A story was posted on social media about a local woman who was trapped on a cruise ship due to the Covid-19 situation. Her health was somewhat fragile and she was running out of medications that were desperately needed due to a chronic heart condition. The story received a great deal of attention, due in part, to the fact the woman is the mother of a prominent local pastor. The comments on the post ranged from supportive and compassionate to skeptical that the Covid-19 situation was really “that big a deal”. One comment read “Yeah and the sky is falling fools!” which is, at best, unfortunate, but what happened next is where things got interesting. In response to the comment the woman’s cardiologist, a very good cardiologist I might add, commented “Right/that’s my pt./bad ticker/if she gets it forget it.”
I am sure his comment was well intentioned, or maybe even an expression of his frustration that people were not taking the Covid-19 situation seriously, but the fact of the matter is his comment is a clear violation of HIPAA. He identified himself as her physician and shared specific information about her health condition; clearly an impermissible disclosure of protected health information.
Every provider will agree social media is a dangerous black hole when it comes to the potential for HIPAA violations because of staff posting photos of clients online, but often forgotten is the fact a simple comment on someone else’s post, even if that comment is intended to defend the provider or clarify mis-information, can lead to a reportable breach of protected health information.
The perils of social media should be a part of every provider’s annual training program. As the number of social media platforms continue to grow, it is more important than ever to have a well written, easy to understand, social media policy that is updated on a regular basis. As is shown by the situation described above, staff at all levels of the organization must be trained and must consider how HIPAA applies to their actions on social media.