Julie was a Registered Nurse in a skilled nursing facility. One day, the facility was having a holiday celebration and Julie took a picture of some of her patients enjoying the festivities and posted it to Facebook. One of Julie’s Facebook friends recognized one of the patients and called the patient’s son to find out what was wrong with his mother. The son was surprised that anyone knew his mother was in the facility, because his mother had expressly asked to not let anyone know.

Social media has opened up a whole new set of issues for organizations tasked with caring for and protecting the privacy of older Americans. While most people understand the rules against taking and/or posting photos of residents/patients that show them in embarrassing or demeaning situations, new rules are cracking down on any dissemination of photos without express written consent. In the situation described above, Julie violated HIPAA (Health Insurance and Portability Accountability Act) regulations by posting a photo of a patient. Anything that can identify a patient (name, image, birthdate, etc.) must remain private and is off limits for social media. The Office for Civil Rights is responsible for enforcing HIPAA’s privacy and security rules and has increased both enforcement and penalties for violations (in the form of fines) over the last several years, making it incumbent on any organization that cares for seniors to ensure their employees are aware of HIPAA’s rules and regulations, particularly as they relate to social media.

Establish a social media policy within your organization
If you don’t already have one, the first step is to create a social media policy. Make sure all employees understand the importance of and need for maintaining patient and resident privacy. The following rules are just a sample of what may be part of your policy.

  • Never post anything from the organization’s account (unless you are part of the team assigned with that role).
  • No taking photos of patients or residents unless these is express written consent and you are a person authorized by your organization to do so.
  • Avoid “friending” patients or family members.
  • No sharing of any patient or resident information (including, but not limited to, name, diagnosis, prognosis, medications, or medical condition) even if the patient/resident posted the information on their own social media page.
  • No referring to patients/residents in a disparaging manner, even if they are not identified.

Some things you will want to avoid including in your policy (because they are illegal):

  • Forbidding sharing information or opinions critical of the organization or management
  • Forbidding employees from “friending” each other
  • Forbidding employees from discussing conditions of employment/working environment

Finally, make the policy as short and easy to understand as possible. Involve staff members in creating or updating the policy. This will increase “buy in” down the road. Don’t ban access completely, as this will create dissatisfaction and will be widely ignored.

How to keep an active, vibrant social media program
With senior care companies under such scrutiny, you may be wondering how to keep your social media program relevant and interesting without being able to use resident or patient photos. Social events are popular on social media and without being able to show the people for whom the event is for, how does one share these events with the public? You may:

  • Use a photo of a resident/patient in a social setting as long as you have written permission to do so and don’t reveal anything about their medical condition, health status or treatment.
  • Use photos of staff and the decorations or food that were part of the event.
  • Include photos of the entertainers who performed at the event.
  • Include photos of family members from whom you’ve received written permission.
  • Post notices of your events online before they happen, using any artwork created for the event, including use of stock photography.

By following these guidelines, you can still have a dynamic and interesting social media presence while protecting both your organization and the privacy of the residents and patients you serve. If you would like assistance if starting a social media program, please contact us.