Social Networking and Patient Privacy

Last month, to forestall any unintended threat to patient privacy, NEBH made the decision to temporarily suspend access to social networking sites like Facebook and Twitter from Hospital computers. Our decision led to a fair amount of discussion on local blogs and even publicity in newspapers and on television. Managing social networking sites is a challenge for many organizations, and as a privacy professional, I have struggled to find a balance between protecting our patients and permitting legitimate contact on these sites, which are commonly used for employee recruitment, marketing, etc.

Although patient privacy was not breached, we came to realize that staff could benefit from additional training. It is easy to be lulled into a false sense of security because a username and password is used to access Facebook, but privacy settings must be configured in order to control who has access to the information. Many of our employees were unaware that an offhanded comment that might be made on Facebook, in an environment of “friends and family only,” could be e-mailed to hundreds of people.

Even a remark about “Aunt Doris” or an unnamed “difficult” patient can be damaging and potentially breach privacy when made by an employee who is self-identified as being a Hospital employee. We are currently developing a training program to ensure that our staff understands the ramifications of their use of social networking sites.

As health care providers, we are afforded the privilege of working with patients to address some of the most intimate challenges of their lives. The trust that is bestowed upon us and the responsibility that we bear cannot be taken lightly. It is paramount that we adopt a common set of standards that protect our patients and their right to privacy. Over the next several months, we’ll be working to establish guidelines, education and monitoring tools to help us ensure that use of these sites is done responsibly and with the protection of patient privacy at the forefront.