They say a picture is worth a thousand words– but when a picture is posted to social media not following HIPAA guidelines, it can quickly be worth thousands more. In our fast-paced digital world all it takes is one photo– say in an operating room with the patient clearly identifiable – to entertain the Internet and quickly leave a physician, medical practice or hospital in danger of violating the Health Insurance Portability and Accountability Act of 1996.

What Should Healthcare Providers Do?

Should all medical providers cease and desist their online following at once? Absolutely NOT! Despite the potential problems, social media platforms are a great way to connect with patients, provide valuable tips, establish trust, and position themselves as the experts in their field. With the right training and a clear understanding of what is PHI (protected health information), HIPAA rules, regulations and violations, physicians and healthcare organizations can successfully connect with patients.

Here are 5 things to consider:

1. Train, train, train

One of the biggest downfalls for a healthcare organization is the lack of proper and consistent social media training for their employees. For those in the medical world, one blunder online can quickly equal tens of thousands of dollars in penalties. To avoid this, ensure every physician and new employee understands the various HIPAA and FDA regulations in regards to social media and healthcare marketing. Don’t forget to keep continued education a focus throughout the year, as well.

Ultimately, in healthcare, a patient’s health and privacy is the highest priority, and it’s the responsibility of those who are managing social media platforms to make sure anyone associated or employed by a medical practice or hospital has a firm understanding of what is permissible and what is not.

2. It’s All In The Details

The most important key to a HIPAA compliant social media strategy is to understand what is considered a violation. The most common violations occur when a staff or healthcare organization does not know, ignores or overlooks one of the 18 Protected Health Information (PHI) rules. PHI is anything that can reveal a patient’s identity. While it should be obvious that disclosing the name of a patient is a violation, it can also happen unintentionally. For example, a patient’s name is visible on paperwork, a monitor, X-ray image, or a patient in the background of a picture as just to name a few. For a full list of PHI violations, visit the U.S. Department of Health and Human Services at HHS.gov.

3. Taking Ownership

We get it– it wasn’t posted under your company account, so why are you being held responsible, right? Unfortunately, even if you follow all of the rules for your company’s social media accounts, the possibility of a patient posting to your account or an employee posting on their private accounts, can still cause problems. For this reason, on Facebook specifically, it is recommendedthat physicians and healthcare institutions disable the ability for individuals to post directly to their Facebook walls. Allowing individuals to post directly to a medical practice, physician or hospital’s Facebook page could open up the opportunity for private patient information to be shown- and therefore, have PHI displayed publicly.

If a patient posts something that is in clear violation of HIPAA to one of your account’s pages, do not engage in conversation with them about it and immediately seek guidance on whether the post should be deleted or not. Hiring a marketing professional in the field of healthcare, is always recommended. Here’s a hint – MOXY knows what to do!

4. Define clear guidelines

Developing a foundation of guidelines for your social media presence is paramount to staying compliant. Creating a practice social media guideline is vital when your staff is active on social platforms. Some basic guidelines include:

• Provide clear examples of do’s and don’ts

• Control who has access to the company accounts

• Have each social platform approved prior to use

• Create a compliant social media marketing calendar to be approved ahead of time

• Monitor and moderate the accounts and comments on a routine basis

• Encourage employees to report any violations they see

5. Don’t forget the FDA

While everyone seems to be focused on remaining HIPAA compliant, we don’t want you to overlook the FDA’s stand on social media violations, as well. Remember, the Food and Drug Administration (FDA) tightly regulates advertising or sharing of information related to drugs and even medical devices. Physicians and pharma companies are also under strict guidelines when it comes to marketing or responding to requests related to the off– label use or procedure of a drug or treatment. Pharma and medical device companies are required to post the “good, bad and the ugly” when marketing their products. Many pharma and device companies provide physicians and healthcare institutions with social media content - graphics, gifs, videos, captions - assets as well as approved content to use. To stay within compliance, it’s imperative that when using content and/or graphics created by pharma companies, it is used exactly as the guideline require.

Should you choose to use social media in your marketing strategy, all staff, including physicians, should know and always use guidelines and best practices to stay HIPAA and FDA compliant.

One of MOXY’s biggest tips, think before you post or comment on any social media platform. Do not share a patients’ names, personal information or photos without proper consent.

A marketing plan is an essential tool for any hospital, physician or independent medical practice. A smart plan will create a thriving social media presence allowing you to inform, connect and educate patients. One of the first steps in preparing a HIPAA compliant strategic plan, is to hire or consult with a marketing professional that specializes in healthcare, like MOXY Company. Having clear directions and guidelines for everyone in your organization, will help with planning, anticipating, assessing, preparing, and protecting your organization from any pitfalls, as well as creating a successful marketing strategy. Reach out if you are ready to take your marketing to the next level of amazing!