Tuesday, September 15, 2009

In Consideration of HIPAA Laws and Social Networking Risks.

You've heard about them... chances are, statistically, you're a member of one or more and you might even be somewhat addicted to them... I'm referring, of course, to social networking websites (Facebook, Myspace, Twitter, LinkedIn, among an increasing number of new sites daily).

I read a statistic today that two weeks ago Facebook reported to news sources that its user base almost matches the population of the United States (article here). And in July, a report stated that on Facebook, "there has been a staggering increase in the number of age 55+ users – with total growth of 513.7% in in the last six month alone."

Social networking offers people a way to connect with classmates, friends and family far and near, as well as business contacts. Sometimes, however, conflicts can emerge if users are not careful. Many social networking services, such as Facebook, provide the user with a choice of who can view their profile. This prevents unauthorized user(s) from accessing their information.

This brings me to an issue for discussion here today. What about Health Insurance Portability and Accountability Act (HIPAA) laws? Take a hypothetical... a hospital employee posts a fairly innocent comment on the "wall" of one of his network sites about a rather difficult case/work problem or patient scenario. A reader takes personal offense and feels the post exposed too much information about the work situation. Because we are in the healthcare business, we are held to HIPAA privacy laws and must be careful that in social networking that no specifics of a case are mentioned, such as patient names. Even so, for a medical professional to post ordinary work frustrations may be exposure and subject the writing to interpretation by others.

Are hospitals and healthcare companies providing guidance to employees about their online activities (such as not refer to work situations on a public board)? Are policies being instituted on social networking, such as a Social Media Best Practices Policy to sheild the ugly side of internet communications? I welcome discussion from other companies and facilities as to what their current policies are.

On HIPAA... I came across an internet site which specializes in interpreting some of the law for laypersons in the healthcare industry. HIPAA.com describes itself as this:

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for electronic health care transactions. The great thing about HIPAA is that it reflects a move away from cumbersome paper records and an increased emphasis on the security and privacy of health data. But the magnitude of the complex changes it requires can sometimes be overwhelming for healthcare providers, compliance officers and other affected professionals. We’re here to help you meet the challenge and stay current with extensive documentation, helpful resources and expert commentary.

There are good things that come from social networking. A 2007 peer reviewed journal article on social networking in the medical field stated that, "Social networks are beginning to be adopted by healthcare professionals as a means to manage institutional knowledge, disseminate peer to peer knowledge and to highlight individual physicians and institutions. The advantage of using a dedicated medical social networking site is that all the members are screened against the state licensing board list of practitioners."

While all that is well and good, that doesn't mean problems won't happen.

Today I advised my employees with the following words to ponder, "As a yardstick, consider that whatever you put on the internet today might appear on the front page of tomorrow's New York Times."

What do you think? Have you run into any issues with social networking and privacy concerns?

Ralph E. Jordan
President & CEO
Trident Health Resources, Inc.

No comments: