Who's responsible for protecting patient privacy on social media?
Picture this: A patient videotapes another patient, who is drunk in the trauma center. The staff doesn't notice. The hospital's media relations department later stumbles across the footage on YouTube. Although the video portrays the staff members in a very good light, caring for the intoxicated man, the patient's likely embarrassing event has gone public.
This scenario played out in real life at a Lifespan hospital in Rhode Island and was the topic of discussion on a thought-provoking Hospital Impact blog post last week by Nancy Cawley Jean, senior media relations officer of social media at Lifespan.
Jean explained that the hospital contacted Google to pull the video, although unsuccessfully, when YouTube's parent company said it wouldn't remove the video because it didn't violate its user agreement. The hospital also called local police, who said they couldn't help. The video still lives online.
Boy, did the article generate some heat! Readers were fired about up "freedom of the press," just as much as patient privacy--some arguing the hospital had no right to try to censor the video, while others said it did the right thing. Here are some of the comments readers had:
"Unless the person taking the video was a hospital employee, he/she has no duty to protect the privacy of the patient."
"How exactly do you expect [staff]--who are busy saving lives by the way--to notice some idiot with a cell phone, uploading this crap?"
"As a health worker, your first line of responsibility is the patient and protecting their safety and their privacy."
The situation Jean described proved that patient privacy in the social media age is an evolving issue and hospitals need to get ahead of it. Was the patient's privacy breached? Is the hospital responsible?
In short, it's not likely a HIPAA or HITECH violation.
"While what happened is very disconcerting, it is not likely a HIPAA breach because the activity was carried out by an individual," Tatiana Melnik, an associate at Dickinson Wright in Ann Arbor, Mich., told FierceHealthcare.
Because HIPAA and HITECH are directly aimed at healthcare providers (i.e., covered entities), as well their business associates and subcontractors, the regulations don't cover patient-produced content. But--and it's a big BUT--that doesn't mean the hospital is off the hook. For situations like these (and it depends on the specific circumstances), the hospital and the person who took the video could still be held liable under state laws on emotional distress, invasion of privacy and negligence, Melnik explained.
The hospital already has a systemwide policy that says photographing and videotaping must go through media relations. The only exception is practitioners taking photos of patients for documentation purposes, in which the patient signs an agreement at admission time, Jean told FierceHealthcare.
"Our security department is vigilant in identifying anyone taking a photo or videotaping and has often notified the media relations team at all times of day or night to manage a situation involving photos or videos on campus [that are] not approved," Jean said. But as this situation demonstrated, some photographers and social media-happy people slid by.
How should hospitals handle those situations?
"We deal with each on a case-by-case basis. Some situations have involved calling the police," Jean said.
Readers of the blog post went as far as to recommend banning smartphones altogether.
"There used to be a time when we were asked to turn off mobile phones in hospitals. This was because of the interference it could cause to the equipment. While this may or may not be true, why not reintroduce this rule?"
"Perhaps the hospital should develop some new privacy policies, by which, no one is allowed to bring cell phones in or they will be confiscated, or people should be searched prior to enter the hospital, like in the airports."
Well, as for Jean, she said the YouTube video holds some tough lessons.
"We have learned that it's vital to catch these things while they are happening, and not after they are posted."
In addition to the existing photography policy, Jean said the hospital is developing some new privacy policies, specific to patients and visitors using smartphones to take pictures and video, which will likely result in signage about the inappropriate use of personal devices for recording.
"We have learned that it's vital to catch these things while they are happening, and not after they are posted because it is near impossible to have a video taken down if the one who posted it is not willing to do so," Jean said. "I believe it's an important message for staff to be more aware of what patients and visitors are doing, and they should feel empowered to ask people to turn off and put away phones and not take pictures or videos."
Jean also said it's important to constantly monitor what's being said about the hospital, which she does through Google Alerts.
"Even if you aren't talking about yourself in the social media world, you can be sure that others are," she wrote.