HIPAA and Social Media Review

Which of the following is considered protected health information?

• The number of people treated by a healthcare organization each year

• The financial report of a healthcare organization

• The names of staff members working for a specific provider

• The birthdates and last names of your patients/clients

Answer explanation

Remember, PHI includes:

-Their name

-Geographic units smaller than a state (ex. address)

-Related dates, except for year (ex. birth/death)

-Telephone or fax numbers

-Email address

-Social Security number

-Account and insurance numbers

Sarah, your coworker, tells you she is providing services for a famous singer. She wants to post about this on social media. What is the BEST response you can give?

• You can post a picture, but nothing else!

• You cannot post anything about your encounter.

• You cannot post anything unless your page is set to private.

• You can post the person's name, but nothing else!

Which of the following would MOST likely be considered a SECURE form of electronic communication?

• Electronic medical record program

• Personal email

• Social Media

• Professional online forums

What is one reason that social media increased the risk of HIPAA violations?

• Only people who need the PHI can access it

• Privacy settings don't protect information

• Social media posts are only seen by a few people

• Social media can easily be secured

Which of the following would be the BEST way to prevent a HIPAA violation?

• Using other patient identifiers rather than the patient's name

• Asking your friends to promise they won't share anything you post

• Using only approved devices for appropriate disclosures of PHI

• Asking social media sites to keep your posts private

True or False: HIPAA prohibits you from ever disclosing PHI in ANY electronic communications.

• True

• False

Answer explanation

Secure electronic communication includes:

-Approved in-network email

-Electronic medical record program

Unsecure:

-Personal email

-Text messaging

-Professional online forums

-Social media sites

Which of the following is MOST likely a breach of HIPAA?

• Responding to a patient's text on your personal phone about an issue they are having

• Responding to an email about a client via your organization's approved email network

• Documenting your organization's electronic medical record program after seeing an individual who receives care from you

• Leaving a message for a colleague on their work phone about an individual's treatment

Answer explanation

Remember that personal devices are not necessarily secure and may be at risk for a HIPAA violation because there are less safeguards in place to protect PHI.

You notice that Mark, a colleague of yours, posted protected health information to his social media site. What should you do?

• Report the activity to your supervisor

• Ask him to delete the post

• Ignore the post

• Respond with your own comment

Answer explanation

If you see that someone has violated a client's PHI, it is your job to report it in order to protect the client.

True or False: One factor that has increased the risk of a HIPAA violation when using electronic communication and social media is that they are accessible outside of work.

• True

• False

Answer explanation

Don't be fooled! HIPAA violations can occur even when you're off the clock! Just because you are off company property does NOT mean you can post about a client, or include any defining PHI.

Whether on company time or not, you, and/or the organization can incur hefty fines if HIPAA has been violated.

Katherine is going to be covering for you while you are on vacation. You need to provide her with the details of an individual's treatment. Which of the following actions is MOST likely a breach of HIPAA?

• Sending Kathy an email with the details of the person's treatment using your work approved email

• Leaving a message on Kathy's work phone with the details of the person's treatment

• Sending the individual's last progress report to Kathy via the electronic medical record program

• Leaving a private message on Kathy's social media account with the person's treatment plan

Answer explanation

In regards to social media, privacy settings don't protect information from being shared beyond the people it was originally sent to.

Also, any info sent through social media is stored there, even if you think it's been deleted.

It can also be stored on the device of any person who accessed the information.