SOCIAL MEDIA RISKS. Of Healthcare Organizations. October Sponsored by:

SOCIAL MEDIA RISKS Of Healthcare Organizations October 2011 Sponsored by:

SOCIAL MEDIA RISKS Of Healthcare Organizations Social media sites such as Facebook, Twitter, YouTube and LinkedIn have become integral parts of both society and the business world. According to a recent study, social media sites account for 22.5 percent of the time that Americans spend online 1. Facebook is the leading social media site for U.S. users, accounting for 53.5 billion minutes on home and work computers. 2 As healthcare organizations (HCOs) utilize these online tools to increase visibility, encourage communications with patients and market products and services, significant business and reputational exposures must be considered. Social media can be an effective tool for delivering an organization s message, but the use of social media by HCOs must be tightly controlled to avoid monetary and reputational penalties. Even if the HCO is not responsible for an employee s activities, careless or malicious postings can damage a HCO s valued reputation. HCOs also must take steps to limit potential damage from social media activities that are largely outside their immediate control. In particular, HCOs are vulnerable to damage resulting from employees personal social media activities both during and outside working hours. Even if the HCO is not responsible for an employee s activities, careless or malicious postings can damage a HCO s valued reputation. The Social Media Revolution Social networking sites have become the conduits for sharing of information throughout the world. Although a relatively new industry, the statistics are impressive: Approximately 8 percent of the world s population is on Facebook. 3 Approximately 42.3 percent of the entire American population uses Facebook. 4 About 9 percent of the adult U.S. internet population had used Twitter as of the end of 2010. 5 2 Social Media Whitepaper Advisen Ltd. Sponsored by:

Over 200 million people currently access Facebook through their mobile devices. 6 More than 3.5 billion pieces of content (web links, news stories, blog posts) are shared each week on Facebook 7. 155 million tweets are published every day 8. LinkedIn has more than 100 million users worldwide 9. Approximately four hours of video is uploaded to YouTube every minute and there are more than 2 billion video views on YouTube every day 10. Social media is a fast and inexpensive way for HCOs to communicate with patients and employees. Many top HCOs prominently use social media for communication. The Mayo Clinic, for example, has over 120,000 followers on Twitter and the organization tweets about HCO news, answers patient questions and provides link(s) to relevant articles. For HCOs and healthcare practitioners embarking on the use of social media, the rewards may be plentiful. However, the exposure arising out of the use of social media must be managed to avoid unintended negative consequences. Why Should HCOs Use Social Media? U.S. HCOs use social media as a marketing tool to increase their visibility and provide information to their patients. Recent studies show that 34 percent of consumers use social media to search for health information. 12 According to CNN, 94 percent of people searching for healthcare information on social media use Facebook as their primary source for this type of information. YouTube was used by 32 percent of respondents and 18 percent accessed MySpace and Twitter for health information. U.S. HCOs use social media as a marketing tool to increase their visibility and provide information to their patients. According to market research firm YouGov Healthcare, more than half of patients surveyed would pick a hospital based on its social media presence, while 81 percent see hospitals visible in social media as more cutting edge. 13 Communicating via social media does not require sophisticated computer skills. It is quick, inexpensive and allows a HCO to respond to breaking news or provide information about an important event such as a drug recall. Social media gives HCOs the ability to communicate with patients and business contacts in almost real time. Currently approximately 500 hospi- 3 Social Media Whitepaper Advisen Ltd. Sponsored by:

tals use YouTube, Facebook, Twitter and blogging sites for physician education and collaboration. 14 Other common uses of social media include marketing and patient and employee communication. The Risks Social media risks for HCOs span a diverse array of exposures. Like any other organization using social media, HCOs are exposed to defamation, intellectual property violations and employment-related issues. Social media is a practical tool for HCOs to use for a variety of purposes, but it comes with risks. For example, as with traditional media, once an item is placed in a social media outlet, it becomes very difficult, if not impossible to retract, and unlike traditional media, a post or tweet can find its way to millions of people in a very short time. Organizations attempting to manage their social media exposures find that social networking tends to be far more freewheeling and informal, with fewer checks and balances, than traditional media outlets. The opportunities for error are great and there is very little time to correct a mistake. Social media risks for HCOs span a diverse array of exposures. Like any other organization using social media, HCOs are exposed to defamation, intellectual property violations and employment-related issues. HCOs are especially susceptible to damaged reputations, and they need to take care that the organization s reputation is not harmed by careless or inappropriate postings. Professional liability, including medical malpractice, is a potential exposure for HCOs or individual healthcare practitioners who provide medical information or offer medical advice through social media channels. Of the various types of organizations exposed to social media liability, HCOs face heightened exposure to privacy-related liabilities because they must comply with stringent requirements of the Health Insurance Portability and Accountability Act (HIPAA). Violation of HIPAA and other privacy laws Because social media is so accessible, people are sometimes too lenient with the information they share online. HCOs, in particular, face increased scrutiny for the handling of private information, such as patient information. HIPAA is the principal federal regulation concerning the privacy of medical information, and sets forth requirements for the safeguarding of this information. HIPAA allows doctors 4 Social Media Whitepaper Advisen Ltd. Sponsored by:

and HCOs to disclose the personal health information when necessary for patient care and other limited circumstances. However, if information is improperly disclosed, HCOs and their employees can be subject to significant civil and even criminal penalties. Depending on the frequency of the improper transmission of individually identifiable health information, and the intent of the transmitter (negligent or knowing), under HIPAA, HCOs can be subject to a maximum annual fine of $1.5 million, and the individuals who inappropriately transmitted the data can face up to ten years in prison. In one case, an employee of a Hawaii hospital illegally accessed a patient s medical records, and then posted the patient s name and confidential medical details on her MySpace page. This HIPAA violation resulted in a one year prison sentence. 15 HIPAA is the principal federal regulation concerning the privacy of medical information, and sets forth requirements for the safeguarding of this information. While it is almost second nature for medical facilities and doctors to provide their patients with the notifications required by HIPAA in the office setting, and to be rigorous about maintaining privacy safeguards, this may not be at the forefront when using social media. Even though social media seemingly is less regulated, information posted online can open an individual or his or her employer to liability depending on the information posted. HCOs must implement clear guidelines to employees to prevent the unintentional and unauthorized disclosure of patient information. Not only should names of patients not be used in social media communications, great care should be taken to avoid identification of the patient, even without the patient s name being used. An example of this occurred last year, when an emergency room doctor at a Rhode Island hospital had her privileges revoked and was reprimanded by the state medical board after posting information about a trauma patient on Facebook. The name of the patient was not included, but the doctor had included enough information that the patient was easily identifiable by the community. While the hospital, at the time of the incident did not have a social media policy, the doctor nonetheless faced severe consequences for posting the information. Another recent example of the risks associated with posting patient information on line, even without the patient s name being revealed, recently occurred in Long Beach, California-based St. Mary Medical Center. In this case, a 60 year old man was brought to the hospital with stab wounds so severe his head was almost decapitated. Before treating the man, emergency room staff took photos which they posted on their personal Facebook pages. Some employees were fired, and others were disciplined for their involvement in the event. Not only is this example a violation of the patient s privacy rights, it also spotlighted the unprofessional activity of the staff and as a result led to bad publicity for the hospital. 5 Social Media Whitepaper Advisen Ltd. Sponsored by:

If the criticism is unfounded, it can be cleared up. But if the criticism is warranted, dealing with it in a constructive way may even enhance the HCO s reputation. Reputation risk The St. Mary Medical Center incident is just one example of a threat to a HCO s reputation from social media. With employees, patients and visitors wandering HCOs with smart phones equipped with cameras and video recorders, potentially embarrassing or even highly damaging images can be recorded and disseminated via social media. Inappropriate tweets and Facebook postings by healthcare professionals can undermine not only their own reputations, but also those of the organizations they work for. Social media provides an easy way for unhappy customers to communicate their displeasure with an HCO, perhaps even on the organization s own social media site. While it may be unappealing to provide a forum for potentially negative publicity, allowing the open display of comments on its social media site gives the HCO an opportunity to respond in a positive manner that is seen by the community. If the criticism is unfounded, it can be cleared up. But if the criticism is warranted, dealing with it in a constructive way may even enhance the HCO s reputation. Providing medical advice on line Technology has resulted in people wanting almost immediate answers to their questions. Health information is one of the top searched topics on the internet. According to a recent study, 80 percent of Americans research health information online 16. The survey results found that people seeking health information ranks third in online activity, trailing only email and using a search engine. 17 HCOs and their workers may feel it is useful or commercially necessary to communicate more regularly with patients through social media. However, they should do so in a way that is not seen as dispensing specific medical advice, which could lead to violations of HIPAA and state laws regarding doctor licensing. Even through social media, a doctor cannot provide medical advice to a patient in a state where he is not licensed. To do so may put the practitioner s license at risk. Dispensing medical advice online also has the potential to lead to a medical malpractice suit. Crossing boundaries Social media is a great way for a HCO s professionals to communicate news and practice information to their patients. But the interactions in social media should not be so informal as to breach doctor/patient boundaries. Friending patients on Facebook, for example, runs the risk of inadvertently establishing inappropriate physician-patient relationships. 6 Social Media Whitepaper Advisen Ltd. Sponsored by:

Practitioners need to be especially cautious about posting information accessible to patients that could give patients a false sense of familiarity or could undermine confidence in the practitioner s judgment. In one case, pictures taken at a party and posted to Facebook led to questions about the clinical judgment of a physician. In extreme cases, information posted online could bolster malpractice accusations. A practitioner should proceed with caution even when he posts information for which the patient has given permission. The American Medical Association (AMA) has issued guidelines for doctors to use in social media to maintain a positive online experience and preserving the integrity of the doctor/ patient relationship. The AMA guidelines address the following issues: 18» Patient privacy. Physicians must avoid posting any information that could identify a patient, including anonymous or de-identified information or material acquired while providing patient care.» Safeguarding personal information. Physicians should take advantage of privacy settings on social networking sites to safeguard personal information. Additionally, physicians should ensure that the personal and professional information on their own sites and content posted about them by others, is both accurate and appropriate» Boundaries. Any interactions with patients on the Internet must be done as to maintain appropriate boundaries of the patient-physician relationship.» Separating personal and professional identities. To maintain appropriate professional boundaries, the AMA suggests that physicians keep personal and professional online identities separate. Even within the personal sphere, however, physicians should always be cognizant that their reputations among patients and colleagues can be affected by their online actions and the content they post. A practitioner should proceed with caution even when he posts information for which the patient has given permission. The balance of power in the doctor/patient relationship lies with the doctor. The doctor must be careful not to violate the patient s trust. The doctor must be aware of the possibility that the patient may give consent to online posts out of a sense of obligation to the physician. The blurring of the line between a physician s professional identity and private life represents an additional area of risk. Privacy, no matter what precautions are taken, cannot be guaranteed and therefore a physician should take this into account when considering what to post on his personal social media sites. A good rule is that any information a practitioner or HCO would not want their patient to know should not appear in social media in any forum. 7 Social Media Whitepaper Advisen Ltd. Sponsored by:

Employee-related exposures HCOs are justifiably concerned about statements made by employees in their own social media activities. Many HCOs have social media policies that prohibit certain types of comments about the organization, its services and other employees, as well as the disclosure of sensitive patient information. Recent cases have shown, however, that organizations sometimes go too far in attempting to control employees communications and may violate state or federal labor laws. In the first social media case to attract the attention of the National Labor Relations Board (NLRB), a Connecticut-based ambulance company, American Medical Response of Connecticut, allegedly fired an employee in violation of federal labor law for criticizing her boss on Facebook. The criticism clearly violated the company s written social media policy. However, according to the NLRB, because federal labor law allows employees to openly discuss working conditions, wages and other work-related topics, and since she made the Facebook comments on her own computer and during her personal time, the employee s words constituted protected speech. American Medical Response of Connecticut settled the suit in April for an undisclosed amount and agreed to revise its social media policy. Areas involved with social media, or which should be providing input into social media policies, include marketing, human resources, public relations, patient relations, risk management and the general counsel s office. Risk management HCOs using social media as a tool to communicate with patients and the community at large should promulgate unambiguous guidelines relating social media use. These include:» Create a clear employee social media policy. Policies will vary among organizations depending on the organization s mission, business objectives, comfort with social media and risk tolerance, but all policies should address the following: - The use of social media at work; - Which employees are authorized to represent the organization through social media; - Prohibitions on disclosing patient information; - Standards of professional conduct in social media, including policies concerning healthcare professionals friending patients; - The use of social media for professional networking purposes; and - Limitations on work-related content in an employee s private social media activities (keeping in mind that some work related postings may be protected by labor laws). 8 Social Media Whitepaper Advisen Ltd. Sponsored by:

» Provide training to the employees designated to represent the organization through social media channels.» All employees must be educated about HIPAA, and clearly understand that no information about patients ever is to be shared.» Employees writing about healthcare matters, unless specifically on behalf of the HCO, should be instructed to note that they do not speak for the HCO.» For posts that provide medical information, use a disclaimer that indicate the post is for informational purposes only and should not be interpreted as medical advice.» Identify the types of information that require legal review before being released.» Incorporate social media into an enterprise risk management framework. Social media can touch many parts of an organization and can result in financial, reputational and regulatory risks. Areas involved with social media, or which should be providing input into social media policies, include marketing, human resources, public relations, patient relations, risk management and the general counsel s office. With enterprise risk management (ERM) frameworks in place, organizations may be able to more easily accommodate the multidisciplinary, cross-departmental requirements of managing social media exposures. Insurance Despite an HCO s best efforts to manage their social media exposure, lawsuits can happen. Insurance coverage is essential. Coverage for some social media exposures may be available under traditional Commercial General Liability policies, but this coverage is most likely limited. Similarly, online professional liability exposures, including medical malpractice, may not be covered by traditional policies. In recent years, the insurance industry has responded to social media and other online exposures by introducing specialized cyber liability policies. In addition to coverage for some social media activities, cyber liability policies cover other risks associated with doing business digitally such as data security. Social media-related exposures typically covered by a cyber liability policy include defamation, trade libel, and invasion of privacy, copyright infringement, plagiarism, and infringement of title, slogan, trademark, trade name, trade dress, service mark or service name. Some policies specifically address the social media and data security exposures of physicians and HCOs. 9 Social Media Whitepaper Advisen Ltd. Sponsored by:

NOTES/REFERENCES: 1. State of the Media: The Social Media Report 2. State of the Media: The Social Media Report 3. Friends without Facebook, Daily Texan, June 20, 2011 4. emarketer, February, 2011 5. emarketer, February, 2011 6. Facebook, December 8, 2010 7. Econsultancy, March 25, 2011 8. Forbes Magazine, September 1, 2011 9. Econsultancy, March 25, 2011 10. Econsultancy, March 25, 2011 11. deluxesmallbizblog.com, March 15, 2011 12. How America Searches: Health & Wellness by icrossing and Opinion Research Corporation 13. Cited in Why hospital social media is a full time job, FierceHealthcare 14. HCOs IT News, September 7, 2011 15. Security for social networking PriceWaterhouseCoopers, p. 5 16. Pew Internet Project and California HCOs Foundation 17. Pew Internet Project and California HCOs Foundation 18. A MA Policy: Professionalism in the Use of Social Media Cyber liability policies provide broad coverage, but they usually do not address the full range of social media exposures. Insurance buyers should work with their brokers to assure their directors & officers liability (D&O) policies and employment practices liability insurance (EPLI) policies will respond to social media claims brought by, as applicable, shareholders, competitors, regulators and employees. Professionals offering advice through blogs and other social media channels should assure they have appropriate malpractice and errors & omissions insurance. Conclusion Social media is an effective method of communication for HCOs and its employees. However, social media is fluid and quickly evolving. Risks associated with its use will continue to arise. HCOs should not be paralyzed by concern over these risks, but they do need to be proactive in minimizing their potential impact. A well-conceived and regularly updated risk management program combined with insurance coverages tailored to social media exposures should give HCO executives the peace of mind to confidently make use of social media to help fulfill their business and social missions. n 10 Social Media Whitepaper Advisen Ltd. Sponsored by: