HIPAA and Social Media: What a Health Practice Can Post

Under HIPAA, a covered health practice must get a patient's signed authorization before it uses that patient's protected health information for marketing. The rule has two exceptions: a face-to-face communication, and a promotional gift of nominal value Source [1]. A post that names a patient or describes their care is the first kind of content to check against that rule (our read) Source [1].

This is general information, not legal advice. It is based on three sections of the HIPAA regulations, and your counsel decides how they apply to you.

When a practice has its own photos, Autonomah uses them in the posts it creates, and a person on the brand's team approves each piece Source [4].

Who the rule covers

The regulation calls the organizations it binds "covered entities." They are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a transaction the rules cover Source [3]. Whether your practice is one is the first question to settle, and your counsel can answer it.

What counts as protected health information

Protected health information starts from "individually identifiable health information." That is information created or received by a health care provider, health plan, employer or clearinghouse that relates to a person's physical or mental health or condition, to the care they receive or to payment for it, and that either identifies the person or gives a reasonable basis to believe it could identify them Source [3].

Our read: a patient's name, or a story specific enough that people could work out who it is, fits that definition. So does confirming in a comment that someone is your patient, because it relates to the care they receive and identifies them Source [3].

What counts as marketing

The regulation defines marketing as a communication about a product or service that encourages recipients to buy or use it Source [2]. Some communications are carved out, such as treatment communications and descriptions of the covered entity's own health-related services, but the treatment and own-services carve-outs do not hold when the entity receives payment from a third party for the communication Source [2].

Authorization comes first

The general rule is that a covered entity may not use or disclose protected health information without an authorization valid under the regulation, unless the regulation otherwise permits it Source [1]. For marketing, the regulation adds that an authorization is required, with the two exceptions above Source [1]. If a third party pays for the marketing, the authorization must say so Source [1].

A valid authorization has at least these elements Source [1]:

• A specific description of the information to be used or disclosed.
• Who may make the use or disclosure.
• Who may receive it.
• The purpose of each use.
• An expiration date or event.
• The individual's signature and the date.

It must also tell the person they can revoke it in writing Source [1]. A person may revoke an authorization at any time in writing, with limited exceptions Source [1].

What to check before you post

The steps below are our suggestion, and the regulation does not list them.

1. Ask: does this post identify a patient, directly or by details someone could piece together? If yes, stop and get a signed authorization first.
2. Keep patient names, photos and stories out of replies and comments unless an authorization covers them.
3. Prefer content that needs no patient information: staff introductions, general health education, opening hours, and how to book.
4. Have counsel review your authorization form, and keep the signed copies.

Three details give a patient away in a post: a name or face, a story with enough detail to work out who it is, and a reply that confirms someone is a patient. The approval step in Autonomah belongs to a person on the brand's team, and a piece is published only after it Source [4].

What this guide does not cover

It does not cover state privacy laws, other HIPAA provisions or each platform's own rules. We read only the three regulation sections cited here.

How Autonomah does it

Autonomah is an artificial creative and advertising brain that thinks, creates and publishes each brand's advertising Source [4]. To start, it asks for the logo, the colors and what the brand has already published Source [4]. The site lists what Autonomah needs to get started.

Frequently asked questions

Who is subject to HIPAA and social media rules?

HIPAA's rules bind covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with covered transactions Source [3]. The rules attach to protected health information, so what matters on social media is whether a post uses or discloses it Source [3].

What does a HIPAA authorization have to include?

At a minimum it needs a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the signature and date of the individual Source [1]. It also needs statements about the right to revoke it in writing Source [1].