Social media is a powerful communication and connection tool that is being applied in healthcare environments for a range of purposes and audiences. Despite its many benefits, it does present some risks — the most common concern being the posting of private health information causing a HIPAA violation and legal liability.
This points to the importance of having policies that specifically address social media and balance the risk of liability of the employer with the rights of employees. Some healthcare organizations have resisted, believing their existing policies were sufficient. However, more specific policies can provide examples that could be used to educate employees, especially those young digital natives and their ubiquitous use of mobile and social tools.
Let's look at "recommendations" on LinkedIn as an example. Some hospitals require that all letters of reference go through the human resources department. If a young supervisor were to post a general recommendation on another employee's LinkedIn page, would this violate the hospital's policy? What if the employee was no longer employed by the hospital?
It makes one wonder just how many employees have received LinkedIn "recommendations" from their supervisor or co-workers when a formal letter would violate hospital policy.
Well-written policies can help establish situational awareness and a shared mental model across generations and levels of leadership. This is important because social media is a nontraditional communication tool and represents emerging technologies with potentially unrealized risk and unintended consequences. The three examples below highlight the role of carefully written social media policies.
1. Gloucester County in New Jersey was forced to change its social media policy following a federal lawsuit in violation of their employees' First Amendment rights. The lawsuit filed by an employees' union claimed the county's policy on social media violated their rights to free speech because it "prohibits all county employees from engaging in a broad range of expressive activities through private social media outlets."
2. In November, the University of Cincinnati Medical Center was found not liable for a Facebook post by a financial services employee that included a screenshot of a patient's medical record. Judge Jody Luebbers found the worker did not act within the scope of her employment, and she dropped the hospital from the patient's lawsuit. Luebbers simply stated the hospital "had a policy. It was violated. It's tragic, but that's just how I see it."
3. A doctor filed a lawsuit against Spectrum Health, challenging her dismissal after a Facebook comment to a picture of a patient posted by a nurse. It highlights social media and the federal patient privacy law violations, as well as the possibility of inconsistent application of discipline. It is also an example of how a patient can be "identifiable" even without her face or specific identifying information being included.
The National Labor Relations Board (NLRB) protects certain work-related conversations, and this extends to those conducted on social media, such as Facebook and Twitter. Their investigations have found reasonable cause to believe that some employer policies and disciplinary actions violated federal labor law.
The NLRB Office of General Counsel has issued complaints against employers alleging unlawful conduct, but they have also found other communications were not protected and the disciplinary actions of these employers did not violate the law.
They recommend outlining specific types of prohibited posts that would lead to discipline and be considered violations, such as anything that could be deemed to be:
- Organizing activity
- Overly broad
- Already publicly available information
Effective leaders will minimize these risks by ensuring that employees and leadership have a shared mental model of expectations around social media. They will also protect their investment in people hired to do important work (nurses, physicians and others) by reducing the risk of misunderstandings and the possibility of termination.
The application of policy and enforcement of consequences for violations must also be consistent. Strong policies are proving to facilitate this important work.
