Social Media Policies: Setting Clear Expectations

Love it or hate it, social media is a fact of life. It can be a great means for medical practices to raise awareness, educate, and engage patients.

However, it's also easy to find stories about social media gone wrong in healthcare. Many of these involve HIPAA violations by staff who don't understand the inherent lack of privacy in social media posts. ProPublica, an investigative news organization, recently reported on more than 30 incidents where staff inappropriately shared images and other patient information over social media networks.

In light of the horror stories, there is a temptation for practices to construct a "defensive" policy focused solely on restricting staff use of social media; essentially "What you don't say can't hurt us." Instead, you should seek a balance that not only protects patient privacy and discourages public relations gaffes, but also allows those who know your practice best - its staff - to show pride in their work and promote it. Designing a good social media policy for your practice can tip that balance to the positive.

Here are some ways to help you get there:

1. Keep it simple. Staff will view a policy that is too long and tries to cover everything negatively - if it's read at all. Further, because social media is constantly evolving, too much specificity will virtually guarantee your policy will quickly become obsolete.

2. Be clear about your goals. To provide context for your social media policy, put the focus on what you are trying to accomplish. These goals may be things such as maintaining patient confidentiality, compliance with applicable laws and regulations, protecting the practice from negative outcomes, enhancing the practice's professional image, and ensuring a productive and focused workplace.

3. Don't reinvent the wheel. There are many easily adaptable, great policies available online. You can find many examples here and can even view policies by professional sector, including healthcare of course.

4. Get beyond the "thou shalt not." See the positive as well as the negative. Don't be so afraid of the worst-case disaster that you stop staff from telling your practice's story. The average adult Facebook user has about 300 friends, meaning that even in a small practice you could easily reach thousands of people with a positive message. Imagine someone saying, "I'd love to tell my Facebook friends about the money we raised at the local charity event, but our social media policy won't allow us to post on work-related topics."

5. Don't just dictate, educate. Beyond the policy itself, staff may need help in thinking through how this all works "in real life." Again, there already are some great resources to give you a running start on this. One example is "A Nurse's Guide to the Use of Social Media." You can offer real examples and scenarios that help your staff understand the repercussions on using social media to represent your practice.

6. Listen and respond to feedback. This allows you to not only hear concerns staff may have, but also get a sense whether they understand your social media policy. Initial staff reaction to a social media policy may not be warm and fuzzy. Most staff will easily understand rules on using practice equipment and network connections for personal use during the workday. However, you may get pushback on "restrictions" outside of work time. Point out that HIPAA violations hurt patients - and they can have negative legal consequences for not only the practice, but also the individual staff member. Be upfront and explain that your policy covers both staff social media activity at work and off the clock. Respond to any concerns by communicating the practice's expectations of staff professionalism, both on and off the clock.

7. Back it up. Enforcement and sanctions may be unpleasant, but they are an absolute necessity. Having a policy but not enforcing it may be worse than no policy at all, since this sends staff the message that you're not serious. It also can create liability for the practice if you have a policy in place and make no effort to ensure that it is followed. Your medical practice's sanctions for policy violations - especially those involving HIPAA - should be documented and consistently applied to all staff.

If you are successful, your social media policy and staff education efforts will offer bright-line guidance prohibiting illegal or unethical activity, while also encouraging staff to share their successes at your practice. That is a win-win for patients, the practice, and staff.

Stephen McCallister, CPHIT, is a health IT consultant with over 20 years' experience managing technology for healthcare organizations. As chief information officer, he planned and implemented IT systems for multiple practice mergers and served as HIPAA Security Officer.  He can be reached at steve.mccallister@frontier.com.