). To friend or not to friend. Academic Medicine, 86 (12), pp 1545- 1550 doi: 10.1097/ACM.0b013e3182356128

Chretien, K.C. MD, Goldman, E. F„ Beckman, L. & Kind.T. (2010). It’s your own risk: Medical students’ perspectives on online professionalism. A cadem ic M e d ic in e , 8 5 (1 0 ), S 6 8 -7 1 . do i: 10 .1097/ ACM.0b013e3181ed4778.

Chretien, K.C., Greysen, S. R„ Chretien, J. & Kind, T. (2009). Online posting of unprofessional content by medical students. JAMA, 302 (12), 1309- 1315.doi:10.1001/jama.2009.1387.

Clark, K., & Kearns, S. (2010). Hospital Seek to Terminate Hospital Workers for Privacy Breaches on Social Media. Retrieved from http://www. healthleadersm edia.com /page-l/H R -252540/H ospital-Seeks-To- Terminate-Five-Hospital-Workers-For-Privacy-Breaches-on-Social- Media##

Conaboy, C. (2011, April, 20). For doctor, social media a tricky case. Boston Globe. Retrieved from http://www.boston.com /lifestyle/health/ articles/201 l/04/20/for_doctors_social_media_a_tricky_case/

Cromwell Communications (2011, July 1). Avoiding HIPAA violations in social m edia [Web log post]. Retrieved from http ://w w w . cromwellcommunications.com/content/avoiding-hipaa-violations-social- media

HIPAA Security & Privacy Advisors, LLC (2011, May 31). Allina terminates 32 employees [Web log post]. Retrieved from http://w w w . hipaasecurityandprivacy.com/201 l_05_01_archive.html

KWOH.L. (2012, October, 29). Beware potential employers are watching you. The Wall Street Journal, Retrieved from http://online.wsj.com/article/SB 1 0000872396390443759504577631410093879278.html

Lipka, S. (2011, January 7). Nursing Student Dismissed for Placenta Photo Sues Community College in Kansas. Chronicle of Higher Education. Retrieved from http://chronicle.com/blogs/ticker/nursing-student- dismissed-for-placenta-photo-sues-community-college-in-kansas/29460

Mayo Clinic Center for Social Media (2012). Retrieved from http://network. socialmedia.mayoclinic.org/mccsm/

National Council State Boards of Nursing (NCSBN) Social Media guidelines for nurses YouTube channel retrieved from http://www.youtube.com/ watch?v=i9FBEiZRnmo

National Council State Boards of Nursing (NCSBN) A nurse’s guide to the use of social retrieved from https://www.ncsbn.org/Social_Media.pdf

Ressler, P. & Glazer, G. (2010). Legislative: Nursing’s engagement in health policy and healthcare through social media. OJIN: The Online Journal of Issues in Nursing, 16(1). doi: I0.3912/OJIN.VolI6No01LegCol01.

Schuman, E. (2014). Feds begin HIPAA probe in Cincinnati. Retrieved from http://www.healthcareitnews.com/news/feds-begin-hipaa-probe-cincinnati

Straw, J. (2013, February 18). Woman out of a job after sending tweet to Governor Barbour. MS News Now. Retrieved from http://www. msnewsnow.com/Global/story ,asp?S=l 1713360

Thompson, P. E„ & Bell, P. L. (2007). Potential student abuse of technology in the clinical setting. Nurse Educator 32(4) pp. 145-146. doi: 10.1097/01. NNE.0000281090.65958.12

U.S. Department of Health & Human Services (2006). Health Information Privacy. Retrieved from http://www.hhs.gov/ocr/privacy/

Woodley, C., & Silvestri, M. (2014). The internet is forever: Student indiscretions reveal the need for effective social media policies in academia. The American Journal of Distance Education, 2 8 (2 ), 126. R etrieved from h ttp ://sea rch .p ro q u es t.c o m / docview/1532765677?accountid= 14872

Dorothy Bouldrick, DMA, MRA, RMA (AMT), is Medical Assisting Program Director and Instructor, Medical University o f South Carolina.

AMT Events March 2015 | 27

Copyright of AMT Events is the property of American Medical Technologists and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.