504S: HIPAA Compliance: The Security Rule

504S: HIPAA Compliance: The Security Rule

A Summary of the Relevant HIPAA Regulations

Health Insurance Portability and Accountability Act (HIPAA) was implemented before social media platforms came into use so, there lack specific HIPAA rules regarding social media use in the clinical practice. However, two  HIPAA regulations apply to the use of social media utilization in health care. The first regulation is to never share Protected Health Information (PHI) to anyone who does not have the right to access it without the patients’ consent. It encompasses limiting access of PHI even on social media. The rule prohibits the posting of any videos and images of the patients even with the faces blurred out as well as posting gossip about patients even if their names are not used. The rule also prohibits posting any information that could result in specific patients being identified. For instance, filming a surgery without showing a patent’s face while exposing an identifiable feature such as a tattoo of the patient that makes him or her recognizable. The second rule requires that employees be trained on HIPPA before they start working for the organization. The HIPPA training must include the use of social media in health care to ensure that violations do not occur. The reason is that, with HIPPA training, health care providers have an idea of what they can and what they can no post on social media.

Concerns about Risk Exposure to the Practice

Concerns about risk exposure to the clinical practice concerning the use of social media include violations of privacy and confidentiality of the patients as well as reduced patient satisfaction. Breach of patients’ privacy and confidentiality can happen intentionally or inadvertently. For instance, hospitals that are not HIPAA compliant can intentionally post the before and after recovery photos of their patients without any valid consent on social media to attract a vast audience. In the scenario provided, Dr. Smith, the chief cardiac surgeon, wants to use Facebook to boost the cardiology practice’s profile and Twitter to announce the positive results of the surgeon. Still, he is mindful of being HIPAA compliant on social media. Direct conversations with patients on social media platforms such as the Facebook comments section my inadvertently expose a patient’s health information if a health care provider asks the Facebook user to share his or her information. When patients perceive their privacy shall be violated, the therapeutic relationship between the health care providers and the patients is damaged. As a result, patients may become hesitant to disclose their medical information to the health care providers for fear that the information they give will end up on social media. Eventually, poor health outcomes are realized, leading to the consequent dissatisfaction in the patients.

Recommendations for Proceeding within Legal Parameters

Recommendations for proceeding with the use of social media with the legal parameters include offering training to the social media administrators and ensuring patients give their consent before posting their information. Educating staff who manage social media on HIPAA violations can prevent violations because of the training discusses procedures for protecting patient data electronically and describes the consequences of violating the HIPAA regulations. Thus, the employees can handle social media tools based on best practices because they would not want to face the consequences. Before posting any information about a patient on social media, a health care organization can ensure that it first obtains consent form the patient. The patients should give their consent in writing, and they should do it willingly without being forced by anybody to do so. Once the patient gives his or her permission, the health care organization should only use the PHI for the purpose mentioned explicitly in the consent form. With such, training and obtaining consent can ensure HIPPAA compliance with the use of social media.