Social media is ubiquitous in contemporary American culture. Given that fact, the question that this article addresses is what utility, if any, social media has for your medical practice? And, if potentially useful, how can social media be used without causing unintended legal consequences?
Physicians live in a litigious and highly regulated professional environment. For that reason, any decision to use social media must be made against the backdrop of both state and federal law. This includes privacy laws, consumer laws, fraud and abuse laws, and other legal realities that arise from using or receiving social media. Some of those statutory and regulatory provisions are dealt with briefly in this article.
The Health Insurance Portability and Accountability Act regulates patient privacy in numerous ways, many beyond the scope of this article. At the top of the list, however, is securing Protected Health Information, or PHI. Thus, in deciding whether or not to use social media in your practice, it is mandatory to be familiar with what PHI is, what the protections are, how these protections can be breached, and the potential consequences if there is a breach.
Should a patient authorize his or her identity or PHI to be used in social media that will not constitute a privacy breach. Moreover, the HIPAA privacy rule also describes those circumstances under which a covered entity (i.e. physician, medical group, hospital, etc.) is permitted to use or disclose PHI without the patient’s express authorization. Each of those permitted disclosures involves detailed requirements that must be met prior to that disclosure. Although authorized, those disclosure requirements must be carefully adhered to but, in any event, will not allow disclosure for social media purposes. See 45 C.F.R. 164.512.
If PHI is “de-identified”, however, there are no restrictions on its use or disclosure. Stated differently, de-identified health information is not PHI and does not require any authorization for its use or disclosure. De-identifying health information is not always a simple process, however, and requires careful attention to detail. And even if the lengthy list of more objective criteria can be satisfied, the last requirement to de-identify PHI requires that any unique identifying number, characteristic or code must be removed. What does this mean? For example, what is a “unique identifying… characteristic”? The answer, of course, is that it depends on the patient’s individual circumstances.
It is this last removal requirement that can make the de-identifying process truly precarious. Thus, if de-identified PHI is to be used, the process of disclosure must be undertaken carefully, and perhaps with the assistance of a knowledgeable health law attorney.
Florida has not enacted an analog to HIPAA. Therefore, if a physician utilizes social media to market his or her practice, complying with HIPAA should assure compliance with Florida law. It is worth noting that while Florida does not have a HIPAA analog, Florida Statutes 456.057, Ownership and Control of Patient Records, Reports or Copies of Records to Be Furnished; Disclosure of Information, does have a rigorous privacy component regarding a patient’s records and makes it clear that “the medical condition of a patient may not be discussed with any person other than the patient, the patient’s legal representative, or other healthcare practitioners and providers involved in the patient’s care or treatment, except upon written authorization from the patient.” This prohibition, on its face, is extremely broad and again militates in favor of a great degree of caution when designing a social media strategy.
False & Misleading Advertising
Using social media to market your medical practice can also lead to accusations of false and misleading advertising. As an example, facial plastic surgeons often use testimonials in their internet marketing efforts or other social media tools such as blogs, social network sites or video sites. Legally, there is nothing wrong with this informational technique as long as it is done properly. The Federal Trade Commission has issued its “Guides Concerning the Use of Endorsements and Testimonials in Advertising”, 16 C.F.R. 255. These Guides address the application of Section 5 of the Federal Trade Commission Act (15 U.S.C. 45), in the use of endorsements and testimonials in advertising.
The Guides provide both definitional information as well as instructional considerations for the use of endorsements and testimonials. For example, “Endorsements” must reflect the honest opinions, bindings, beliefs or experience of the endorser.” Although that statement seems elementary, the Guides provide examples of endorsements that to some may seem acceptable but which, in fact, could actually violate the Act. Thus, if you are going to use endorsements or testimonials in your social media marketing efforts, it would be prudent to review these Guides before doing so. By understanding the Guides and applying them to your social media efforts any doubts about the propriety of your use of endorsements or testimonials can be addressed and easily resolved.
Trial lawyers use social media too, as does the government, primarily for the purpose of obtaining information about a witness or the adverse party, often a defendant physician in a medical malpractice case. So what you say about yourself in the public portions of your social media account may be used against you at a regulatory proceeding or in a malpractice action. The extent of these kinds of pre-suit investigative techniques and the extent of subsequent pretrial discovery is beyond the scope of this article. Nevertheless, the message should be clear: anything you say in the public portions of your social media is potential evidence in a subsequent legal proceeding.
Some marketing companies may claim that their marketing services, including social media, have been approved by “legal counsel.” Don’t let that fool you. Instead, demand a copy of the legal opinion that the marketer is touting. Often, it never comes. But if it does, before you do anything, have it reviewed by a knowledgeable health law attorney first.
Because of the regulatory and litigation risks, the decision to use social media in your medical practice is a simple risk-reward analysis. The question is whether the rewards are worth the risks. The answer to that question depends on any number of variables, all of which must be determined on a physician by physician basis, often with the assistance of a health law attorney. But, if the decision is to use social media, it is the author’s view that if there is any doubt as to its content, it should be left out; the reward is probably not worth the risk.