Compliance Today - October 2021

More efficient social media monitoring for HIPAA violations

Social media can be a low-hanging fruit in a privacy program’s move to proactive work. Note, this discussion about social media is limited only to HIPAA-questionable content. It is not the privacy program’s responsibility to monitor and determine professionalism of an employee’s social media presence.

COVID-19 has changed healthcare in many ways, one of which has been an increased use of social media by healthcare professionals to show what it is like to be on the frontlines of a pandemic.^[1] These users likely make these posts with the best of intentions, whether it is advocacy or education, but what the users sometimes forget is that HIPAA protects more than just the “obvious” information. Marketing can help monitor social media for these questionable posts when employees tag the organization or check in to work, because if done correctly, the individual(s) running the organization’s account receive a notification. At that point, marketing knows right away if someone has posted a picture that may contain a patient in the background, made a comment about a procedure they did that day, or anything else that could border the fine line between breach and nonbreach. By having a strong interdepartmental relationship, marketing will know to immediately notify privacy of the issue so that privacy can make a determination of whether there is a breach.

Another way that marketing can help with proactive social media monitoring is by watching the comments of the posts under the organization’s pages. Oftentimes, patients may want to share how grateful they are to have received care from the organization, sometimes going so far as to share the name of their aide, nurse, pharmacist, or physician in a comment on a post the organization makes. The patient is free to share this as much as they want, but the issue will come from the organization’s response confirming the treatment relationship, or from the previously named employee responding and thanking the commenter for their gratitude. Why? Because protected health information includes any information that relates to an individual’s past, present, or future mental/physical health, provision of healthcare, or payment for the individual’s care. Many employees of covered entities find this shocking, but it is true. And confirming a patient’s treatment relationship exposes your organization to fines from the Department of Health & Human Services Office for Civil Rights.^[2] If your marketing team knows to watch for comments that confirm a treatment relationship, they can quickly hide or delete the comment and notify your privacy team so that appropriate coaching and training can occur with the employee who made the comment.

Risk-specific training and development with your workforce

One of the elements of an effective compliance program is conducting training and education. If your training and education program is computer-based, your marketing team can also help you with this. Marketing can provide you with branded presentation templates, help you communicate to the organization your training window, and even help you put together some of the content.

At UC Health, we used our marketing team to help us film short videos that we incorporated into our training. These videos included scenarios such as a patient asking for his after-visit summary and the employee retrieving it from the printer and another employee answering a phone, searching for the patient on the phone, and asking for multiple identifiers to confirm she had the correct patient’s record open before disclosing information or changing anything in the record. We chose these scenarios because we determined these two issues to be our biggest risk areas based on the previous year’s reported incidents. These scenarios could be described with text and presentation slides, but marketing helped us develop our training to replicate real scenarios that our clinical employees find themselves in every day and show what the right thing is to do each time.

An added bonus will also come to your general compliance (not privacy) team. The relationship between privacy and marketing will allow compliance to develop a similar relationship. Compliance can provide ongoing trainings to marketing about the Anti-Kickback Statute, Civil Monetary Penalties Law, Stark Law, and other fraud and abuse laws to assist in identification of any issues when someone approaches marketing about an idea and wants to offer something that may be an issue according to one of these laws or regulations. Once the department knows how to identify an issue, they will contact the compliance department when they see any possible problems prior to encountering them.

Better communication about your privacy program and what it does

Many privacy programs are known as the “HIPAA police,” or some variation of the phrase, in their organizations. For better or for worse, many individuals in your organization may assume that you and your team only exist to respond to incidents. Your marketing team can help you change that perception so that your organization knows that you are also available to help proactively.

If your organization has an internal communication tool or process, ask your marketing team if they would be willing to include your privacy team in a communication that goes out to the organization. This could be an opportunity to publish to your whole organization what exactly you do and how you can help everyone do their job without worrying whether something is a HIPAA violation. Alternatively, this communication can address a large risk in your organization. For example, if your organization has a policy that forbids an employee from accessing their own electronic medical record (or other record system), and your privacy program notices an uptick in individuals still accessing their own records, marketing can help you push out a reminder to everyone about the institutional policy. As your privacy program becomes more visible in your organization, it will become easier to move from a reactive program to a proactive program.

Compliance with the Breach Notification Rule in case the worst happens at your organization

As the HIPAA Breach Notification Rule requires, “covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are…required to provide notice to prominent media outlets serving the State or jurisdiction.”^[3] For many covered entities, if it has not already happened, it is only a matter of time until a breach happens that requires media notice. Privacy programs should plan now, not when trying to create their response and notification to the Office for Civil Rights, how to handle media notice.

Your marketing team may have contacts at your local media outlets or may know how to get in touch with the outlets. Marketing can also help you draft the news release that will go to the media outlets. Marketing can help you draft a brief but clear news release that complies with the requirements in the Breach Notification Rule. Additionally, your marketing team may be able to help you field any media calls your organization gets about the breach, although your organization may have a policy about speaking to media.

Stronger safeguards for some of your organization’s high-profile patients

While this may seem like an issue that only applies to large hospitals, trauma centers, or academic medical centers, it can also apply to community hospitals and smaller providers. When a significant event happens, such as a mass casualty, sporting event injury, car accident that shuts down the interstate, or other event that can create an attention-grabbing headline, marketing can quickly become privacy’s right hand. Or, for less tragic situations, if a VIP is in your facility for routine care, this same process can apply, and marketing can help privacy ensure that the patient’s privacy is always being protected.

The news will likely report where the patient has gone for treatment. Your marketing team may have contacts with most or all the local news organizations and will field questions or requests for comments from the outlets. For large events that have everyone’s attention, such as a major league athlete being injured during a match, it will be obvious to privacy that they need to actively monitor that athlete’s electronic medical record for snooping or other inappropriate uses/disclosures.

But for incidents that may not seem as obvious, if marketing receives multiple calls or requests for comments from news organizations about a patient reportedly at your facility, your marketing team can tip off your privacy team that the patient may need to be considered high-profile/VIP, activating your internal policy on safeguarding their records.

At UC Health, we have established a standard operating procedure for what we call “media events.” A media event is any situation in the local or national news media that involves patients at any of our facilities. Because of our relationship with our marketing team, our media relations director will notify the chief privacy officer whenever there are multiple requests for a statement about a patient in our care. The chief privacy officer will then work with the registration team to ensure that the patient is marked as confidential, add our electronic medical record system’s added security feature (“Break the Glass”) to the patient’s record, and if the patient has not arrived yet, ensure that they will arrive under an alias. At that time, privacy and information security conduct regular auditing and monitoring of access to the patient’s electronic medical record to ensure that no snooping occurs, or if it seems that snooping has occurred, then activate the standard investigation process. In practice, this has helped privacy ensure that individuals’ HIPAA rights are protected despite the news media sharing information it obtains from other sources.