HIPAA Compliance for Medical Practices
82.6K views | +0 today
HIPAA Compliance for Medical Practices
HIPAA Compliance and HIPAA Risk management Articles, Tips and Updates for Medical Practices and Physicians
Your new post is loading...
Your new post is loading...

HIPAA and Social Media: Avoiding Costly Mistakes | Eyemaginations

HIPAA and Social Media: Avoiding Costly Mistakes | Eyemaginations | HIPAA Compliance for Medical Practices | Scoop.it

A nurse inspired by a young chemotherapy patient’s courage posts a photo on her personal Facebook page, being careful not to use the patient’s name. A practice manager posts a photo of an office party on Instagram; a stack of patient files is in the background. A nurse writes an angry blog post about an alleged cop-killer who is being treated at the hospital where she works, but does not name the patient, victim, or her employer. What do all of these scenarios have in common? They are all examples of HIPAA violations that led to a healthcare professional being reprimanded, fined, or fired.

You may think your practice is up to date on patient privacy, but changes in HIPAA policies, healthcare information technology, and the explosion of social media have changed the game. “Despite widespread awareness of the need to store and send sensitive patient data securely, physicians and practices run afoul of HIPAA rules on a regular basis, which opens the door to both civil and criminal penalties,” reports Medical Economics. The maximum HIPAA fines have increased to a whopping $50,000 per violation.

Here’s what you need to know about HIPAA and protecting your patients and your practice in this age of social media and oversharing.

Decoding ‘patient identifiers’

Because there are new social media platforms emerging all the time, it can be daunting to figure out what’s OK to post and what’s not. First, you and your employees need to understand what is considered a HIPAA violation on social networks. Most healthcare professionals know to avoid impermissible use or disclosure that compromises the security or privacy of a patient’s protected health information (PHI). The confusion arises in defining what PHI is and is not.

HIPAA specifies 18 identifiers beyond a patient’s name that must be kept private. One of those is “full face photographic images and any comparable images,” which is where the nurse mentioned in the Facebook example above ran afoul of HIPAA. This even includes recognizable patient photos or files in the background of photos, such as in the office party example above. You’re not even in the clear if you’re simply reposting or “regramming” photos of a patient sharing all the details of their medical issues on their own social media accounts. If the patient can be identified, don’t do it.

It’s also important to consider things that might be “patient identifiers” besides a person’s name or face. In one case, a nurse posted a comment on a small-town newspaper’s blog that mentioned a patient’s age and mobility aids, which were enough to figure out whom she was discussing.  “In small communities especially, people can quickly determine who is in the hospital and for what with just a few details. Innocent comments about a patient lead to identification,” notes Kyna Veatch on the legal website Law360.com.  

This also goes for celebrities and high-profile people. In the case of the nurse mentioned above who angrily shared her views about a patient online, news coverage about the murder case made it clear whom she was talking about. Another common example of HIPAA violations is when staffers cannot contain their excitement about treating a pro athlete or well-known TV personality and “overshare” on social media. “Posting verbal ‘gossip’ about a patient to unauthorized individuals, even if the name is not disclosed” can get medical practices into hot water with HIPAA, warns the company Healthcare Compliance Pros (HCP).

HIPAA do’s and don’ts

Let’s look at some best practices related to HIPAA and social media:

Do keep your and your employees’ personal social media accounts separate from the practice accounts. “Some ophthalmologists choose to create personal pages with pseudonyms that only their friends and family know,” notes Veatch. “This keeps patients from searching for them and sending friend requests.” Avoid “friending” patients on personal or practice accounts, and advise your employees to do the same.

Don’t make the mistake of thinking that posts are private or disappear once they have been deleted.Search engines and screenshots can make even deleted posts permanent. As a general rule, don’t post anything you wouldn’t be comfortable sharing in public. “If there is any doubt at all about a certain post, picture, or comment then check with your compliance officer or even a colleague before publishing,” advises HCP.

Do speak up when patients are asking for medical advice online. Crowdsourcing your medical care on social media is never a good idea, but people do it all the time. Doctors can offer advice as long as it’s general and not specific to one patient. Sharing a patient education video on a particular health topic or condition can be one way to do it. “Speaking to patients as a collective on social media should steer providers away from any privacy risks,” per physician and social media expert Kevin Pho of KevinMD.com. If an unknown patient reaches out and asks a personal health question on social media, “take that conversation offline with a standard response that asks the patient to call the office and make an appointment, or if an emergency, to call 911 or go to the emergency department,” he advises.

Don’t overlook staff training. Educating your staff and having a solid social media policy in place is imperative to HIPAA compliance, according to Healthcare IT News. Your policy should define social media, mention specific sites, and describe what information employees are allowed to post online and what is off-limits, on both the practice pages and their personal pages. As Healthcare IT News states, “When employees post on social media, not only do they represent themselves, they represent the employer, the office, and all healthcare professionals.”





Technical Dr. Inc.'s insight:

Contact Details :
inquiry@technicaldr.com or 877-910-0004

No comment yet.

Data Breach Cost Of $5.6 Billion Predicted For Healthcare In 2015

Data Breach Cost Of $5.6 Billion Predicted For Healthcare In 2015 | HIPAA Compliance for Medical Practices | Scoop.it

Experian has released its 2015 Second Annual Data Breach Industry Forecast, a report that provides insight into the changing state of healthcare data security as the industry faces a new year. Reports like this one will be of increasing interest to your clients, as organizational leaders begin to realize the impact that data security and breaches have on their overall organizational health. The report states: “Board members and the C-suite can no longer ignore the drastic impact a data breach has on company reputation. Meanwhile, consumers are demanding more communication and remedies from businesses after a data breach occurs. As a result, the topic is one of the highest priorities facing businesses and regulators in 2015.”

The Threat To Healthcare

Healthcare, as an industry, is opening its doors to more attacks, just as information is becoming more valuable on the criminal circuit. The advent of EHRs (electronic health records) and increase in use of wearable technology has meant amazing new uses of data in regard to health, but it’s also meant more access points for cybercriminals.

The report indicates that it fully expects breaches to increase in 2015, and that many organizations (doctors’ offices, hospitals, and clinics) simply may not have enough resources to properly protect PHI (protected health information) — and they know it. According to a survey by the Ponemon institute, 72 percent of healthcare organizations indicated they are only “somewhat confident” or “not confident” in the security and privacy of patient data that travels via HIE. It’s expected that the cost of breaches next year could reach $5.6 billion.

Experian recommends that healthcare organizations “step up their security posture and data breach preparedness,” or face the risk of not only breaches, but increased attention and scrutiny from federal regulators who are beginning to turn an eye the costly danger of an unprotected healthcare system.

Medical Identity Theft

The report makes a special call-out to the dangers of medical identity theft on page seven. Experian is working with organizations like the Medical Identity Fraud Alliance (MIFA) to start making headway in addressing this issue.

Ann Patterson, senior vice president of the alliance, weighs in: “Medical identity theft is a serious threat that needs to be prioritized by healthcare organizations, regulatory groups and consumers. There is no single solution for fraud prevention, meaning we must take a collaborative approach to solving the issue. Industry and government must work together to develop holistic strategies pertinent to the fight against fraud, and consumers should take an active role in advocating for system-wide reform.”

No comment yet.