How A Social Media Policy Can Protect Your Practice

An increasing number of rheumatologists are venturing onto the Internet and, specifically, social media sites. Practice consultants increasingly recommend updating websites, creating a Facebook page, and joining Twitter. Consultants, however, seldom mention that there are legal concerns associated with the Internet and social media for healthcare providers. While social media can be a beneficial marketing tool, it is important for rheumatologists to address the proper ways to use this outreach both inside and outside the workplace through a specific media policy.

Does Your Practice Have a Website?

More than half of medical practices in the United States with fewer than five physicians do not have websites. A website is an excellent and relatively inexpensive way to brand a medical practice.

When potential patients are looking for a physician in a particular specialty and in a specific location, many first turn to Internet search engines. Whether a potential patient is searching for terms such as “rheumatologist and Dallas,” or “Dr. Jack Smith, rheumatology, and Dallas,” you want your website to pop up and be viewed by the searcher. At a minimum, a practice website should include the four W’s:

Who (biographical information about the physicians employed by the practice);

What (the practice’s specialty);

Why (this is your opportunity to shine—tell potential patients why they should select your practice); and

Where (contact information).

Remember, however, that you are legally responsible for the content of your website.

Websites are a form of advertising and are subject to restrictions imposed by federal and state law.

Do You Tweet, Blog, or Surf Facebook?

The terms “Facebook,” “Twitter,” and “blog” are words no longer just spoken by teenagers. The healthcare community—including hospitals, medical practices, and practice staff members—is using Facebook, tweeting, and blogging at an increasing rate. These social media outlets are inexpensive ways for healthcare entities and physicians to disseminate information and market to a broad audience.

In addition to the concerns described above, physicians should be aware of the Health Insurance Portability and Accountability Act (HIPAA) privacy laws when engaging in social media. Even an inadvertent disclosure of a patient’s protected health information through a social media outlet can be problematic. A Rhode Island physician recently had her hospital privileges revoked and was reprimanded by her state’s medical board for writing about her clinical experiences on Facebook. Even though the physician had no intention of revealing confidential patient information, one of her Facebook posts revealed just enough detail to allow others in the community to identify a specific patient.

Patients also use social media to express their views on positive and negative experiences with a physician. Some of my physician clients have expressed concern that patient blogging and user-review websites are among the first listings on search engine result pages. If the posts are about positive experiences with the physician, then the physician just obtained free publicity. However, if the posts are negative, this can be very disheartening for the physician and could keep a potential patient from becoming an actual patient. There is little, if anything, a physician can do to curtail or stop negative blogging other than to provide the best patient experience possible. While some physicians may think responding to the negative post on the blog is the solution, it is not recommended because the physician could unintentionally disclose information that he or she is not permitted to disclose.

Social Media Policy

In light of the risks associated with social media, it is important that practices establish a social media policy for the physicians and staff members. There are two general types of social media policies: a policy that addresses what is acceptable use (if any) of personal social media during office hours and a policy that addresses how social media can be used on behalf of the practice. (Editor’s Note: This article will focus on the use of social media on behalf of the practice; the use of personal social media will be addressed in a future “Legal Matters” article.)

For social media use on behalf of the practice, it is imperative that the following three W’s are outlined in the social media policy:

1. Who is permitted to post or tweet material on the social media websites? Is there a designated poster or “tweeter” for the practice? Remember that, while staff can be trained to monitor and post content, it is the physician who is ultimately responsible for the practice’s online material, and it is his or her licensure that is put at risk if inappropriate material is posted.
2. What material can and should be posted by the party or parties authorized to do so? The social media policy should address appropriate responses to postings on the practice’s social media site. For example, the policy needs to identify how to respond when someone, whether a patient or otherwise, posts a medical question on the practice’s Facebook page. From a liability perspective, providing medical advice via social media outlets should be avoided. Even posting general information about diseases could be misconstrued as creating a patient–physician relationship and should be avoided.
3. Where will the practice be posting? The policy should explicitly state which social media avenues the practice can use and maintain. For example, if the practice decides to have a Facebook page but not a Twitter account, this needs to be conveyed in the policy.

Additionally, the policy should inform employees of the risks associated with disclosing patient and other practice-related information on social media networks (whether being used personally or on behalf of the practice) and ways to avoid unlawful disclosures. One way to do so is to require a committee approve material posted on behalf of the practice, rather than at the discretion of a single person. This will help avoid HIPAA violations and inappropriate disclosures. The committee could also preapprove language for common responses, such as office hours, types of insurance accepted, or how to contact the practice to make an appointment, and train staff on when to use these responses. Further, the policy should explain the consequences of noncompliance by your employees and emphasize personal responsibility and good judgment.

Now is the time to review your practice’s existing policies and documents. A social media policy can be incorporated into your existing employee handbook, or you may elect to have a freestanding policy.

If you haven’t already been bitten by the social media bug, this is the time to jump on the bandwagon. Your competitors are probably already riding the wave. However, be cautious of your social media involvement and establish a social media policy so to avoid inadvertently and unintentionally violating the law.

Steven M. Harris, Esq., is a nationally recognized healthcare attorney and a member of the law firm McDonald Hopkins, LLC. Steve may be reached at [email protected].