What Are We Doing? An Interview on Forming Social Media Policy with Paul Anderson

By Griffin Jones

This is the eighth interview in a series that explores the implications of patient privacy and the effective use of digital media. This piece centers on the importance of forming a social media policy. Paul Anderson is director of risk management publications at ECRI Institute.

Paul A. Anderson

Jones: You don’t tell practices that they have to be on social media, but what do they need to consider?

Anderson: Your patients, colleagues, and even your competitors are using social media. You want to know what patients are saying. If it’s positive, you want to thank them and share that. If it’s negative, you want to be aware of what they’ve said. If you’re not participating in social media, you’re missing part of your constituency. If you’re not using it, they’re going to sail right past you. You’re not in the space where people are talking.

There is often worry from physicians about participating in that space where people are talking. What about the risk? What about privacy?

Providers have a lot of misconceptions and fears about HIPAA. And of course, there is cause for concern. You don’t want to identify a patient in any way without their authorization. It is much better to get patients to tell their own stories, because patients can tell their own story to whomever they want. Practices should consult someone who is experienced with HIPAA compliance. I also recommend thoroughly educating someone in the practice on compliance issues, and having that person in charge of advising the social media policy. That person can be the word of caution and help the practice be smart about what they are doing. The first thing an agency will look for when investigating a privacy complaint is to see if there was a policy in place. The second thing they’ll look for is, “did we teach anyone about it?”

Many fertility centers participate in social media, but have yet to put a policy in place. Where do they start?

They first have to identify their goals. “Are we just going to monitor or are we going to engage people? Who’s going to approve content? Who’s going to post? What is our voice? Is it formal and academic? Or informal and casual?” Depending on the size of the practice, an individual or a committee should be placed in charge of initiating and enforcing the policy. Someone needs to be in charge of posting, because if a practice has a social media account, but never posts anything, that doesn’t look very good. I’m in favor of being active by posting and promoting content. You only do that when you have a well-defined reason for doing that and goals to employ.

How should practices respond to negative reviews?

One first has to be aware of the risks. If the review is too hostile to address productively, it’s perfectly reasonable to just leave it alone. If it’s negative commentary, take that conversation offline. There’s a lot of high emotions. You don’t want to inflame the situation.  Your response may be as simple as, “We hear your concern. We value your feedback. We’d like to talk to you. Here’s our phone number.” You can get a sense pretty quickly if the situation is resolvable. If it’s not, you have to disengage and try to balance that with positive reviews.

How about responding to positive reviews?

It’s never bad to say thank you, or when someone’s said “thank you” to say “you’re welcome.” Keep it simple. You don’t want to say too much but you’ve got to engage. Social media is a marketing tool that isn’t one-way.

Who is a healthcare provider with an exemplary social media policy?

The folks at the Mayo Clinic really have one of the best social media presences in all of healthcare. They have a center for social media and educational boot camps and social media trainings for employees. They’re very active on social, you can follow them almost everywhere. Their policy and their practices in place are really great resources.

But how does a small fertility practice implement a good social media policy?

Whoever’s going to spearhead this initiative better know how to use social media. Familiarity with the platforms and their nuances is necessary in order to be able to use them to effectively communicate. Define why you are going to use social media, first. If you can articulate that clearly, that will drive the rest of your conversation.

Paul Anderson is the director of risk management publications at ECRI Institute, an independent, non-profit, research institute that works with all sizes of healthcare providers from single practitioners to large research hospitals. They help practices with risk, quality, and patient safety management. You can learn more about ECRI Institute and their services here

Start With The Law: An Interview on HIPAA and Social Media with Paul Hales

By Griffin Jones

Paul Hales

This is the fourth interview in a series exploring the implications of the Health Insurance Portability and Accountability Act (HIPAA) as it relates to digital media.

Paul Hales is an attorney from St. Louis, who specializes entirely in HIPAA law. Mr. Hales’ comments do not contain legal advice, but they do educate us about some of the risks that face fertility centers with respect to HIPAA and social media. Mr. Hales gives us some background on the Act.

Hales: We have to start with the law. My focus is on enabling practitioners to make use of social media and comply with the law. HIPAA was passed in 1996 with two objectives;

1. To be able to keep insurance when switching from one provider to another.

2. To have a uniform code for information and payment

It has had further additions since.

• The privacy regulations were added in 2003.

• The HIPAA security rule was added in 2005

• HITECH was passed in 2009.

• In 2013, the Omnibus rule was added to HIPAA to extend liability to “business associates”.

What is a business associate?

A “business associate” is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.

What are common areas in which covered entities and businesses associates fail to meet HIPAA compliance?

• Protected Health Information (PHI) is made up of 18 identifiers, including but not limited to name, e-mail address, full face photos, and date of birth.

• Under HIPAA, every health care practice or organization must designate a privacy officer. The privacy officer must perform a risk-analysis.

• Health plans and covered health care providers are required to develop and distribute a notice that provides a clear explanation of privacy rights and practices with respect to patients’ personal health information.

What about when a patient posts their own information on a blog, social media channel, or place page operated by the practice?

It’s important to look at how HIPAA defines a website, which is any site that provides information about a covered entity’s services or benefits. Therefore, if a patient posts their own information to a site that’s owned by the practice, that is unauthorized PHI on the practice’s site. The practice has to obtain HIPAA authorization before allowing any patient content to be published to its sites.

What is necessary in a HIPAA authorization?

HIPAA Authorizations have six core elements:

1. A specific and meaningful description of the information to be used or disclosed.

2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

3. The name or other specific identification of the persons(s), or class of persons, to whom the covered entity may make the requested use or disclosure (i.e., the intended recipients).

4. Description of each purpose of the requested use or disclosure.

5. Must contain an expiration date or an expiration event.

6. The signature of the individual and the date.

A HIPAA authorization must also include three statements.

1. Individual’s right to revoke the Authorization.

2. Clarification that the covered entity is not permitted to condition the provision of treatment on the execution of a valid Authorization.

3. Explanation that there is a potential that the information may be re-disclosed by the recipient of the information and that the recipient may not be required to comply with the Privacy Rule.

What should fertility practices be conscious of right now to minimize risk of HIPAA violations?

Recently, there has been more enforcement, and soon there will be audits. On February 16, 2016 the Office of Civil Rights (OCR) settled an enforcement action against Complete P.T., Pool & Land Physical Therapy, Inc. for impermissibly disclosing patient information in the form of testimonials on their website. HIPAA is a very extensive law. There is a lot of information on the internet that is simply wrong. HIPAA regulations are very demanding and products cannot ensure compliance. No product can be HIPAA compliant. It’s how a covered entity uses a product that makes it compliant or not.

Paul Hales is an attorney who provides legal services and consultation regarding HIPAA compliance. His software, the HIPAA e-tool helps covered entities and business associates with a complete HIPAA compliance solution. If you’re interested in an educational webinar with Mr. Hales, you can register here.

Every Fertility Center Needs a HIPAA Compliant Social Media Strategy: An interview with Mike Bossenbroek

By Griffin Jones

This was the first interview that I did in a series exploring the Health Insurance Portability and Accountability Act (HIPAA) and its implications regarding digital media. I originally recorded this interview in August of 2015,  before the Fertility Bridge blog was active in its current form. Per usual, my video intro is corny, and very crudely edited, but the content is very valuable because practices should educate themselves about HIPAA considerations in social media as much as they can.

Michael Bossenbroek practices healthcare law in Michigan. Of course, Mr. Bossenbroek's comments are NOT legal advice, but they give us important information to consider about how fertility centers should approach social media and patient engagement. In this interview, we address

• What are some things that a HIPAA compliant social media policy should include?

• Where should a fertility practice's social media policy be visible?

• What else should fertility practices consider when deciding their activity on social media?

Michael Bossenbroek is a partner at Wachler & Associates, P.C.  in Royal Oaks Michgian. Mr. Bossenbroek practices in all areas of health care law, including representing clients in matters relating to HIPAA compliance. If you'd like to learn more about HIPAA compliance from Mike, you can contact him here.