Privacy in a Social Media World

One patient at MacArthur OB/GYN had a question about moving her ovulation. Others spoke freely about their experiences with an endometrial ablation procedure. Most just wanted to say “thanks” to the physicians and show off pictures of their newborns.

These medical questions and concerns - as well as helpful information on women’s health - are all online at the practice’s Facebook page.

“We are taking this giant world we live in, and we are turning it into this small town where people are interacting,” says Jeff Livingston, one of five OB/GYNs and one nurse practitioner at MacArthur OB/GYN in Irving, Texas.

MacArthur OB/GYN’s online community of about 600 people (and counting) provides a forum for questions and information shared between physicians and patients. Livingston monitors it daily, and encourages the discussions by posting links and questions.

Livingston is among a growing number of physicians joining social media networks as a way to share information with patients or connect with their colleagues. In fact, 60 percent of physicians reported using or being interested in using online communities, according to an early 2009 survey by Manhattan Research. And all signs point to this number continuing to rise.

But as the status updating, Tweeting, and blogging increases, questions about appropriate online content and patient privacy arise. Should a physician “friend” a patient online? Will patients put your practice at risk and raise privacy red flags by posting their personal health information on the public forum? What if the doc shares too much? Are you exposing your practice to a lawsuit risk by engaging online?

For Livingston and others, online networks have become a necessary venue for connecting - and many physicians are embracing so-called Web 2.0 without ill effects. With a few guidelines and a lot of common sense, social media can be a boon for your practice and your patients.

Where your patients are

If you’ve been reluctant to hop onto the social media bandwagon, it might be time to consider it. Patients are increasingly turning to the Internet for healthcare information. A recent Pew Research Center study found that 60 percent of adults look online for health information. Plus, 35 percent of adults used social media for health and medical purposes last year, Manhattan Research found.

If this is where patients are turning for health and provider information, perhaps it’s where you should be as well, to best educate them and reach new ones?

Livingston first realized his audience was online more than five years ago when he was conducting outreach education to teens about STDs and pregnancy prevention. He noticed his 15-year-old daughter interacting with her friends on the networking site MySpace, and as he put it, “A light bulb went off. Here I am trying to connect with young people in my community and I am not talking to them in the way they actually talk.”

His daughter helped him build his MySpace page, and he has since expanded to Facebook and Twitter, where he manages the messages for his practice. Now, the practice’s Facebook page is a thriving forum where Livingston shares relevant and credible healthcare information and his patients post photos and discussions.

But before signing up for an account, ask yourself why you’re entering the social media realm. Jim Tobin, president of Ignite Social Media, which worked with the Massachusetts Medical Society to promote their organization, says physicians should ask the question: What’s the point of it all?

And there can be several answers that garner benefits for your practice. Engaging online through social media can allow physicians to show - not just tell - that they are the experts. Your Web site might say you’re the best-trained or the most knowledgeable endocrinologist, but how about demonstrating that by offering helpful information and resources?

Social networks also can boost your search-engine rankings, notes Tobin, who is also the author of “Social Media Is a Cocktail Party.” Posts on Facebook and blogs, for example, are indexed and searched by Google and other engines, so fresh content will appear high on the list when a patient searches for a physician online.

Social media can be one tool of many to boost marketing and customer service, but businesses and organizations must first understand what they are getting into, Tobin says. “If you are completely booked up and you have met all your goals, maybe you don’t need to do this,” Tobin says. “But if there is an issue that needs to be solved, whatever the objectives are, [you should] set aside the plan to accomplish those.”

Same rules apply

Much discussion has revolved around what information should be shared and how to protect privacy online. But many experts say the same rules apply online as they do in real life.

“We make a big deal out of this, but it’s no different than anything else,” says Joel Diamond, a family physician in Pittsburgh who uses social media and blogs about health IT interoperability. “The technology offers other areas to get trapped with privacy, but it doesn’t add new privacy concerns. The basic issue is always what it has been.”

So even though you’re sitting behind a computer screen and engaging other people using Internet handles and avatars, you should treat it the same as, say, a cocktail party. What private information would you withhold there? Regardless of the setting, physicians should be cognizant of what information they are sharing, says Bruce Armon, a partner at Saul Ewing LLP in Philadelphia.

The only difference is that at a cocktail party, presumably you only have a small audience. “When it’s an online forum, you have a much larger and unknown audience that may be relying on the advice or the guidance the physician is providing,” Armon says.

Tobin puts it this way: “Picture the same behavior you would do in public, and picture it with a megaphone to your mouth and someone recording it forever.” That’s about right. Deleting something doesn’t necessarily mean it will be completely erased, so physicians must recognize the responsibility and liability of their online actions.

Of course, HIPAA is pretty clear - medical information is private and can only be released by the patient or by authorization of the patient. There’s no exception for social networks, so before you tweet, consider the privacy rules you know so well from the real world.

Look before leaping

Before logging on to a Twitter account, consider a few gems of advice from the experts:

Not all sites are the same. Social media has become a blanket phrase to refer to sites for connecting and sharing online. But physicians must understand that Facebook is different from Sermo is different from Twitter when it comes to audience and content. “What’s different is the detail of information or the depth of medical information shared,” said Jason Bhan, a family physician and cofounder of Ozmosis, a physicians-only network. At Ozmosis, cases are presented in the same way they would be in a hospital program setting, ensuring there is no identifying patient information divulged even though great clinical detail is shared. The physician-only forum makes that appropriate, Bhan says, adding that “a blog would be the wrong place.” A blog, for example, has a very different - and more public - audience than the doc-only sites like Sermo and Ozmosis, which provide a forum for physicians to share clinical and professional issues. Those conversations shouldn’t be shared with your patients or the general public. For the more public interactions, such as sharing health information and resources, look to sites like Facebook.

Consider boundaries when building an online presence. Armon suggests that physicians who have a personal profile online limit the connections to those outside of their professional life, and vice versa. If the page is for your practice, remember to keep it strictly business and make sure it fairly represents your practice, he says.

But what happens when a patient requests to be your personal friend on Facebook? Here, the expert opinions diverge. “I don’t do it,” says Bhan, adding that it’s probably not terrible, but could open you up to dealing with sensitive information should a patient contact you online.

David Harlow, founder of healthcare law and consulting firm The Harlow Group and author of a popular healthcare and law blog HealthBlawg, also advises against it. He says physicians on Facebook should connect with patients through the practice’s page, of which patient’s can become “fans,” rather than through individual profiles.

That’s how Livingston connects with his patients. For the most part, patients understand that they should connect with him through the fan page for MacArthur OB/GYN. “Very few are asking to be my friend personally,” he says. “Patients are smart people, and they understand how it works and for the most part they are respectful of the boundaries.” What about those few? Sure, “friend” them, he says. Thanks to privacy controls and account settings, Livingston can choose how much of his personal information he cares to share - or keep private - with his patients. He has a group of his friends tagged “patients,” where he can limit the information. “I can use the technology Facebook has in place,” he says.

Take it offline (or to a secure messaging system). There will likely be times, however, when a patient does cross the line and post a personal question or clinical details. But that’s not reason to halt social media operations, says Harlow.

“You don’t need to shut down in response to inappropriate information,” he says, adding that there are ways of responding. If a patient posts personal health information on your Facebook fan page, for example, don’t respond directly to that person’s post, Harlow warns. For example, a patient could post, “I’m cancer free for one year! Thanks, doc!” Be careful not to respond, “Great news that Mrs. Jones is breast cancer free for an entire year!” Even though your patient posted first (and the comment seems innocuous), your response could land you in hot water.

Instead, opt for a far less personal response. Consider writing something generic, such as, “Thanks for sharing. Check out our updated Web site here.” The other option is to send the patient a private message, Harlow says.

Whatever you do, don’t offer any medical advice online, Armon says. Sure, these forums are ideal for addressing a health topic broadly, but if it gets too personal, suggest your patient make an appointment.

That’s what Livingston did when a patient posted a discussion about moving her ovulation time to better plan a pregnancy. MacArthur OB/GYN’s response - visible to all of the practice’s Facebook fans - was general for the benefit of other patients, but also recommended a visit: “There are some ways with birth control pills for a patient to change when they ovulate. Since this is kind of a personal topic schedule to come in and you and your doctor can discuss the options. Anyone considering pregnancy should also be taking a prenatal vitamin ahead of time to get the folic acid into your system. This can prevent certain birth defects.”

Livingston’s practice recognized the demand for online communications with his patients - and the need to implement the “next step,” he says. “If you are going to be out there, you are teaching your patients to be online and be engaged, so you have to have a system in place to allow them to do that.” That system? A patient portal, a secure way to communicate that ensures patient privacy but allows them to access their information and send questions to their physicians. “You can imagine the efficiency has gone up, and patient satisfaction has gone up,” he says.

Be ready to respond. Whether with comments about personal medical information, praise for your practice, or even negative feedback, social media platforms open you up for communication - and you have to be ready to respond. Diamond once received a comment on his blog from a patient who had lost touch with him and wanted to schedule an appointment. Not a big deal, Diamond says, just a little awkward. And Diamond recognizes that a patient’s post could have also been something negative, rather than just an appointment request. “I think this is a brave new world we are in,” Diamond says. “I think we just have to confront that reality.”

You could always take down the negative post on your blog or Facebook page, but that seems to defeat the purpose of social media, right? “The whole attraction of Web 2.0 is the transparency and responsiveness,” says Harlow, who advises against deleting the negative messages. Instead, be ready with a response, and know in advance how you plan to confront such interactions.

Harlow says it’s a good idea to have clear policies and procedures in place that address this issue, which of course requires you to first determine why you’re getting into social media in the first place. These policies should be posted on your fan page or Web site, and reviewed at least annually to keep pace with the dynamic nature of the Web, he says. This will be particularly helpful if you have staff posting on behalf of your practice. You might also consider having someone tasked with monitoring the pages, deleting or responding to inappropriate posts.

Think before you post. The final point might seem obvious, but warrants a reminder. The Internet makes it almost too easy to type away and hit send before reviewing what you’ve written. But don’t make that mistake.

“Consider everything on the Internet permanent,” says Bhan. “There is no erase button or delete button. Anything you put out there - it’s out there and permanent.”

Several years ago, when Twitter and blogs were just catching on, there was a small wave of inappropriate postings by healthcare professionals, Bhan says.

There’s also no such thing as anonymity online. Remember the case of Dr. Flea? In 2007, a Boston-area pediatrician using that pseudonym had been blogging about his malpractice trial. He was exposed on the witness stand, and the case was settled.

Similarly, sharing too much about a patient online for the sake of venting about a case or attracting readers with juicy details can land you in hot water. You risk losing patients, or worse, facing a lawsuit.

But for the most part, physicians who are engaging online understand the platforms and the rules of engagement, Bhan says. Plus, healthcare professionals have been trained extensively on privacy protections. (And the same rules apply, remember?)

The permanence of online communiqué can be troublesome for physicians who naturally want to be helpful and engaged, but who might not take the time to double-check what they are sharing, says Armon. Although most tend to err on the side of caution, remember not to share any information that could come back to haunt you. What may seem harmless to you could be taken the wrong way by someone else, he says. “The risk is sometimes all of us type quicker than our mind can think and we might not be as accurate as we like,” he says. “Once a physician hits the send button the message can take on a life of its own.”

Sara Michael is a senior editor at Physicians Practice. She can be reached at sara.michael@cmpmedica.com.

This article originally appeared in the July/August 2010 issue of Physicians Practice.