Of Healthcare Organizations - Advisen...Organizations attempting to manage their social media exposures find that social network ing tends to be far more freewheeling and informal,

October 2011

Sponsored by:

Of Healthcare OrganizationsSOCIAL MEDIA RISKS

2 Social Media Whitepaper | Advisen Ltd. Sponsored by:

W H I T E P A P E R | October 2011

Social media sites such as Facebook, Twitter, YouTube and LinkedIn have become integral

parts of both society and the business world. According to a recent study, social media sites

account for 22.5 percent of the time that Americans spend online1. Facebook is the lead-

ing social media site for U.S. users, accounting for 53.5 billion minutes on

home and work computers.2 As healthcare organizations (HCOs) utilize these

online tools to increase visibility, encourage communications with patients and

market products and services, significant business and reputational exposures

must be considered. Social media can be an effective tool for delivering an

organization’s message, but the use of social media by HCOs must be tightly

controlled to avoid monetary and reputational penalties.

HCOs also must take steps to limit potential damage from social media activi-

ties that are largely outside their immediate control. In particular, HCOs are vulnerable to

damage resulting from employees’ personal social media activities both during and outside

working hours. Even if the HCO is not responsible for an employee’s activities, careless or

malicious postings can damage a HCO’s valued reputation.

The Social Media Revolution

Social networking sites have become the conduits for sharing of information throughout the

world. Although a relatively new industry, the statistics are impressive:

• Approximately 8 percent of the world’s population is on Facebook.3

• Approximately 42.3 percent of the entire American population uses Facebook.4

• About 9 percent of the adult U.S. internet population had used Twitter as of the

end of 2010.5

Even if the HCO is

not responsible for an

employee’s activities,

careless or malicious

postings can damage

a HCO’s valued

reputation.

Of Healthcare OrganizationsSOCIAL MEDIA RISKS


of healthcare organizationsW H I T E P A P E R | October 2011

social media risks

• Over 200 million people currently access Facebook through their mobile devices.6 More

than 3.5 billion pieces of content (web links, news stories, blog posts) are shared each

week on Facebook7.

• 155 million tweets are published every day8.

• LinkedIn has more than 100 million users worldwide9.

• Approximately four hours of video is uploaded to YouTube every minute and there are

more than 2 billion video views on YouTube every day10.

Social media is a fast and inexpensive way for HCOs to communicate with patients and em-

ployees. Many top HCOs prominently use social media for communication. The Mayo Clinic,

for example, has over 120,000 followers on Twitter and the organization tweets about HCO

news, answers patient questions and provides link(s) to relevant articles.

For HCOs and healthcare practitioners embarking on the use of social media, the rewards

may be plentiful. However, the exposure arising out of the use of social media must be man-

aged to avoid unintended negative consequences.

Why Should HCOs Use Social Media?

Recent studies show that 34 percent of consumers use social media to search for health

information.12 According to CNN, 94 percent of people searching for healthcare information

on social media use Facebook as their primary source for this type of information. YouTube

was used by 32 percent of respondents and 18 percent accessed MySpace and Twitter for

health information.

U.S. HCOs use social media as a marketing tool to increase their visibility and provide infor-

mation to their patients. According to market research firm YouGov Healthcare, more than

half of patients surveyed would pick a hospital based on its social media presence, while 81

percent see hospitals visible in social media as more cutting edge.13

Communicating via social media does not require sophisticated computer skills. It is quick,

inexpensive and allows a HCO to respond to breaking news or provide information about an

important event such as a drug recall. Social media gives HCOs the ability to communicate

with patients and business contacts in almost real time. Currently approximately 500 hospi-

U.S. HCOs use

social media as a

marketing tool to

increase their vis-

ibility and provide

information to their

patients.



social media risks

tals use YouTube, Facebook, Twitter and blogging sites for physician education and collabo-

ration.14 Other common uses of social media include marketing and patient and employee

communication.

The Risks

Social media is a practical tool for HCOs to use for a variety of purposes, but it comes with

risks. For example, as with traditional media, once an item is placed in a social media outlet,

it becomes very difficult, if not impossible to retract, and unlike traditional media, a post or

tweet can find its way to millions of people in a very short time.

Organizations attempting to manage their social media exposures find that social network-

ing tends to be far more freewheeling and informal, with fewer checks and balances, than

traditional media outlets. The opportunities for error are great and there is very little time to

correct a mistake.

Social media risks for HCOs span a diverse array of exposures. Like any other organiza-

tion using social media, HCOs are exposed to defamation, intellectual property violations

and employment-related issues. HCOs are especially susceptible to damaged reputations,

and they need to take care that the organization’s reputation is not harmed by careless or

inappropriate postings. Professional liability, including medical malpractice, is a potential

exposure for HCOs or individual healthcare practitioners who provide medical information or

offer medical advice through social media channels. Of the various types of organizations

exposed to social media liability, HCOs face heightened exposure to privacy-related liabilities

because they must comply with stringent requirements of the Health Insurance Portability

and Accountability Act (HIPAA).

Violation of HIPAA and other privacy laws

Because social media is so accessible, people are sometimes too lenient with the informa-

tion they share online. HCOs, in particular, face increased scrutiny for the handling of private

information, such as patient information.

HIPAA is the principal federal regulation concerning the privacy of medical information,

and sets forth requirements for the safeguarding of this information. HIPAA allows doctors

Social media risks for

HCOs span a diverse

array of exposures.

Like any other orga-

nization using social

media, HCOs are ex-

posed to defamation,

intellectual property

violations and employ-

ment-related issues.



social media risks

and HCOs to disclose the personal health information when necessary for patient care and

other limited circumstances. However, if information is improperly disclosed, HCOs and their

employees can be subject to significant civil and even criminal penalties. Depending on the

frequency of the improper transmission of individually identifiable health information, and

the intent of the transmitter (negligent or knowing), under HIPAA, HCOs can be subject to

a maximum annual fine of $1.5 million, and the individuals who inappropriately transmitted

the data can face up to ten years in prison. In one case, an employee of a Hawaii hospital

illegally accessed a patient’s medical records, and then posted the patient’s name and con-

fidential medical details on her MySpace page. This HIPAA violation resulted in a one year

prison sentence.15

While it is almost second nature for medical facilities and doctors to provide their patients

with the notifications required by HIPAA in the office setting, and to be rigorous about

maintaining privacy safeguards, this may not be at the forefront when using social media.

Even though social media seemingly is less regulated, information posted online can open

an individual or his or her employer to liability depending on the information posted. HCOs

must implement clear guidelines to employees to prevent the unintentional and unauthorized

disclosure of patient information.

Not only should names of patients not be used in social media communications, great care

should be taken to avoid identification of the patient, even without the patient’s name being

used. An example of this occurred last year, when an emergency room doctor at a Rhode

Island hospital had her privileges revoked and was reprimanded by the state medical board

after posting information about a trauma patient on Facebook. The name of the patient was

not included, but the doctor had included enough information that the patient was easily

identifiable by the community. While the hospital, at the time of the incident did not have

a social media policy, the doctor nonetheless faced severe consequences for posting the

information.

Another recent example of the risks associated with posting patient information on line, even

without the patient’s name being revealed, recently occurred in Long Beach, California-based

St. Mary Medical Center. In this case, a 60 year old man was brought to the hospital with

stab wounds so severe his head was almost decapitated. Before treating the man, emergency

room staff took photos which they posted on their personal Facebook pages. Some employees

were fired, and others were disciplined for their involvement in the event. Not only is this ex-

ample a violation of the patient’s privacy rights, it also spotlighted the unprofessional activity

of the staff and as a result led to bad publicity for the hospital.

HIPAA is the princi-

pal federal regulation

concerning the privacy

of medical informa-

tion, and sets forth

requirements for the

safeguarding of this

information.



social media risks

Reputation risk

The St. Mary Medical Center incident is just one example of a threat to a HCO’s reputation

from social media. With employees, patients and visitors wandering HCOs with smart phones

equipped with cameras and video recorders, potentially embarrassing or even highly damag-

ing images can be recorded and disseminated via social media. Inappropriate tweets and

Facebook postings by healthcare professionals can undermine not only their own reputations,

but also those of the organizations they work for.

Social media provides an easy way for unhappy customers to communicate their displeasure

with an HCO, perhaps even on the organization’s own social media site. While it may be

unappealing to provide a forum for potentially negative publicity, allowing the open display

of comments on its social media site gives the HCO an opportunity to respond in a positive

manner that is seen by the community. If the criticism is unfounded, it can be cleared up.

But if the criticism is warranted, dealing with it in a constructive way may even enhance the

HCO’s reputation.

Providing medical advice on line

Technology has resulted in people wanting almost immediate answers to their questions.

Health information is one of the top searched topics on the internet. According to a recent

study, 80 percent of Americans research health information online16. The survey results

found that people seeking health information ranks third in online activity, trailing only email

and using a search engine. 17

HCOs and their workers may feel it is useful or commercially necessary to communicate more

regularly with patients through social media. However, they should do so in a way that is not

seen as dispensing specific medical advice, which could lead to violations of HIPAA and

state laws regarding doctor licensing. Even through social media, a doctor cannot provide

medical advice to a patient in a state where he is not licensed. To do so may put the practi-

tioner’s license at risk. Dispensing medical advice online also has the potential to lead to a

medical malpractice suit.

Crossing boundaries

Social media is a great way for a HCO’s professionals to communicate news and practice

information to their patients. But the interactions in social media should not be so informal

as to breach doctor/patient boundaries. “Friending” patients on Facebook, for example, runs

the risk of inadvertently establishing inappropriate physician-patient relationships.

If the criticism is un-

founded, it can be

cleared up. But if the

criticism is warranted,

dealing with it in a

constructive way may

even enhance the

HCO’s reputation.



social media risks

Practitioners need to be especially cautious about posting information accessible to patients

that could give patients a false sense of familiarity or could undermine confidence in the

practitioner’s judgment. In one case, pictures taken at a party and posted to Facebook led to

questions about the clinical judgment of a physician. In extreme cases, information posted

online could bolster malpractice accusations.

The American Medical Association (AMA) has issued guidelines for doctors to use in social

media to maintain a positive online experience and preserving the integrity of the doctor/

patient relationship. The AMA guidelines address the following issues:18

» Patient privacy. Physicians must avoid posting any information that could identify a pa-

tient, including anonymous or de-identified information or material acquired while provid-

ing patient care.

» Safeguarding personal information. Physicians should take advantage of privacy settings on

social networking sites to safeguard personal information. Additionally, physicians should

ensure that the personal and professional information on their own sites and content

posted about them by others, is both accurate and appropriate

» Boundaries. Any interactions with patients on the Internet must be done as to maintain

appropriate boundaries of the patient-physician relationship.

» Separating personal and professional identities. To maintain appropriate professional bound-

aries, the AMA suggests that physicians keep personal and professional online identities

separate. Even within the personal sphere, however, physicians should always be cogni-

zant that their reputations among patients and colleagues can be affected by their online

actions and the content they post.

A practitioner should proceed with caution even when he posts information for which the

patient has given permission. The balance of power in the doctor/patient relationship lies

with the doctor. The doctor must be careful not to violate the patient’s trust. The doctor must

be aware of the possibility that the patient may give consent to online posts out of a sense

of obligation to the physician.

The blurring of the line between a physician’s professional identity and private life represents

an additional area of risk. Privacy, no matter what precautions are taken, cannot be guaran-

teed and therefore a physician should take this into account when considering what to post

on his personal social media sites. A good rule is that any information a practitioner or HCO

would not want their patient to know should not appear in social media in any forum.

A practitioner should

proceed with caution

even when he posts

information for which

the patient has given

permission.



social media risks

Employee-related exposures

HCOs are justifiably concerned about statements made by employees in their own social

media activities. Many HCOs have social media policies that prohibit certain types of com-

ments about the organization, its services and other employees, as well as the disclosure of

sensitive patient information. Recent cases have shown, however, that organizations some-

times go too far in attempting to control employees’ communications and may violate state

or federal labor laws.

In the first social media case to attract the attention of the National Labor Relations Board

(NLRB), a Connecticut-based ambulance company, American Medical Response of Con-

necticut, allegedly fired an employee in violation of federal labor law for criticizing her boss

on Facebook. The criticism clearly violated the company’s written social media policy. How-

ever, according to the NLRB, because federal labor law allows employees to openly discuss

working conditions, wages and other work-related topics, and since she made the Facebook

comments on her own computer and during her personal time, the employee’s words consti-

tuted protected speech. American Medical Response of Connecticut settled the suit in April

for an undisclosed amount and agreed to revise its social media policy.

Risk management

HCOs using social media as a tool to communicate with patients and the community at

large should promulgate unambiguous guidelines relating social media use. These include:

» Create a clear employee social media policy. Policies will vary among organizations

depending on the organization’s mission, business objectives, comfort with social media

and risk tolerance, but all policies should address the following:

- The use of social media at work;

- Which employees are authorized to represent the organization through social

media;

- Prohibitions on disclosing patient information;

- Standards of professional conduct in social media, including policies concerning

healthcare professionals “friending” patients;

- The use of social media for professional networking purposes; and

- Limitations on work-related content in an employee’s private social media activi-

ties (keeping in mind that some work related postings may be protected by labor

laws).

Areas involved with

social media, or which

should be providing

input into social media

policies, include market-

ing, human resources,

public relations, patient

relations, risk manage-

ment and the general

counsel’s office.



social media risks

» Provide training to the employees designated to represent the organization through

social media channels.

» All employees must be educated about HIPAA, and clearly understand that no informa-

tion about patients ever is to be shared.

» Employees writing about healthcare matters, unless specifically on behalf of the HCO,

should be instructed to note that they do not speak for the HCO.

» For posts that provide medical information, use a disclaimer that indicate the post is for

informational purposes only and should not be interpreted as medical advice.

» Identify the types of information that require legal review before being released.

» Incorporate social media into an enterprise risk management framework. Social media

can touch many parts of an organization and can result in financial, reputational and

regulatory risks. Areas involved with social media, or which should be providing input

into social media policies, include marketing, human resources, public relations, pa-

tient relations, risk management and the general counsel’s office. With enterprise risk

management (ERM) frameworks in place, organizations may be able to more easily ac-

commodate the multidisciplinary, cross-departmental requirements of managing social

media exposures.

Insurance

Despite an HCO’s best efforts to manage their social media exposure, lawsuits can happen.

Insurance coverage is essential.

Coverage for some social media exposures may be available under traditional Commercial

General Liability policies, but this coverage is most likely limited. Similarly, online profes-

sional liability exposures, including medical malpractice, may not be covered by traditional

policies. In recent years, the insurance industry has responded to social media and other

online exposures by introducing specialized cyber liability policies. In addition to coverage

for some social media activities, cyber liability policies cover other risks associated with do-

ing business digitally such as data security. Social media-related exposures typically covered

by a cyber liability policy include defamation, trade libel, and invasion of privacy, copyright

infringement, plagiarism, and infringement of title, slogan, trademark, trade name, trade

dress, service mark or service name. Some policies specifically address the social media and

data security exposures of physicians and HCOs.



social media risks

Cyber liability policies provide broad coverage, but they usually do not address the full range

of social media exposures. Insurance buyers should work with their brokers to assure their

directors & officers liability (D&O) policies and employment practices liability insurance

(EPLI) policies will respond to social media claims brought by, as applicable, shareholders,

competitors, regulators and employees. Professionals offering advice through blogs and other

social media channels should assure they have appropriate malpractice and errors & omis-

sions insurance.

Conclusion

Social media is an effective method of communication for HCOs and its employees. However,

social media is fluid and quickly evolving. Risks associated with its use will continue to arise.

HCOs should not be paralyzed by concern over these risks, but they do need to be proactive

in minimizing their potential impact. A well-conceived and regularly updated risk manage-

ment program combined with insurance coverages tailored to social media exposures should

give HCO executives the peace of mind to confidently make use of social media to help fulfill

their business and social missions. n

NOTES/REFERENCES:

1. “State of the Media: The Social Media

Report”

2. State of the Media: The Social Media

Report

3. Friends without Facebook, Daily Texan,

June 20, 2011

4. eMarketer, February, 2011

5. eMarketer, February, 2011

6. Facebook, December 8, 2010

7. Econsultancy, March 25, 2011

8. Forbes Magazine, September 1, 2011



11. deluxesmallbizblog.com, March 15,

2011

12. How America Searches: Health & Well-

ness by iCrossing and Opinion Research

Corporation

13. Cited in “Why hospital social media is a

full time job,” FierceHealthcare

14. HCOs IT News, September 7, 2011

15. Security for social networking PriceWa-

terhouseCoopers, p. 5

16. Pew Internet Project and California

HCOs Foundation

17. Pew Internet Project and California

HCOs Foundation

18. A MA Policy: Professionalism in the

Use of Social Media

Documents

Of Healthcare Organizations - Advisen...Organizations attempting to manage their social media exposures find that social network ing tends to be far more freewheeling and informal,