Long term care facilities should consider implementing a social media policy to establish clear guidelines for appropriate use, prevent and mitigate facility-damaging postings and clearly delineate patient information protected by Health Insurance Portability and Accountability Act (HIPAA). The policy, and the consequences of violating it, should also be clearly communicated to all employees. At a minimum, a good social media policy should include the following:
- If a facility chooses to allow employees personal use of the Internet at work, its policy should limit usage to: checking personal email, handling personal business via the Internet or passive reading of news or other informational websites. Employees can and should be prohibited from blogging or posting on sites while at work, unless such usage is for sanctioned, work-related activities.
- The policy should emphasize that employees remain responsible for the content of texting and Internet postings done outside of work. For example, employee posts should not violate any policies including the Code of Ethics or Anti-Harassment/Nondiscrimination policies. Employees should also be encouraged to use good judgment and discretion when posting information. For example, if a profile can link someone to their place of employment, the employee should not post anything that could potentially embarrass or otherwise reflect poorly on the facility. Moreover, if an employee posts information to a posting site that could impair or injure the reputation of, or otherwise harm the facility, the policy should reserve the company’s right to demand that the employee remove the information from the posting site and discipline the employee.
- The policy should strictly prohibit the dissemination of, posting, or reference to patient information, unless done via encrypted communication and for work purposes only. Willful violations of this rule should result in immediate termination.
- All policies should also emphasize that employees should have no expectation of privacy with respect to any information communicated via the company’s electronic communication systems; and that the company reserves the right to monitor, review and inspect all e-media use conducted through its networks and the contents of it.
The policy should be communicated in writing to every employee immediately upon hire, and it should be re-emphasized periodically so the provisions stay fresh in employees’ minds. As discussed earlier, companies should also consider implementing a social media monitoring program. The company’s monitoring program should be communicated to employees so that employees know that online postings will be reviewed by the company. This will help ensure employees are complying with the policy and it will alert the company to any content on social media sites involving the company. Several companies offer monitoring services for a charge, and others offer free services. For example, Google Alerts provides email updates of the latest relevant Google results on the search terms of your choice.
A facility should also consider establishing a team tasked with responding to disparaging uses of social media that threaten to go, or have already gone, viral. The team should be comprised of employees from corporate communications (specifically people well-versed in social media), senior management and people in the legal and marketing departments. Doing so now will save time later if the facility needs to respond quickly in order to mitigate potential damage.
Emily Plotkin and Courtney Smith are attorneys in the Nashville office.