1. From Baby Boomers to Millennials
How to Remain HIPAA Compliant in the Age of Social Media
Molly Staley, Marketing Consultant
Capital Ortho

2. So, who exactly is a millennial and who is a baby boomer
So, who exactly is a millennial and who is a baby boomer? Why are we looking at generations as it relates to social media and HIPPA compliance. The rules are essentially the same for everyone. But different generations tend to utilize social media differently. So, it’s important to communicate clearly to ALL employees in your organization. While older employees may chose to use Facebook primarily, younger generations are utilizing Snapchat and Instagram more often. Challenge for employers
OR if you’re in the greatest generation, a Xennial, like myself.

3. I think we could all agree that the way we communicate has drastically changed over the past 15 years.

5. Now these are two extremes
Now these are two extremes. But the point is, that when it comes to social media, we have to be careful to think before we hit publish.

6. Quick Review… What is HIPAA??
The Health Insurance Portability and Accountability Act of 1996 is U.S. legislation that provides data privacy and security provisions for safeguarding medical information.
Established in 1996… which was pre-social media boom! FaceMash was established in 2003, which later became TheFacebook in 2004 and was only available to college students with a valid college address. Then in 2006, Facebook became available to the general public, which cued the rise to fame for social media.

7. Protected Health Information
Protected Health Information is any health information that can be tied to an individual and includes one of more these 18 identifiers.
Names (full or last and initial)
Geographical Identifiers smaller than a State
Dates (other than year)
Phone Numbers
Fax Numbers
addresses
Social Security Numbers
Medical Record Numbers
Health insurance beneficiary numbers
Account Numbers
Certificate/License Numbers
Vehicle Identifiers
Device Identifiers and Serial Numbers
URLs
IP Address Numbers
Biometric Identifiers
Full face photos and comparable images
Any other Unique Identifying Number, Characteristic, or Code
As a healthcare company or one who works with healthcare companies, you are responsible for taking care of those who come to you for help. You should not look at HIPAA compliance as a necessary evil or something you need to navigate so as to not get into trouble with the law. You should instead view it as a set of guidelines that help you in your quest to provide the absolute best care for your patients.
Source: HIPAAJournal.com

8. HIPAA & Social Media: What’s the Big Deal?
According to HHS, the majority of HIPAA violations in recent years have occurred from employees mishandling PHI, many of which stem from inappropriate social sharing.
Violations can result in fines ranging from $100-$1.5 million or Criminal Penalties which can result in fines up to $250,000 and up to 10 years in prison.
Other potential consequences include lawsuits, loss of medical license, & employee termination.
Give real life examples.

9. Many researchers believe that by the year 2025, Millennials will make up over half of the workforce in the US. And 75% of all internet users have at least one social media account. The popularity of social media networks combined with the ease of sharing information means HIPAA training should include the use of social media. If employees are not specifically trained on HIPAA social media rules it is highly likely that violations will occur.
Photo credit: Entrepreneur.com

10. Common Social Media HIPAA Violations
Posting of videos or images of patients without written consent
Posting of gossip about patients
Posting of any information that could allow a patient to be identified
Posting videos or images taken inside a healthcare facility in which patients or PHI are visible
Read 3 examples
Sharing of photos, videos, or text on social media platforms within a private group

11. HIPAA Social Media Guidelines
Develop clear policies covering social media use and ensure all employees are aware of how HIPAA relates to social media platforms
Train all staff on acceptable social media use as part of HIPAA training and conduct refresher training sessions annually
Provide examples to staff on what is acceptable- and what is not- to improve understanding.
Communicate the possible penalties for social media HIPAA violations- terminations, loss of license, and criminal penalties
Ensure all new uses of social media sites area approved by your compliance department
Review and update your policies on social media annually
Develop policies and procedures on use of social media for marketing, including standardizing how marketing takes place on social media accounts
Develop a policy that requires personal and corporate accounts to be totally separated

12. Guidelines Cont.
Create a policy that requires all social media posts to be approved by your legal or compliance department prior to posting
Monitor your organization’s social media accounts abd communications and implement controls that can flag potential HIPAA violations
Maintain a record of social media posts using your organization’s official accounts that preserves posts, edits, and the format of social media messages
Do not enter into discussions with patients who have disclosed PHI on social media
Encourage staff to report any potential HIPAA violations
Ensure social media accounts are included in your organization’s risk assessments
Ensure appropriate access controls are in place to prevent unauthorized use of corporate social media accounts
Moderate all comments all social media platforms

14. Guidelines Cont.
Create a policy that requires all social media posts to be approved by your legal or compliance department prior to posting
Monitor your organization’s social media accounts abd communications and implement controls that can flag potential HIPAA violations
Maintain a record of social media posts using your organization’s official accounts that preserves posts, edits, and the format of social media messages
Do not enter into discussions with patients who have disclosed PHI on social media
Encourage staff to report any potential HIPAA violations
Ensure social media accounts are included in your organization’s risk assessments
Ensure appropriate access controls are in place to prevent unauthorized use of corporate social media accounts
Moderate all comments all social media platforms

15. Resources
hipaajournal.com/hipaa-social-media/ hipaajournal.com/hipaa-compliance-checklist/ hhs.gov/web/social-media/policies/index.html

16. Main thing with social media and HIPAA is think before you post
Main thing with social media and HIPAA is think before you post!! Social media can be a fun way to connect with others and find out what’s going on in the community and with the world, it can also open up new ways for businesses to engage with their customers and clients. Once you’re educated on how to avoid HIPAA violations, you’ll see that social media can benefit your business and you don’t need to be afraid of “being social”!