Ask the Experts, Assisted Living, News, Skilled Nursing Facility

Ask the expert: Creating a policy for social media and HIPAA compliance

In 2016, Health Insurance Portability and Accountability Act (HIPAA) enforcements and settlements hit a record high—and HIPAA’s vigilance isn’t expected to change under the new administration. Industry expert Reginald M. Hislop III, PhD, from H2 Consulting answers important questions for providers regarding HIPAA compliance and a highly talked about and talked on force: Social media.

Q: What should an effective policy that addresses staff posting work-related content on their personal social media accounts include?

A: A good policy will not ban or discourage the use of social media but instead, frame the appropriate use for the employee. This means making employees aware that work-related information on social media should conform as follows:

  • Not violate any applicable laws, particularly with regard to HIPAA/privacy
  • Not violate company policy such as harassment, discrimination, etc.
  • Not share or disclose company information that is not otherwise publicly available
  • May not use company logos, etc. without permission and may not imbed links to company websites, etc. on personal social media accounts
  • Emphasize decorum regardless of the topic and mandate that any language that can be viewed as hostile to the company, its staff, its vendors, etc. can and will be dealt with in the context of applicable law
  • Licensed personnel need to be extra careful as their applicable licensing authority (Board of Nursing, etc.) may view their public actions as a violation of a license code or standard and take applicable action as permitted, against the licensee

Q: How can facilities’ policies integrate rules about posting on the facility’s social media sites?

A: Most organizations do not allow staff to directly post content on their sites. They may allow staff to respond to content posts. The same rules apply with regard to staff conduct on “any” social media outlet/site (theirs, company, other).

Q: How should providers communicate this policy to staff?

A: Communication needs to occur consistently and continually, including:

  • On hire as part of orientation (oral and in writing)
  • Annually as part of inservice education
  • Periodically; various situations present throughout the course of a year where re-education is warranted
  • Post policies and poster-style information at time clocks, break areas, etc.

Q: How can providers avoid diminishing employees’ rights with the implementation of a policy for social media use?

A: This area is evolving rapidly. Various cases including at the National Labor Relations Board (NLRB) level (under the National Labor Relations Act) have created tremendous ambiguity for employers regarding policy on this matter.

A recent article posted by the popular job-board site Monster stated that “According to the National Labor Relations Board (NLRB), employers’ attempts to control or limit what employees post on social media websites and their personal accounts often violate the employees’ rights to engage in “protected” activity under the National Labor Relations Act.”

Similarly, current culture has defined the acceptance and applicability of social media as a news and communication foreground. What this means is that both good and bad coexist in this realm for companies and the line between good and bad is exceptionally fine. Companies need to be resourceful and educational and stick to the bright-line limits that are permissible under law—namely, no harassment, intimidation, violation of privacy, disclosure of protected information, etc., and leave the rest to discussion and dialogue with staff.