Beware of HIPAA 'experts' on social media. Why most of them are wrong

Here is what healthcare communicators — and everyone else — should know when a social media debate breaks out about HIPAA.

You open social media, and here is what you see:

📣 “You violated HIPAA first by sharing your own information!”

📣 “The news media violated my HIPAA rights!”

📣 “This random person on social media violated my HIPAA rights!”

📣 “Facebook violated my HIPAA rights.”

☝️ Wrong. Wrong. Probably wrong. Wrong.

Yes, all of that yelling above comes from social media.

If you work in healthcare, you’ve probably seen it: a social media argument where everyone suddenly becomes a HIPAA expert — and almost everyone is wrong.

Recently, a brouhaha broke out on Threads over whether a doctor violated someone’s right to privacy by seemingly confirming that they were a patient without authorization (most likely) to do so.

Let’s set aside the merits of that specific case for now (scroll to the bottom to read my take on it). What really interests me is how mistaken people are about what HIPAA covers.

HIPAA is not an all-encompassing privacy force field. It applies to specific people, organizations and information in very limited contexts. Let’s break it down.

OK, so what is HIPAA?

HIPAA stands for the Health Insurance Portability and Accountability Act. Enacted by the federal government in 1996, it is designed to protect patient medical records and personal health information (PHI) from unauthorized disclosure by people working at “covered entities.” You’ll hear that term a lot.

Covered entities include physicians, nurses, healthcare providers, hospitals, health plans, healthcare clearinghouses and specific business associates of those groups that handle PHI.

Said plainly, HIPAA is meant to protect patients from the misuse or improper disclosure of their medical and other personal information by the people and organizations entrusted with it.

There are some exceptions and nuances. Go in-depth here if you want more information.

Who/what does HIPAA not apply to?

Quick disclaimer: I’m not a lawyer, and this isn’t legal advice. I’m writing from the perspective of a healthcare communicator who has spent a lot of time with HIPAA training, consent forms, legal reviews and compliance guidance.

With that said, let’s look at some of the statements I shared at the start of this article.

📣 “You violated HIPAA first by sharing your own information!”

Sorry, you cannot violate HIPAA against yourself.

HIPAA is designed to protect your protected health information from others. It does not prevent you from sharing your own health information.

That means you can share whatever you want — no matter how sensitive — on Facebook, Threads or a billboard on the freeway. However, once you post it publicly, you will lose control over where it goes next and who sees it. I wouldn’t recommend doing that, but HIPAA isn’t what stops you.

📣 “This random person on social media violated my HIPAA rights!”

Nope. Private citizens generally cannot violate HIPAA.

If a private citizen shares another person's medical information, it is not a HIPAA violation, though it could run afoul of other laws.

However, if that same private citizen is employed by a traditional healthcare organization like your community hospital, they can be held personally and criminally liable if they improperly access or share protected health information. HIPAA applies to them.

Long story short, it’s never a good idea to share someone’s information unless they’ve authorized you to do it. Just don’t do it.

📣 “The news media violated my HIPAA rights!”

In general, the media cannot directly violate HIPAA because news organizations are not covered entities.

Medical professionals and organizations face severe penalties if they share protected health information with journalists or allow them to film in treatment areas without a patient's prior written consent.

Just ask any healthcare marketer or communicator. We can tell you all about patient consent forms. And we spend a lot of time explaining HIPAA to journalists.

📣 “Facebook violated my HIPAA rights!”

Since social media platforms are not covered entities bound by HIPAA, they are not legally considered violators of the law for what users post on their personal accounts.

If a doctor, nurse or any other healthcare employee posts your protected health information online without your written consent they are committing a HIPAA violation.

Again, it’s never a good idea to share anyone’s information on social media unless they have authorized you to do it.

Navigating gray areas

Social media has a way of bringing out the worst in people — and turning everyone into an instant expert with firm views on how things work. In fact, there are some gray areas.

The tricky part is that posting something on social media can be inappropriate, unethical, invasive or even actionable under another law without being a HIPAA violation.

HIPAA is important, but it is not the only privacy rule in the world. And ethics matter.

Tips for healthcare communicators to remember:

That distinction above matters for healthcare communicators and marketers, because our standard should be higher than whether something is “technically allowed.”

Here are some high-level best practices to follow:

• Don’t confirm that someone is a patient unless you have authorization to do so.

• Never assume something shared on social media is safe for you to repost or reference.

• When in doubt, pause and ask legal/compliance for guidance.

• Patient stories, photos, media access and social replies all need clear consent processes. Your organization has these in place. Ask about those policies if you haven’t been trained on them.

I hope this primer helps the next time a social media fight breaks out over whether something is a HIPAA violation.

Spoiler alert: most of the time, the example cited on social media probably isn’t a HIPAA violation. But there are exceptions. Don’t be one of them — it can get you and your organization into a lot of trouble.

---

Below is the post that inspired this blog.

Here is the argument for this incident being a HIPAA violation: Just by responding to the patient’s post, the doctor is acknowledging she served the patient. That response discloses the patient’s identity, which is PHI.

My training over the past 20 years is that responding to a social post like this without written authorization to do so from the patient could be a HIPAA violation.

Here is guidance to physicians from the American Medical Association:

Don’t disclose any information about the patient—don’t even acknowledge the person is a patient in your office. Even if a patient has disclosed their information in an online review, remember that HIPAA prevents a physician from disclosing any information about a patient without the patient’s permission. A patient’s own disclosure is not permission for the doctor to disclose anything.

Complicating the analysis here a bit is that cash-pay practices that do not transmit health information electronically for claims purposes are generally not covered entities. That could apply to the physician's new practice, but I'm not sure it applies to the existing practice.

Clear as mud. Right?

So, what happens next? Will this go to a formal complaint? Uncertain. This is very different than inappropriately accessing a medical record and posting something online.

The bottom line for me: It would have been much safer for the physician to handle this offline or in direct messages to the patient. Putting it all out there is just too risky.

Join the conversation about it on LinkedIn.