The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was created to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.
HIPAA was created many years before social platforms became the omnipresent media giant it is today. As a result, there are no specific rules outlining social media use. Rather, you can apply the general rules around the protection of PHI (patient health information).
Healthcare organizations must implement a HIPAA social media policy to reduce the risk of violations. The HIPAA Privacy Rule prohibits the disclosure of PHI on social media networks without the express consent of patients.
So if you want to utilize social media in your marketing, that’s what you need to worry about – acquiring consent.
The easiest way to gain consent is by including a ‘Media Consent Form’ with your patient onboarding paperwork – either printed or as a digital file. Patients and their families are already mentally prepped to fill out paperwork when dealing with health and dental visits, so this won’t be an inconvenience to them at all.
Why worry about getting consent to post photos of your patients?
One of the best ways to show off your dental practice is by posting patient results on your website, office bulletin board, and social platforms (both photos of teeth and photos of patients having a good experience in your care) so having a media consent form is critical to marketing your practice. And it’s just good practice. Some parents are sensitive about sharing their children online, and some encourage it!
One of our most popular marketing items is our photo ops that help create social media engagement. Of course, parents and kids can take and post all the photos of themselves that they want.
The time for a consent form is when your business wants to share photos as well, such as celebrating a cavity-free prize winner, sharing funny photos of a family posing with your photo op character, or showing off the successful results of a dental treatment plan on a young patient.
A consent form should include:
- your organization’s name to show who is using the photos and videos
- the name and signature of the parent or guardian
- the date to show when consent was granted – a timeline of when the use of photos and videos begins
- purpose of the authorization – description of how the media will be used – social media, website, promo videos
- the ability of the parent to revoke consent at a future date
This signed agreement, with clear indications of how the information will be used, must remain on file.
Here is a sample of what a consent form will look like:
We have included all this information in a media consent form for children and one for adults:
This blog is not legal advice and no attorney-client relationship is formed by using our contract template. If you have a specific problem and need legal advice, contact a licensed attorney. Consult your legal team or HIPAA Privacy Officer about HIPAA and your social media policies.
Other tips to help you stay HIPAA compliant when using social media include:
- Have a dedicated social media coordinator who is educated in HIPAA compliance. There are numerous educational programs to help your staff get HIPAA compliant. It is better to have someone who is aware of the rule surrounding HIPAA and who is able to check the consent form before posting or commenting on social. Having control over content is the first step to avoiding violations.
- Consult your legal or compliance team to verify that your content does not violate HIPAA and aligns with your brand’s social media use policy. Additionally, work with them to establish a communication protocol for corresponding with patients and their families over social media.
- Make sure your staff keeps PHI off their personal social media accounts. It is a good idea to train your entire staff in HIPAA compliance to make sure they do not make a mistake in their personal use of social platforms.
- Review environmental photographs and videos to ensure there is no PHI in the background such as a patient’s name on an x-ray, charts, or computer screens.
- Ask permission to share photos and testimonials posted on a patient’s own social media page, just to be safe.