As the use of social media grows, physician practices continue to face challenges in the workplace regarding its appropriate use among staff. Whether it’s a young receptionist Tweeting while she should be checking-in patients, or the posting of inappropriate patient information on Facebook, the need for clear guidelines regarding the use of social media is imperative.
Of greatest concern to a medical practice is the use of social media that is not for the benefit of the practice, but which occurs during working hours, typically through the practice’s computers, telecommunications systems, or electronic software. To minimize risk to my practice clients, I encourage they draft a compliance policy which everyone is required to sign. It prohibits in part:
1. Sending, receiving, displaying, printing or otherwise disseminating:
a. material that is fraudulent, harassing, embarrassing, sexually explicit, obscene, intimidating, or defamatory;
b. confidential, proprietary business information or trade secrets in violation of company policy, employee contract and/or proprietary agreements,
c. confidential information or Personal Health Information (PHI) in violation of HIPAA or HITECH or any other applicable federal, state or local privacy laws; and
2. Using technology owned and/or operated by the practice to engage in any type of illegal activity;
3. Violating any state, federal or international law governing intellectual property (e.g., copyright, trademark, and patent laws) and online activities;
4. Violating any license governing the use of software;
5. Procuring or attempting to procure a password, access a file, or retrieve any stored communications without explicit authorization.
Practice personnel should understand there is no tolerance for violation of any of these prohibitions and the potential for discipline should be clearly spelled out. While a written reprimand (placed in the personnel file) may be appropriate in some cases, other violations require termination. The practice can be placed at risk for violations of state and federal laws, as well as sexual harassment claims (as discussed in a prior blog), should these rules be violated. Additionally, remember that a written policy without discussion, training and enforcement is just a piece of paper. Regular review of your policies and appropriate training and review of expectations are important!
When it comes to the use of social media, it can be hard to oversee all the many outlets, whether it is personal websites, Facebook, Twitter, or Pinterest. These and other forms of social networking are prevalent methods of communication in our culture today. While you cannot expect to prohibit your staff from engaging in these activities, it is important to clarify what is expected of practice staff when they participate in social media to the extent their affiliation with the practice is known, identified, expected, or presumed. The practice should be clear with all employees that they should uphold the practice’s values by not making any defamatory or harassing statements about other employees, staff, partners or affiliates of the practice. Practices should, when possible, look at the online activity of any new candidate to see first-hand what type of social media presence has already been established by the individual.
With all practice staff, the following are essential standards for an online conduct policy:
1. Employees must abide by all applicable confidentiality laws and policies. No disclosure of identifiable information regarding a coworker, business affiliate, client or patient of the practice is permitted.
2. Employees should identify themselves and, if relevant, their role at practice. It should be clear they speak for themselves and not on behalf of the practice.
3. Employees are personally responsible for content they publish online.
4. Employees should obtain approval from a supervisor before establishing a practice-hosted blog or other social media site or forum.
5. There should be no photos taken inside the workplace which could capture documents, paperwork, patient charts, or other information protected by privacy law.
If your practice has been operating without official guidelines, it may take more than a simple policy to change the approach being used by your staff. Outside training and an actual review of current practices may be needed to change the way in which your staff has, perhaps for a long time, been using social media. For additional guidance and to make sure your policies are enforceable, talk to your legal counsel.
Find out more about Ericka L. Adler and our other Practice Notes bloggers.
