Social media posts have become so common and reflexive that people often fire off posts without appropriately considering the consequences. This can be costly on multiple fronts. In the health care context, beyond the risk of losing patients (and the revenue they bring), inappropriate posts can result in Health Insurance Portability and Accountability Act (HIPAA) violations. Indeed, as the Director of the U.S. Department of Health and Human Services Office for Civil Rights (OCR) has stated, “Social media is not the place for providers to discuss a patient’s care… [doctors] and dentists must think carefully about patient privacy before responding to online reviews.” Of course, this warning is not limited to dentists; all health care providers should take heed.
Elite Dental Associates (Elite), a private dental practice offering general, implant, and cosmetic dentistry in Dallas, Texas, has reached an agreement with the OCR to settle potential violations of the HIPAA Privacy Rule stemming from its activity on social media. Among other things, Elite has agreed to pay OCR $10,000 and undertake a corrective action plan that includes two years of monitoring by OCR to ensure Elite’s compliance with HIPAA.
OCR received a complaint from an Elite patient in June 2016 that Elite had disclosed the patient’s last name and health condition in response to a review of Elite that was posted Yelp. The subsequent investigation uncovered a pattern of such disclosures of protected health information (PHI) in response to similar reviews, as well as Elite’s failure to have in place appropriate policies and procedures to ensure that its social media presence adequately protected patients’ PHI. Elite had also failed to provide a Notice of Privacy Practices that complied with HIPAA’s Privacy Rule.
Notably, the relatively low dollar amount of this settlement should not be taken to mean that OCR considers this to be a minor issue. Instead, OCR made specific mention in its announcement that it had accepted a substantially reduced settlement in consideration of Elite’s size, finances, and its cooperation with OCR in the course of the investigation.
Social media engagement is undoubtedly an integral part of participation in today’s healthcare marketplace, but it is essential that providers proceed with caution. McGuireWoods can help with policy development and workforce training to reduce Privacy Rule violation risks.
The resolution agreement and corrective action plan regarding the Elite settlement may be found here.