When it’s YOU in the Review
Making dinner plans? Check online for reviews before you spend your money dining out. Ready to book a vacation? You’re definitely making sure the pool is as big as they say it is.
How about when it comes to personal care? Do you check online to see if a medical facility is up to par?
A lot of people do. Between neighborhood chat groups and online review sites, the information is there for the taking. So, what happens when it is your business that is affected by a negative review? You would likely want to respond and perhaps give your side of the story or work to remedy the situation with the consumer. This seems like a good way to deal with any negative press or feedback.
Unless you’re under HIPAA jurisdiction and requirements.
Recently a dental practice in Dallas, Texas found out the hard way that responding to an online review put them in violation of HIPAA and cost them $10,000 in fines – plus a multitude of other actionable items.
The fine came after a patient found their full name and medical information (among other details) had been disclosed on the Elite Dental Associates Yelp review page. This led to an investigation by the Office for Civil Rights (OCR) which then led to uncovering additional violations in their policies and procedures of HIPAA compliance in accordance with its social media practices.
Social Distortion
Social media is a valuable asset to any business, but just because it is “free” and not monitored by any one entity, for the most part, doesn’t mean it can be overlooked as being a responsibility of the business. HIPAA was enacted before platforms like Facebook were around, but there are rules in place that apply despite that timing.
Above all, and as is true with nearly all HIPAA regulations, never disclose patient health information (PHI) on social media channels or networks. If a patient is visible in any image or video, they must provide – in writing, their consent to use that media. The purpose for which that media is to be used must also be explicitly defined in the consent.
Social media can be used for posting health tips, event details, research news, marketing messages that exclude any PHI, and to present staff bios.
As with all HIPAA compliance, you must remember that no one is excluded from regulation or judgment. This was a small privately-owned practice. Not only were they affected monetarily with a fine, but they must also now bring their policies and procedures up to par.
HIPAA standards are not created based on visibility or on the size of a healthcare organization, therefore you must rise to meet the standard, not expect to be overlooked when you don’t. Ensure your organization has a social media policy in place that clearly lays out what is acceptable on social and that employees are trained on the policy.
Leave a Reply