News From Our Perspective

Navigate the Healthcare System with Ease

Aug 2016

Dealing with HIPAA Violations in the Age of Social Media

1970s TV doctor “Marcus Welby, M.D.” never had to deal with the issue of social media in the modern workplace. However, with the HIPAA laws of the 21st century, it is becoming a growing concern in the healthcare world.

Federal regulators this month directed state inspectors to step up efforts to protect elderly nursing home residents from being degraded on social media by facility staff members. This directive was prompted by a rise in disturbing posts from nursing homes and hospitals in recent years.

The Centers for Medicare and Medicaid Services (CMS) recently asked state officials to make sure nursing facilities have policies in place to prevent the staff from posting embarrassing and dehumanizing photos and videos of elderly residents on social media sites such as Twitter, Facebook and Snapchat.

For many families, a cry for more punitive measures from CMS is growing. Patient advocates want the federal agency to clearly outline penalties for the growing number of nursing home employees who are abusing patients in this public way via technology.

The most recent case to capture national attention was a Wisconsin nurse who shared a video on Snapchat. The video showed a fellow employee kicking an elderly man’s wheelchair while the patient sat in it. The patient tried to kick back while multiple employees laughed.

In a notice posted earlier this month, CMS said it expects state health officials to make sure their regions have policies that prohibit nursing home staff from taking or using photos or recordings in any manner that would demean or humiliate. The facility must implement corrective actions to prevent recurrence, such as staffing changes, increased supervision and follow-up counseling for the residents.

CMS stated that nursing home employees must report cases of abuse to “at least one law enforcement agency,” and that anyone who fails to report incidents is subject to “various penalties, including civil monetary penalties.”

Advocates say the document doesn’t go far enough.

So here are a few simple rules for nursing homes, hospitals and physician offices to make sure their staff fully understand:

1. Office staff should NEVER post images of patients.
2. Office staff should never contact a patient via a social media message.
3. If a patient messages the provider’s page/account concerning their healthcare, they should be kindly directed to contact the office via the phone or other secure means of messaging.
4. All office staff, physicians included, should be educated about the importance of respecting patient privacy.
5. Any social media posts about patients, even if they lack specific identifiers, can be deemed HIPAA violations.
6. Any postings about patients, with images of patients or insecure methods of contacting patients, can warrant an investigation of a HIPAA violation.
7. The best policy is that office staff and physicians should NOT post anything at all about patients, whether it is unidentifiable or not.

Last year, ProPublica reported there have been 35 cases since 2012 in which nursing home staffers have used social media to share photos or videos of residents. Some showed residents who were partly or completely naked. These are just the ones that are known.

Not only are such postings a violation of HIPAA; some states states have even charged offenders with elder abuse, voyeurism and invasion of privacy. Also, because many of these hospitals and nursing homes allow visitors, it would be prudent for the providers to post signage clearly stating what is allowed with respect to the use of smartphones while in the facility.

Our Partners Have a Combined Legal Experience of Over 100 Years

Meet our experts