I agree and disagree in part: No doubt that no process can ensure 100% compliance and even with well defined guidelines and extensive education/training, at the end it is all left to the good judgment and use by the individuals. However, the use of social media is/will be different from the use of fax machines/emails/phone calls. The latter are forms of one-to-one communication where the influencing power of these means is only as strong as the influencing power of the individuals using such means. Most often, in such means, you influence or get influenced by an individual AND moreover, you can be selective about who can influence you (for example, patient-doctor communication with the patient giving the right to the doctor to influence the patient’s actions through doctor’s opinion).

Social media on the other hand brings with it the power of numbers and the dangers of majority opinion being misinterpreted as the correct thing to do. It also poses the dangers of some random opinion being considered the correct (or the recommended) thing to do just because it is expressed in a “convincing” manner from a “trustworthy” platform. Moreover, it takes away from you the right to decide who (and how many) can influence your decisions, because by very definition, it is a “social” media. Privacy issues will also add to the complexity.

And therefore, the risks will not be “small”. It can be argued that the owner of such a healthcare social media will only be providing the platform and the users will be themselves responsible for how they use the content and opinions expressed therein. However, lawsuits (and the associated costs and bad publicity) are a distinct possibility. If subject matter experts (doctors/specialists) are given the tasks of constantly monitoring and managing the social media, then it will substantially increase its cost and will put a question mark on the ROI.

It is more complex than it appears…

-Atul

It comes down to a risk / reward question: do the benefits of social media use outweigh the relatively small risks? Of course we have to set guidelines, and have education in place before opening up access, but at some point you have to trust your employees to use good judgment and make the right decisions. We trust them to use fax machines, send emails and make phone calls to the outside world – how is the use of social media different?

My question is this: How do hospitals who allow open use of social networks (and I’m guessing general Internet access) for employees ensure that no HIPAA violations occur? Having a sound social media policy does not in itself assure this, nor does it implicitly protect employees from making an error in judgment.

Thanks for any insights.

-atul