Understanding HIPAA Requirements for Social Media and Protecting Patient Privacy Online

In today’s digital age, social media has become an integral part of our daily lives. However, for healthcare organizations and providers, navigating the world of social media can be complicated. HIPAA does not explicitly say anything in regard to social media.  The standards were created before social media platforms existed.  However, social media is subject to the Privacy Rule.

With HIPAA social media violations on the rise, healthcare entities must take all precautions to ensure compliance. The following are requirements for protecting patient privacy when using social media platforms online:

1. Patient Consent: HIPAA requires written consent from patients before any protected health information (PHI) can be shared on social media platforms. This includes any identifiable information such as names, photos, or medical records. However, once something is posted on social media, you have no control over what happens to it.
2. De-identification of PHI: Healthcare entities must de-identify any PHI shared on social media. De-identification involves removing or altering any information that could potentially identify a patient.  All 18 identifiers must be removed from the information.  A few examples include names, addresses, social security numbers, and other unique identifiers. 
3. Secure Communication Channels: When communicating with patients on social media, healthcare entities must use secure channels and avoid public comments or direct messages exposing sensitive information. Instead, encourage patients to use secure messaging platforms or patient portals for private discussions. 
4. Monitoring and Auditing: To ensure HIPAA compliance, healthcare entities should implement robust monitoring and auditing systems for social media. This involves regularly reviewing social media posts, comments, and interactions to identify any potential breaches of patient privacy.
5. Training and Education: Comprehensive training and education should be provided to all employees regarding social media usage. This includes educating staff on the potential risks, proper handling of PHI, and the consequences of non-compliance. All members of the workforce should be included in training relating to social media, whether they have access to ePHI or not. 

As healthcare organizations and providers continue to embrace social media for engaging with patients and sharing valuable educational information, it is crucial to understand the possible risks. 

For more information:

For questions regarding HIPAA social media requirements or HIPAA training, contact the experts at MedSafe for a free consultation. MedSafe is the nation’s leading one-stop resource for outsourced regulatory compliance solutions in healthcare.

Toll-free: (888) MED-SAFE