Recent studies show the average user spends 1.72 hours per day on social media, which represents about 28 percent of all online activity[1]. With that much time spent on social media sites, it’s important for every large group practice to have a smart social media policy in place.
There are many uses for social media in one’s practice, from notifying patients that flu shots are available to sharing health-focused articles. Having well-educated patients means improved compliance, which leads to better outcomes. In addition, social media can be utilized to promote your practice and save money on advertising.
However, there are also risks related to social media that are unique to healthcare, of which providers should be aware. Everyone in a large practice needs to take care to protect patient protected heath information (PHI) as unauthorized disclosure of PHI subjects the practice to large fines for violating federal and state privacy laws, civil lawsuits, and possible medical board action – all of which can be costly for the practice.
A strong social media policy should save money every year by helping the practice avoid large fines and the costs associated with civil lawsuits and medical board discipline.
Here are some steps to ensure that your large practice is using social media effectively and responsibly:
- Put the right people in place.
It’s important to know who is managing your social media efforts, and whether a social media policy currently exists. A large practice may have a social media director, but sometimes someone from corporate communications or marketing leads this discipline.
Given the importance of social media, do you have the right team in place? Are they sufficiently experienced and responsible to handle the job? Are they stretched too thin to be effective? Make sure your team has everything they need to succeed.
- Benchmark your social media policy against others.
If your team already has a social media policy, it’s a good idea to benchmark it against others in the industry and determine whether the existing policy is up to date. Many firms publish their social media policies openly online, so a good first step is to have someone perform an online search of social media policies for healthcare companies.
- What makes a good social media policy?
A good social media policy should:
- Define what social media is and how people should use it
- Explain the rules surrounding patient privacy
- Educate staff about the consequences for breaching patient privacy
- Emphasize keeping a workplace with a good business reputation: on social media you not only represent yourself – you represent the practice and the entire medical community
- Explain the importance of professional boundaries, for example, physicians who have a personal Facebook page should never “friend” patients
If your current policy says things like “be ethical and professional”, remember that this leaves a lot of gray area. Do other policies perform a better job of making things clear? Do they offer examples of specific behaviors that can lead to trouble? Remember that a major reason to have a policy is to ensure patient confidentiality. Provide clear and multiple examples of ‘what to do’ and ‘what not to do’, so staffers don’t inadvertently disclose things they should not.
- Creating or revising your social media policy? Choose the right tone.
Some social media policies are dense legal documents: long, detailed, and very complex. Others are brief, and strive to provide easy-to-remember guidelines. Which tone you choose depends on the culture of your organization. It’s important to reflect the language and sensibility of your organization and how you want to represent it.
No matter what the tone is, remember that your policy will only be effective if your staff can understand and remember it. Keep it as simple and brief as your culture will allow, and strive to be memorable. For example:
- It’s easy to remember: “No photos or videos inside our practice, ever.”
- It’s hard to remember: “Employees who carry smartphones or other devices which contain cameras or other recording equipment must exercise proper judgment about whether a photograph or video might inadvertently lead to a breach of patient confidentiality.”
In brief: keep things as simple and to the point as you can.
- Instruct staff on the consequences of noncompliance of the social media policy.
Don’t assume your staff is aware of all the regulations about patient privacy and the consequences of a privacy breach. Staff should be educated on the cost of potential fines, civil suits, and medical board investigations. The social media policy should also include what action will be taken against employees who violate the policy, including termination. If you’ve already instructed them on this, your social media policy is an opportunity to reinforce the message.
The Heath Insurance Portability and Accountability Act (HIPAA) has a list of 18 identifiers that are classified as Protected Health Information, including “Any other unique identifying number, characteristic, or code”. A photo of a knife or gunshot wound could easily constitute a breach. Even a picture of an x-ray, with the patient’s name blocked out might be a violation. In 2011, an emergency room physician who posted a few notable cases she had seen in the ER on Facebook, carefully avoided using patient names or ages. Yet, "unauthorized third parties" were able to determine one patient's identity from the post, so she lost her hospital privileges, and the Rhode Island medical board found her guilty of unprofessional conduct and fined her $500[2].
- Beware: every picture tells a story.
Most people know you should never post a patient’s name, date of birth, or Social Security number online, but few realize how much information can be contained in what seems to be an innocent photograph.
Imagine a birthday party in a hospital emergency room. A colleague snaps a photo of the birthday girl posing with her friends around the cake. It’s posted on Facebook and Instagram. Sounds harmless, doesn’t it? But wait, there’s a long list of patients written in big letters on the wall behind them, captured in high resolution. Whoops. That’s a problem.
Should you ban taking photos at work? Probably.
- Keep personal and professional social media separate.
Social media breeds a certain informality that’s not appropriate for healthcare. If you have a personal Facebook page, it’s best not to “friend” any patients.
Insist that professional and personal profiles remain separate. Avoid blurring the lines and maintain smart boundaries: work is work, and friends are friends.
It’s simply good common sense.
- Celebrate and teach your natural “internal champions."
Every healthcare organization has staff members who are naturally great at promoting what your large practice does on social media. It pays to get to know them. It is important to work with and train employees on how to share content so people see what your practice has to offer.
Nothing beats authenticity in social media. When you find internal champions who are genuinely excited about what the medical practice is doing, help them do it in the best and safest way possible. The networking and brand awareness benefits for your practice can be priceless.
- In a large practice, cultural norms matter.
A reality of running a large practice is that you can’t monitor 500 employees the same way you can in a small practice of five employees. You have to teach cultural norms about social media, so the staff can have the common goal to protect patient privacy. For example, imagine an enthusiastic young employee is about to take a photo of a patient and her new baby on his smartphone. You need to be able to count on the more experienced employees to stop him or her and point out the dangers.
- Guard against too much screen time.
In some healthcare organizations, the interview process includes questions about the prospective hire’s social media practices.
The reason is simple: constant distractions impact productivity and patient safety. And because online activities are time-stamped, that information can be used in a lawsuit. If a physician has a bad outcome or caused harm by being excessively online during surgery, it could present problems in the practice’s and physician’s defense.
Your social media policy should guard against excessive use by everyone on staff.
Understand the risks, but don’t be afraid to dive in.
A strong social media policy for your large practice can help you guard against potential risks, while maximizing your opportunity to promote your practice and patient health. With good management in place, you can move ahead with confidence.
Author Kimberly Danebrock, JD, RN ,CPPS is Director of Risk Management, CAPAssurance and Director of Risk Assessment Peer Review, Mutual Protection Trust.