By Cecilia Backman, MBA, RHIA, CPHQ; Susan Dolack, MHIM, RHIA; Denise Dunyak, MS, RHIA; Laurie Lutz, RHIA, CHPS; Anne Tegen, MHA, RHIA, HRM; Diana Warner, MS, RHIA, CHPS, FAHIMA; and LaVonne Wieland, RHIA, CHP
Social media has become an undeniable force, and its rapid, informal communication style represents both possibility and liability for healthcare organizations. Good policies and training help organizations pursue the benefits and mitigate the risks.
Social media refers broadly to Web-based tools that allow individuals to communicate quickly, easily, and broadly. Current popular social media sites include Twitter, Facebook, LinkedIn, and YouTube; in addition, millions of individuals publish their thoughts and interests through blogs. The days are gone when mass communication belonged to mainstream print, television, and radio companies.
Social media represents a brave new world for healthcare. It offers a venue for communicating with consumers quickly and inexpensively, such as promoting new wellness programs, marketing new services, and announcing the latest achievements in patient care. It also presents challenges, including risks to information accuracy, organizational reputation, and individual privacy.
Establishing appropriate staff use of social media through policies, position statements, and guidelines is an essential first step in mitigating the risks. Most importantly, organizations must educate staff and closely monitor the social media channels they sponsor.
Growing Use in Healthcare
Many healthcare organizations are using social media to engage with patients and consumers. One organization to embrace it wholeheartedly is the Mayo Clinic, whose Center for Social Media has a stated mission to "lead the social media revolution in healthcare, contributing to health and well being for people everywhere."
Mayo Clinic actively uses YouTube, Facebook, and blogs. It has more than 100,000 followers on Twitter, where on a typical day in February it published an announcement of a major philanthropic gift, a link to a video tour of its Florida facilities, and inspirational quotes. Its "Sharing Mayo Clinic" blog presents "stories from patients, families, friends, and Mayo Clinic staff."
The primary focus for most organizations' social media programs is marketing and communications. Social media is moving people away from a reliance on advertising in making purchasing decisions; consumers are relying more on the information they find online. For healthcare, this becomes increasingly relevant as the public has access to quality and cost ratings.
Consumers also are using the opinions they find online to inform their purchases. Companies are using social media to market their messages and encourage their customers to promote their products and services. Healthcare organizations that offer a venue for patients to share their positive experiences and personal stories can send a powerful message to consumers who are determining where to obtain their healthcare services.
Healthcare organizations also use social media to communicate their mission and vision, describe the services they offer, and provide health education. Some organizations use social media to promote wellness and sponsor online support forums where individuals who are dealing with chronic health issues or catastrophic conditions can find support from others who are having similar experiences. On some sites, physicians and other clinicians educate the public on common diseases, what can be done to cope with conditions, and how to maximize the quality of life for the individual who is suffering from the disease.
Many organizations use social media to encourage philanthropy. By publicizing their services, promoting patient advocacy, displaying credentials, and describing the tangible and intangible community benefits they provide, organizations can encourage benefactors to invest in their mission.
Finally, many organizations including healthcare are using social media for recruitment. They advertise their available positions and also search social media sites to determine the integrity and trustworthiness of potential hires. Human resources departments must be fully aware of labor laws when accessing social media on new hires or current employees.
Unintended Outcomes, Good and Bad
Perhaps the greatest fears organizations have about social media is the inability to control the conversation. People may say bad things about the facility-true or not-that can damage its reputation. At the same time, people may say very good things that can promote the facility. Learning to highlight the positives and manage the negatives is imperative for any organization embarking on social media.
Some risks are internal. Employees, medical staff, contractors, or volunteers who use social media may not grasp its ability to publish comments far and wide. One incorrect or flippant remark can become indelible, reaching audiences who lack the ability to read facial expressions or hear intonation. They may not be able to discern something said in jest from something said in earnest.
Improper descriptions or discussions of a patient case on social media could violate a patient's privacy, even if no names are used and no harm is intended.
Take for example a nurse who lives in a rural area and has a frustrating experience with a patient one day. Coming home she merely intends to blow off steam to friends by venting about the situation on her Facebook page. Although she does not divulge any protected health information, one of her Facebook friends recognizes the patient based on the description and the situation. The friend is related to the patient and shares the nurse's comments. The patient is angry with the organization and accuses it of negligence in protecting her health information.
Even acts of kindness can have complicated and unintended outcomes. For example, a staff member who communicates with a patient or family through an online support community could set up scenarios for boundary issues and claims of care disparity.
External risks are harder to manage. Social media opens up an organization to public criticism. However, as social media experts like to say, customers are already talking about companies online-by joining them, companies can help direct the conversation.
A patient who has a less-than-desirable experience or outcome during an encounter can convey his or her displeasure via social media-perhaps even on the facility's own social media site. When this happens, an organization that has fostered positive patient comments and has promoted its awards, accreditations, and community service will maintain better equilibrium when negative comments appear and retain more public confidence.
Finally, there are times when social media delivers unintended and unexpected outcomes that are wholly positive. In 2008 a woman and her mother leaving the Mayo Clinic stopped in the lobby to listen to an elderly couple playing the piano. The woman asked the couple to play another song and took a video of them with her phone. She posted the video to YouTube, where more than 7.5 million people have viewed it.
This simple video communicated an image of the Mayo Clinic that no amount of purposeful advertising could have yielded.
Popular Social Media Sites
"Millions of people use Facebook everyday to keep up with friends, upload an unlimited number of photos, share links and videos, and learn more about the people they meet," according to the site. In addition, companies use Facebook as a means for marketing. As of January 2011, Facebook had more than 500 million active users.
Individuals use Twitter to publish "small bursts of information called Tweets," according to the site. Each Tweet is a maximum of 140 characters in length and may be read by other registered users. Organizations use Twitter to share information on products and services, gather real-time market intelligence and feedback, and build relationships. Twitter claims 175 million registered users and 95 million tweets per day.
LinkedIn is a professional network where users maintain a professional profile. The network offers opportunities to connect with current and former colleagues, look for a job or business opportunity, and ask for and share business advice. LinkedIn claims more than 85 million users.
Blogs, short for "Web logs," are typically simple Web sites offering commentary from an individual and accepting comments from readers. Companies also employ corporate blogs to deliver news and build customer relationships. Blog software is free and relatively simple to use. Wordpress, one of several common blogging platforms, is installed on millions of sites.
YouTube describes itself as the world's most popular online video community. It "provides a forum for people to connect, inform, and inspire others across the globe and acts as a distribution platform for original content creators and advertisers large and small," according to the site. Users uploaded more than 13 million hours of video in 2010 and 35 hours of video are uploaded every minute.
One example of social media in healthcare is CaringBridge (www.caringbridge.org), which offers "free, personal and private websites that connect people experiencing a significant health challenge to family and friends, making each health journey easier." Patients and family maintain personal information on the site. Each day more than half a million people connect through CaringBridge, according to the site.
Managing Social Media with Guidelines and Training
Organizational policies on staff use of social media run the gamut from highly restrictive to very open. Some organizations encourage all staff to participate in social media, while others restrict use to departments such as marketing or human resources. More important than the degree of access is the development of a policy that guides social media use within the organization.
Further, organizations should educate both their employees and the public on their privacy practices to encourage responsible use of their social media sites. They also must diligently monitor the social media sites they sponsor to ensure that information posted there does not violate privacy regulations and other laws.
Policies help establish an organization's rules and expectations around social media. Some healthcare organizations find that they can simply modify existing policies to specifically address social media. Legal counsel should contribute their expertise or guidance in creating written policies. A sample social media policy template appears below.
Policies surrounding social media should address the following issues, at minimum:
- Who can access social media from the organization's network
- Activation of network settings that allow only designated staff to access social media (e.g., marketing staff) to help protect privacy and confidentiality
- Inappropriate uses of social media, either on the organization's network or a personal device (e.g., disparaging and defaming the employer, divulging trade secrets and other proprietary information, or violation of privacy rights)
- Ramifications for inappropriate use, which should relate to existing company policy stating a violation can and may lead to discipline, up to and including termination
- Responsibility of employees that witness inappropriate use
- Modification of other policies related to codes of conduct, disciplinary action, handbooks, e-media use, discrimination, or harassment
- Ensuring that staff members understand and acknowledge that they are not speaking on behalf of the organization when they post on their personal social media sites
- Responsibility of employees outside the realm of their employment (e.g., their actions on social media may put them at risk for civil liability)
Many Uses, Restricted Access
In October and November 2010, AHIMA surveyed 260 members on the social media practices in their organizations. The responses show a range of social media uses and varying states of policy development and access.
Marketing and Communications Lead
How does your organization use social networking sites?
Laying the Ground Rules
Does your organization have a social networking policy that addresses employee use?
Restricting Access Common
Are staff members allowed to access social media sites from the organization's hardware and network?
*May include blocking sites from work stations, restricting access to staff whose jobs require it, or restricting by policy but not blocking access.
Training and Monitoring
Once policy is established, employees, volunteers, contracted employees, and medical staff members should receive training and education to ensure they are aware of the policies and procedures. Whatever form the training takes, those who receive it must acknowledge they understand the policies presented to them.
Training should include examples of both appropriate and inappropriate uses of social media in other organizations. Real-life situations are effective in delivering messages both to technologically advanced staff who use social media daily and to those staff who are not as facile or committed to the media. Training should cover technical issues such as the importance of security settings on social networks to the potentially devastating impact that a poor choice of words could have on individuals, the organization, or the author.
Organizations must monitor and moderate the social media sites they sponsor. Identifying potential privacy violations related to the organization on other social media sites, however, is challenging at best.
There are software and services that organizations can use to search social media channels for references to themselves; the free site SocialMention, for example, is similar to a Google search on dozens of social media sites including Facebook and Twitter. However, monitoring the Web for inappropriate postings by staff is not possible.
Instead, if an organization learns of inappropriate staff behavior, it is most likely a staff member who sees and reports it. Staff are typically the organization's greatest watchdogs. For this reason, training is important-staff should understand their responsibilities and the protocols for reporting actions that could put patients or the organization at risk.
In addition, employers must use caution as they venture into personal sites maintained by employees. Unless the employer has been given the right, information contained on an employee's personal site cannot be used in the workplace. Examples of court cases upholding privacy rights of employees on their private Web sites include Konop v. Hawaiian Airlines, Pietrylo v. Hillstone Restaurant Group, and Blakey v. Continental Airlines.
The laws can be vague in their relation to social media, and they continue to change. Technology is outrunning regulations. As such, continuing education on industry activities is critical. Organizations must regularly review policies and procedures and update them as necessary. Complaints must be acted upon immediately to reduce exposure and risk. And employees must be continually reminded of their responsibility to their peers, their employers, and their patients.
Social Media Sample Template
Policy Name: Social Media Guidelines
Departments Affected: Workforce
Purpose: This policy provides employees of [organization] with the requirements for participation in social media. The policy establishes conditions and limitations related to the use of social media by staff.
Scope: This policy applies to all [organization]'s employees, contractors, medical staff, volunteers, and workforce members.
Policy: Social media may be used by [organization] employees and workforce members, in the course of their job responsibilities, for business-related purposes subject to the restrictions set forth in this policy. These restrictions are intended to ensure compliance with legal and regulatory restrictions and privacy and confidentiality laws and agreements. Social media includes items such as blogs, podcasts, discussion forums, and social networks.
Blog: Short for "Web log," a site that allows an individual or group of individuals to share a running log of events and personal insights with online audiences.
Electronic media: noncomputing devices (floppy diskettes, flash memory drives, CDs, DVDs, tapes, hard disks, internal memory, and any other interchangeable, reusable, and/or portable electronic storage media) (1) on which electronic information is stored or (2) which are used to move data among computing systems/devices.
Protected health information (PHI): individually identifiable information (oral, written or electronic) including, but not limited to, information about a patient's physical or mental health, the receipt of healthcare, or payment for that care; patient records; name, address, Social Security number, account number and others. Individually identifiable health information in [organization] employment records is not PHI; however, it may be subject to other state and federal privacy protections.
Social media: variety of formats that include, but are not limited to, blogs, podcasts, discussion forums, wikis, videos, and social networks like Facebook, LinkedIn, and MySpace.
Responsibilities: This policy applies to employees and workforce members using social media while at work. It also applies to the use of social media when away from work, when the employee's [organization] affiliation is identified, known, or presumed. It does not apply to content that is nonhealthcare- related or is otherwise unrelated to [organization].
Using social media. Employees are expected to adhere to all existing [organization] rules and policies when using or participating in social media. All the rules that apply to other [organization] communications apply here, specifically: respecting employees, patients, customers, and one another; protecting confidentiality, privacy, and security of patient identifiable information, PHI, employee identifiable information, and [organization] information; and safeguarding and proper use of [organization] assets.
Be respectful. Employees may not post any material that is obscene, defamatory, profane, libelous, threatening, harassing, abusive, hateful, or embarrassing to another person when posting to [organization] hosted sites.
Abide by the law and respect copyright laws. Employees may not post content or conduct any activity that fails to conform to any and all applicable state and federal laws. For both [organization] and its employees' protection, it is critical that all employees abide by the copyright laws by ensuring that they have permission to use or reproduce any copyrighted text, photos, graphics, video, or other material owned by others.
Obtain pre-approval before setting up [organization]-hosted sited. Employees must seek approval from the privacy, information technology, and marketing/public relations departments before setting up a [organization]-hosted blog or other social media site.
Proprietary information. Employees may not disclose any confidential or proprietary information of or about [organization], its affiliates, vendors, or suppliers, including but not limited to business and financial information, represent that they are communicating the views of [organization], or do anything that might reasonably create the impression that they are communicating on behalf of or as a representative of [organization].
Patient confidentiality. Employees may not disclose any patient identifiable information of any kind on any social media without the express written permission of the patient. Even if an individual is not identified by name within the information you consider to use or disclose, if there is a reasonable basis to believe that the person could still be identified from that information, then its use or disclosure could constitute a violation of the Health Insurance Portability and Accountability Act (HIPAA) and [organization] confidentiality policy.
Employee confidentiality. Employees may not disclose any personal information obtained through records or documents viewed or obtained though the normal course of business at the [organization].
Self-hosted sites. Employees must not say or suggest that the views and opinions they express related to [organization] and healthcare topics represent the official views of [organization].
[Additional responsibilities for other individuals or departments]
Violations: [Add organizational policy]
"AMA Weighs in on Social Media." Health Data Management. January 1, 2011. Available online at www.healthdatamanagement.com/issues/19_1/ama-weighs-in-on-social-media-41631-1.html.
Barwise, Patrick, and Sean Meehan. "The One Thing You Must Get Right When Building a Brand." Harvard Business Review 88, no. 12 (December 2010): 80–84.
Dimick, Chris. "Privacy Policies for Social Media." Journal of AHIMA, January 6, 2010. Web exclusive. Available online at http://journal.ahima.org/2010/01/06/social-media-policies.
Edelman, David. "Branding in the Digital Age: You're Spending Your Money in All the Wrong Places." Harvard Business Review 88, no. 12 (Dec. 2010): 62–69.
Gaines-Ross, Leslie. "Reputation Warfare." Harvard Business Review 88, no. 12 (Dec. 2010): 70–76.
ID Experts. "Avoid the Risks of Anti-Social Networking." Data Breach Examiner 7 (Nov. 2010).
Mayo Clinic Center for Social Media. http://socialmedia.mayoclinic.org.
Spenner, Patrick. "Why You Need a New-Media 'Ringmaster.'" Harvard Business Review 88, no. 12 (Dec. 2010): 78–79.
Wolf, Dale. "Making Social Media Work for Business." Expert Access. September 8, 2010. Available online at http://expertaccess.cincom.com/2010/09/making-social-media-work-for-business.
Cecilia Backman is associate director of health record integrity and registry services at Parkland Health and Hospital System. Susan Dolack is a data and accountability manager at Pressley Ridge. Denise Dunyak is a product marketing manager at Siemens Healthcare. Laurie Lutz is the director of health information and medical records at Kootenai Medical Center. Anne Tegen is the director of HIM at Children's Hospitals and Clinics of Minnesota and co-chair of AHIMA's EHR Practice Council. Diana Warner (email@example.com) is a practice manager at AHIMA. LaVonne Wieland is the director of information privacy at HealthEast Care Systems in St. Paul, MN.
Backman, Cecilia; Dolack, Susan; Dunyak, Denise; Lutz, Laurie J.; Tegen, Anne; Warner, Diana.
"Social Media + Healthcare"
Journal of AHIMA