Social Media Issues for Healthcare Employers Kim Daniel and Maria Greco Danaher AHLA Physicians and Hospitals Law Institutes February 2012

Transcription

1 Social Media Issues for Healthcare Employers Kim Daniel and Maria Greco Danaher AHLA Physicians and Hospitals Law Institutes February 2012 I. What is Social Media and How is it Being Used in the Industry? A. Social Media is: In general, social media means internet-based platforms allowing individuals to communicate, network and share information. B. Examples of Social Media: Facebook, MySpace,Twitter, LinkedIn, YouTube, Blogs, or Leaving Comments in News Stories C. Uses: 1. Personal use by employees on their own social media accounts or other personal postings a. According to a survey by Pew Research, two-thirds of online adults (66%) use social media platforms such as Facebook, Twitter, MySpace or LinkedIn Use by healthcare companies for marketing purposes a. More than 1,100 hospitals currently use a major social media outlet such as Facebook, YouTube, Twitter or LinkedIn 2 b. Through July 2011, about 660,000 people liked Children s Hospital Boston s Facebook page. The Hospital has more Facebook friends than any other hospital in the country. 3 c. Recent Pew Poll showed 66% of American adults look online for health information on a specific disease or medical problem. 4 d. Risks: employees (or former employees) posting negative comments about the organization on the organization s own Facebook page. Consider a monitored forum where postings must be reviewed before going live. 3. Use by healthcare companies during the recruiting or hiring process (looking at applicants Facebook pages or online posts). a. According to a Career Builder survey in 2009, 45% of employers use social media sites like Facebook, MySpace, Twitter, and LinkedIn to screen job applicants. 5 b. Ohio State University Medical Center is piloting LinkedIn as a recruiting tool. Useful in identifying highly-skilled recruits for specialized roles. People they want to hire are already 1

2 employed somewhere else. Instead of an ad, OSUMC creates a connection to find candidates and let them know of the opportunity. 6 D. Problems caused by Social Media: 1. Employees disparage the company, boss or coworker; 2. Employees post confidential or personal health information or photos concerning patients; 3. Employees contact coworkers with unwelcome personal messages. II. The National Labor Relations Board has been unfriending employers at an increasing rate (Maria Danaher) A. Section 7 of the National Labor Relations Act protects associational rights. 1. Section 7 of the National Labor Relations Act protects the right to engage in concerted activities for the purpose of collective bargaining or other mutual aid or protection USC Concerted activity is any activity by individual employees who are united in pursuit of a common goal. To find an employee s activity to be concerted, the action must be engaged in with or on the authority of other employees, and not solely by and on behalf of the employee himself. 3. Protected concerted activity is activity that is engaged in for employees mutual aid or protection or as efforts to improve working conditions and terms of employment is protected under the NLRA. Such activity can include circumstances in which individual employees act to initiate group action, as well as actions by individual employees bringing group complaints to the attention of management. B. Section 8 of the NLRA prohibits retaliation. 1. Section 8 (29 USC 158(a)(1)) provides that it is an unfair labor practice for an employer to interfere with, restrain, or coerce employees in their exercise of right protected by Section 7 of the Act. 2. An employer s retaliatory conduct against an employee because of that employee s protected concerted activity as defined above specifically violates Section 8 of the NLRA. 2

3 3. Remedies for unfair labor practices include reinstatement with full back pay plus interest. Employers also are required to post a notice to all employees detailing the violation and the remedy. C. Employers may violate the NLRA if: 1. The employer knows of the concerted nature of the activity; and 2. An adverse employment action (i.e., discipline or firing) taken by the employer is motivated by the employee s protected activity. D. The Facebook Cases have gotten employers attention. 1. In the past year, the NLRB has increased its focus on social media communications, specifically including Facebook and Twitter, focusing primarily on postings that include discussion regarding work-related conditions. 2. Such activity has been cited by the NLRB as protected concerted activity under Section One of the first cases highlighted by the NLRB on this issue involved an ambulance driver s comments on her Facebook page, for which she was fired. The NLRB filed an unfair labor practice charge that designated the postings as protected concerted activity. a. The case was settled; resolution included reinstatement of the employee and revision of the company s social media policy. (American Medical Response of Connecticut, Inc., NLRB Case No. 34-CA ) 4. In May 2011, the NLRB issued a complaint alleging that a Buffalo non-profit violated the NLRA when it fired five employees after they used Facebook to criticize working conditions. a. The five were reinstated after a hearing before an Administrative Law Judge. (Hispanics United, NLRB Div. of Judges, Case No. 3-CA ) 5. In July 2011, the firing of a car salesman was upheld, with admonition by an administrative judge that his Facebook postings were protected activity. a. The interesting twist in this case is that both the company and the employee agreed that the employee was not terminated for the postings deemed by the ALJ to have been 3

4 protected concerted activity. The firing was not a violation of the NLRA. (Knauz BMW, NLRB Div. of Judges, NY Div., Case No. 13-CA ) 6. A disgruntled employee/bartender s Facebook self-serving postings referenced his customers as rednecks, stating that he hoped they choke on glass. a. In that case, the Office of the General Counsel stated that there was no evidence of protected concerted activity because no co-workers were involved in the postings and therefore, no violation of the NLRA. (JT s Porch Saloon & Eatery Ltd., NLRB Div. of Advice, No. 13-CA-46689, 7/7/11.) 7. Employee of residential facility for homeless people with significant mental health issues was fired after engaging in a Facebook conversation with a non-employee/friend in which she made negative comments about the residents. a. The OGC pointed out that the employee was not seeking to induce or to prepare for group action related to her job conditions and that her actions were for personal amusement. Her firing was not in violation of the NLRA. (Martin House, NLRB Div. of Advice, No. 34-CA-12950, 7/19/11.) E. Actions that should be taken by knowledgeable employers. 1. NLRB has taken the position that employer policies cannot impose limitations on electronic communications if those postings include discussion related to the terms and conditions of employment. 2. Employers should take the opportunity to review their social media policies, and to train managers and supervisors to coordinate with their human resources departments any planned disciplinary actions based upon the use of electronic communications, especially if those communications involve personal postings. 3. The U.S. Chamber of Commerce has compiled information of NLRB charges related to social media going back to The full survey, which includes 117 charges, 7 complaints, and 5 settlement agreements, can be accessed at III. Tweet Nothings or Big Problems: Other (Non-NLRB) Cases and Legal Issues Involving Social Media (Kim Daniel) 4

5 A. Other types of claims: breach of patient confidentiality, discrimination, harassment, defamation, privacy issues B. 60% of medical and nursing students polled were found to have made unprofessional postings online that violate patient confidentiality, contain discriminatory language, or present inappropriate sexual references, as published in the Journal of American Medical Association. 7 C. Breach of patient confidentiality: HIPAA: health care providers must keep individually identifiable health information private and secure, except within specific limited circumstances where disclosure is allowed. Healthcare providers must maintain strict policies against employees posting information or photos about patients on social media. 1. Even de-identified information can violate patient confidentiality, especially in small communities or when the aggregate of the information can lead to identification. 2. Posting even de-identified patient information is not a good idea without consent. Many patients do not like the idea of photos or information about themselves (even de-identified) being posted in a public forum. D. Discrimination. Companies are likely to get information about an applicant they would not get in an interview from looking at an individual s social networking site. A job applicant s sexual orientation or religion, for example, may be readily apparent from photographs or from posts on the site. 1. Although this information may not enter into the company s hiring decision at all, it may become a problem down the road, particularly if the applicant is not hired. You have information that you would be better off not having, and you may have to prove that you did not rely on it in failing to make a job offer. E. Harassment. Harassment issues can arise when coworkers and supervisors are Facebook Friends. Although many employees would not give a personal address or home phone number to a coworker they do not know very well, they would not hesitate to become Facebook Friends, which can allow for private message conversations. 1. Harris v. North Park Clubhouse Lounge (EEOC Charge). Waitress Harris complained to Human Resources when a manager uttered a sexual slur against her. The tavern owner then posted threatening comments on her Facebook page that did not name the waitress, but were clearly directed at her. The waitress co-workers commented on the owner s post with statements like People like [the waitress] should burn in hell. Waitress filed a Charge with the 5

6 EEOC, claiming that the threatening Facebook posts were retaliation for her original compliant of harassment. 2. Yancy v. U.S. Airways, 2011 U.S. Dist. LEXIS (E.D. La. 2011). Customer service agent Yancy filed her first EEOC Charge for sexual harassment after customer service supervisor posted a photograph of her on his Facebook page. The photo showed Yancy hunched over her desk with her underwear visible. She appeared to be sleeping. Yancy complained that the photo showcased at least part of her buttocks and that she was crouched over the desk from the pain of yet-to-be-discovered gall bladder problems. U.S. Airways disciplined the supervisor, but did not discharge him. Dissatisfied that US Airways had not discharged the supervisor, Yancy filed an EEOC Charge. Yancy was later placed on suspension for sending a lewd text to a coworker, which she denied. Yancy filed a second EEOC Charge, alleging that she was suspended as retaliation for filing the first EEOC Charge. Yancy was then placed on furlough, and she filed a third EEOC Charge alleging that she was selected for furlough in retaliation for filing her first two charges with the EEOC. The district court granted Defendant s Motion for Summary Judgment on her claims of retaliation and intentional infliction of emotional distress. F. Defamation. 1. Low & Tritt v. The Pizza Kitchen (Tenn.). Knoxville marketing firm filed a $2 million libel lawsuit against a former client claiming comments posted on social media sites Facebook and Twitter have hurt its reputation. The marketing firm claims the restaurant and its owner defamed it in two Facebook entries that said, "Do not EVER use Lowandtritt mktg. firm!" and "CROOKS! - Stolen list, and have tried to pressure me by threat of lawsuit to sign a 'license agreement' to use their mktg materials." The following day on Twitter, the owner posted, "Lowentritt mktg firm has done it again..." and "Can you believe that they have not only stolen my list, but have now hacked Pizza Kitchen's facebook page taking it offline?" The posts were published to more than 300 Facebook friends of The Pizza Kitchen and 247 followers on Twitter, according to the suit. G. Privacy Issues 1. Employers can leave no question that employees have no reasonable expectation of privacy on company-owned computers and electronic devices by so stating in a clear company policy. 6

7 2. If Employer allows personal use of company computers and electronic devices and does not have such a policy, employees may be able to show that they have a reasonable expectation of privacy in their personal s, etc. sent and received on those devices. 3. For personal employee web pages on social network sites or otherwise the employee may have a privacy interest, if the employee has taken reasonable efforts to keep the information private. 4. If employee has a personal webpage that is accessible and open to internet users, the employee has not taken reasonable steps to keep such information private. 5. However, if an employee s personal webpage can only be accessed with a proper password, and he only provides the password to select friends and family, he has taken reasonable steps to keep such information private. 6. Stored Communications Act, 18 USC a. Prohibits third parties from accessing electronically stored communications (like ) without proper authorization. b. Intended to prevent hackers from accessing electronically stored communications. 7. Konop v. Hawaiian Airlines (9 th Cir. 2002). Employee, a pilot, alleged employer airline viewed his secured website in violation of SCA. Pilot maintained a website, in which he criticized the airline, the airline s officers and the union. Certain airline employees could access the site with a user name and password, but management was expressly excluded. VP of airline accessed the website with help of an eligible employee. 9 th Circuit held that if the eligible employee constituted a user of the website (meaning he could authorize a third party to access the website), then VP was authorized to access the website and could not be liable under the SCA. 8. Pietrylo v Hillstone Restaurant Group d/b/a Houston s (D.N.J. 2008). The employer viewed employees' internet discussion group critical of the employer by getting another employee's password. Employee felt that if she did not provide her password to employer, she would get in trouble. Employer discharged the employees based on content of the 7

8 discussion group. A jury found defendant employer violated the SCA and awarded the discharged employees compensatory and punitive damages. Jury found the employee's authorization was coerced, so the employer's access was unauthorized and its managers improperly accessed the site several times, despite knowing access was restricted. Punitive damages awarded because the jury found the employer acted maliciously in repeatedly accessing the employees' site via the other employee's password. Manager knew access was unauthorized. Employee was not told other managers would be given her password or that management would repeatedly access the site. H. iyogi Holding Pvt. Ltd. v. Secure Remote Support, 2011 U.S. Dist. LEXIS (N.D.Cal. 2011). Plaintiff iyogi and Defendant Secure Remote Support ( SRS ) both provide remote computer technical support services. Plaintiff alleged that Defendant s website contained a blog which contained false statements about iyogi s business. Defendant also operated a website that led consumers to believe it was operated by a neutral third party reviewer, on which Defendants falsely stated the iyogi had an F rating with the Better Business Bureau. Finally, Plaintiff alleged that Defendants published false, misleading and defamatory reviews, testimonials and comments regarding Plaintiff's services on other consumer websites (without disclosing the fact that the authors of these negative comments have a material connection with SRS, an iyogi competitor) with the intention of damaging Plaintiff's business reputation. The district court ruled for the Plaintiff on its claims of unlawful business practices and unfair competition (under Cal. Bus. Prof. Code et seq. and common law); false or misleading advertising, under Cal. Bus. Prof. Code et seq.; false advertising, under the Lanham Act 43(a)(1)(B), 15 U.S.C. 1125; and violation of the Anticybersquatting Consumer Protection Act, under 15 U.S.C. 1125(d). I. Eagle v. Morgan, et. al, 2011 U.S. Dist. LEXIS (E.D. Pa. 2011). Plaintiff founded a financial services company, Edcomm with two other individuals, and had an account on LinkedIn. She used her LinkedIn account to promote Edcomm s services and bolster her business reputation. In 2010, SISCOM purchased all of the outstanding shares of Edcomm. Initially, all three founders of Edcomm remained employed as Edcomm executives, but within a few months, they were involuntarily terminated. When Eagle tried to access her LinkedIn account later in the day, she could not. Eagle s former assistant, still employed by Edcomm, knew Eagle s LinkedIn password and changed Eagle s account profile so that it would display the new Chief Executive Officer s name and 8

9 photograph. As a result, individuals searching for Eagle on LinkedIn were routed to a page with the new CEO s photo, but with Eagle s honors, awards, recommendations and connections. Eagle eventually regained control of the LinkedIn account. Plaintiff initiated legal action against Defendants, alleging: (1) violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. 1030(a); (2) violation of the Lanham Act, 15 U.S.C. 1125(a)(1)(A); (3) unauthorized use of name in violation of 42 Pa.C.S. 8316; (4) invasion of privacy by misappropriation of identity; (5) misappropriation of publicity; (6) identity theft under 42 Pa.C.S. 8315; (7) conversion; (8) tortious interference with contract; (9) civil conspiracy; and (10) civil aiding and abetting. Defendants filed a counterclaim alleging that the LinkedIn account was maintained for the benefit of Edcomm and that Edcomm personnel developed and maintained all connections and much of the content on Eagle s LinkedIn account. Defendants contended that Plaintiff wrongfully misappropriated Edcomm s connections on the LinkedIn account as well as her Edcomm cell phone number. Defendants counterclaim alleged: (1) violations of the CFAA, (2) misappropriation; (3) unfair competition; (4) conversion; (5) tortious interference with contract; (6) violation of the Pennsylvania Uniform Trade Secrets Act, 12 Pa.C.S. 5301, et seq., and (8) tortious interference with prospective relations. No ruling yet on the Plaintiff s claim(s). Plaintiff filed a motion to dismiss the counterclaims of Defendants. Court ruled: Dismissed the CFAA claims, as well as the claims of tortuous interference with contract, violation of the Uniform Trade Secrets Act and tortuous interference with prospective relations. Court denied Plaintiff s motion to dismiss for the claims of misappropriation, unfair competition and conversion. Court rejected Edcomm s claim that Eagle unlawfully misappropriated a trade secret. The LinkedIn connections do not qualify as trade secrets because they are generally known in the business community and are easily derived from public information. However, the court did not dismiss Edcomm s claim that Eagle misappropriated an idea. It noted that Edcomm alleged that its employees developed the accounts, maintained the connections and contacted instructors and specific personnel within its clients through LinkedIn. IV. Social Media Policy Provisions/Considerations. A. In a recent survey of 120 national and international companies, 45% of the companies did not have a social media policy. 8 B. Determine the company vision, mission and goals regarding social media; 9

10 C. Determine company s position on use of social media: 1. by employees in the workplace 2. by employees outside the workplace 3. during the hiring process D. Define what is and what is not appropriate social media use. 1. Prohibit disparaging comments that are not related to a dispute over working conditions; 2. Prohibit false or obscene statements; 3. Prohibit harassing statements or statements disparaging an individual s race, religion, age, sex or disability; 4. Prohibit the posting of any confidential information about patients; 5. Prohibit disclosure of company financial, proprietary or other confidential information; E. Explicitly state that the policy is not intended to interfere with protected activity or infringe upon employees rights. F. Require supervisors to comment on an employee s performance only as part of a formally established review process, and prohibit managers from any informal review systems on social networking sites or anywhere else. G. Prohibit use of company trademarks or logos on personal social media. H. Specify that employees are not to speak for companies on social networking sites or blogs, only for themselves I. For a healthcare provider s marketing site: use a disclaimer as to medical advice. J. State that posts by others not affiliated with the provider are their own opinion and not attributable to the hospital; K. Give notice that the provider may review, edit or remove postings from its social media page. L. Reiterate that the company s harassment and discrimination policies apply to employee s communications on social networking websites. M. Prohibit any use of employer s data that is unauthorized. 10

11 N. Prohibit conduct or statements that are contrary to the employer s business interests. O. Reflects poorly on employer P. Damages customer relationships Q. Exposes employer to potential legal liability R. Require employees to sign an acknowledgement form that they have received, read and understand the policy. S. Provide that employees who violate the policy will be disciplined, which may include immediate discharge. T. Enforce the policy consistently Expand Your Network: Four Reasons Health Systems Are Embracing Social Media, The Advisory Board Company Daily Briefing, September 1, Id. 4 Social Media and Mobile Devices in Healthcare: Managing the Times of Change, Hospitals & Health Systems Rx, December 2011, p teid=cbpr&sc_cmp1=cb_pr519_&cbrecursioncnt=1&cbsid=8412d5b32ef54ce6854a035cf3a59d x Expand Your Network: Four Reasons Health Systems Are Embracing Social Media, The Advisory Board Company Daily Briefing, September 1, Katherine C. Chretien, MD; S. Ryan Greysen, MD, MA; Jean-Paul Chretien, MD, PhD; Terry Kind, MD, MPH, Online Posting of Unprofessional Content by Medical Students, JAMA 2009; 302 (12): Expert Q&A on Creating and Implementing Employee Social Media Policies, Labor & Employment, October 2011, p.8. 11