The Health Insurance Portability and Accountability Act (HIPAA) started several years before social media platforms began. Because of this, it didn’t initially include anything regarding these platforms. But today’s updated version of the HIPAA Privacy Rule prohibits the use of protected health information on social media.
Despite this, health employees still tend to violate social media regulations. A 2015 investigation focused on photographs and videos of patients posted by nurses and home care workers. The results uncovered 47 HIPAA violations since just 2012, but there were likely more that never got reported.
Dealing with a HIPAA violation is one of the last things you want as a health practice. It will cause clients to lose trust in your organization and you could face hefty fines and penalties.
To prevent these breaches, health practices need to get authorized consent from patients.
This could be for use of videos, images, testimonials, or example stories which are often for marketing or educational purposes. It’s helpful to use real-life examples of patients to appeal to other clients.
While it’s useful for your practice and audience, not all patients are comfortable with you posting about them online. This is why it’s necessary to first receive permission. The best way to do this is with a social media consent form.
By signing these forms, patients either grant or waive the right for the company to use their health information on social media. These provide a record that you did receive permission in case the patient changes their mind or denies consenting later. So what all should you add to make sure these forms are comprehensive and have all the necessary details?
Here are 12 details to include when creating a social media consent form to receive legitimate permission.
Table of Contents
Type of Content
One of the first steps is to explain the type of content that you’d be sharing. This clarifies exactly what information of theirs that they’re authorizing.
For instance, will you be sharing a picture or video that they’re in? Are they the focus or just in the background?
Or are you sharing a story or testimonial of theirs that includes patient identifiers, such as their name, age, condition, or treatment?
Every patient will be comfortable with something different. Some people don’t feel vulnerable at all if pictures and videos of them end up online. But others don’t want any physical representation of themselves.
via issuu
Some may only be okay with being in the background of images or videos. They don’t want people to know any details of their condition through a story, but they’re fine if people know they visited your practice in general.
Specifying what content you will be posting gives them control to choose what they’re OK with. This way, there are no surprises if they come across their story or their picture online.
Purpose of Content
This explains why you’re using this content online, such as for educational or marketing purposes. It helps the patient know why their information is valuable for sharing online with the public.
Some people are more reluctant to share their details because they don’t know what use it will have. Yet 90% of young people would trust health information on social media, so they know that it has value.
If these consent forms explain what use their details have, they may trust your organization more to share it. 61% of people already feel comfortable sharing their health information with doctors online.
By knowing that their details could help your practice and other patients, it could incentivize them to give permission. Since they find benefits from health content online, they already know it could be useful for others. This is why you want to make them aware of the purpose of using theirs, so they know how it can help.
Information Included in Post
The next thing you want to add to a social media consent form is the specific information that you will use within the post. This can help them decide if they want to give permission or not. For instance, you should state if you only plan to use details about their condition with no other identifiers, such as name or image.
But if it includes more of their identity, they may be more reluctant. To make them more likely to complete the form, you can add a checklist with all the details your organization would potentially use.
This way, the patient still has control over what they feel is most appropriate for sharing. It makes them consider all options. That way they can give authorization without getting upset over a detail that they hadn’t considered before, but aren’t okay with.
Where It Will End Up
Always inform patients of where their data would end up when they give consent. This helps them keep track of it so they know how you used their information. It builds trust letting them know where you will include it.
If someone doesn’t have a specific social media platform, they might not permit sharing their details on that site. That way, there aren’t posts about them that they can’t see.
Each age group has different platforms that they’re more familiar with.
Facebook gets the most use of any platform with 2.7 billion active users each month. Following that is Instagram, but there are far fewer older users on this platform than on Facebook.
YouTube also gets high use with 2 billion monthly active users, but the age group breakdown is slightly different. Of all popular sites, older people use this one the most. 58% of those over 56 years old use YouTube.
But just because they use a site doesn’t necessarily mean they’ll want their information on it. People don’t always trust these platforms with their private data, so chances are they could also be hesitant about having their PHI posted on it.
Only 53% of people agreed in some way that Facebook protects their privacy and data, despite it being the most used platform. This made it the least-trustworthy site. A lack of trust from almost half of users could influence how they respond on a consent form.
This is why you should always include the platforms you’d be using the content on. Patients can select which ones they approve of so they know and trust where it will end up.
When It Will Get Used
Make sure to specify the length of use for all patient details you plan to post. Is it a one-time instance or is it for long-term, repeated use?
Adding this will save you from having people forget later on that they consented. When they see your company include something about them, they’ll remember that they gave you permission for long-term use.
Or, it allows them to hold your company accountable for single-use. If they see that you posted details again in the future when you only included a specific use, they can correct your practice.
Who The Patient is Authorizing
This may seem obvious, but you should always state who the patient is authorizing. Your organization’s name needs to appear on these forms so that they know who they’re granting permission to.
Doing this distinguishes from the company asking for permission versus the employee. No staff member should be asking to post PHI on their private page. It’s unprofessional to develop this kind of personal relationship with patients.
Understanding that it’s the company requesting use makes more sense to the person signing. It’s more trusting that it will get structured use from your practice’s social media team than one of the health workers for their private account.
Age Acknowledgement
In most cases, minors have a personal representative who can make medical decisions on their behalf and access their data.
This is usually a parent or guardian.
Because many children can’t make their own decisions, social media consent forms need an acknowledgment that the person is an adult.
Legal Guardian Identification
This goes along with the age acknowledgment. If the patient from who you’re requesting consent is unable to make medical decisions, you need permission from someone else.
via neuac
Besides minors, not all adults can make their own decisions.
Around 40% of adult medical inpatients and residential hospice patients have lost this capacity. And over 90% of adults in intensive care units can’t make decisions either.
These decisions include consenting to social media, too. If someone can’t make their own medical choices, then they can’t consent to you using their details online.
Because of this, you should have a space for permission from patients’ guardians or personal representatives. This could mean requesting their name, age, relationship to the patient, and signature.
Contact Information
Always request contact information from the consenting person and list your practice’s as well.
If anything changes in the future for use of their details, you will need to follow up to inform them and get consent again. Without their preferred contact method, this becomes a bigger challenge. But having it right on the form makes it easy and all in one place.
Likewise, also include how they can get in touch with your practice. This could mean adding the email or extension for your social media coordinator. That way they can contact the relevant team member directly instead of getting bounced around between staff.
A patient who has questions about the consent form or changes their mind later will need to contact you. Having this on the form makes this easier for them, just like having their information on it makes things easier for you.
If Patients Change Their Mind...
Like I just said, a patient could end up changing their mind later. They might have been OK with consenting at one point, but now they feel uncomfortable with having their details on the internet.
Include a section that explains how your team handles these situations. You should always offer the option for them to change their permission since their health is sensitive to them.
But also note how this works if you’ve already posted on social media with their previous consent. If they change their decision later, does that mean you’ll remove the posts you already made? Or does it mean you will no longer post anything in the future, and they can’t change the consent for what’s already posted?
Always indicate this to set clear expectations and inform them how to change the status of their consent. If they need to formally revoke the permission in writing, then you should state this on the form.
Explanation for Compensation
Depending on what you’re using content for on social media, you may need to explain the rights to compensation. If a patient’s image will be in an advertisement that leads to financial gain for your practice, it’s best to explain these rights.
via AdventHealth
Without this, someone may try to demand compensation from your practice for using their image and likeness. But adding this will prevent any legal issues. As you already know, using someone’s image or details without consent violates HIPAA.
But using their image and likeness for commercial reasons without consent is also illegal. If your practice is going to profit in any way from the post, make sure to explain that they won’t have access to that benefit.
Sign and Date
Finally, once you get through all the requests and explanations of what the person is authorizing, you need a space for them to sign and date. The signature is what grants you the ability to share their details because it officially identifies them.
Adding the date with the signature is also necessary. It indicates when the document goes into effect to clarify when your practice can start using the material. Without a date, it’s unclear when you obtained permission and when you could have legally started including the patient in posts.
via Adams Drafting
Conclusion
Social media is a great tool in the health industry for reaching clients and sharing success stories of your practice. Even with all of the benefits, you need to ensure your team uses it appropriately so there are no HIPAA violations.
Part of avoiding inappropriate use is using social media consent forms. These ensure you have proper authorization before sharing anything so you don’t violate anyone’s privacy.
By having a thorough consent form, patients fully understand what they’re agreeing to. They’ll feel more relaxed letting you use their data if they have control over where it ends up, what data you use, and the kind of content you’re creating.
It also puts their minds at ease to know they can change their mind in the future and that they can contact you with any concerns. That way they won’t feel pressured or intimidated by the requests.
