{"id":46181,"date":"2023-09-15T15:23:09","date_gmt":"2023-09-15T15:23:09","guid":{"rendered":"https:\/\/pabau.com\/?p=46181"},"modified":"2026-08-12T10:03:00","modified_gmt":"2026-08-12T10:03:00","slug":"hipaa-and-social-media","status":"publish","type":"post","link":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/","title":{"rendered":"HIPAA compliance and social media: What you need to know"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"46181\" class=\"elementor elementor-46181\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-73a782f4 e-flex e-con-boxed e-con e-parent\" data-id=\"73a782f4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1c9f9473 elementor-widget elementor-widget-text-editor\" data-id=\"1c9f9473\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Let\u2019s talk about HIPAA compliance.<\/span><\/p><p><span style=\"font-weight: 400;\">It\u2019s one little acronym, one enormous can of worms to get your head around.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">This blog will drill into one area where medical businesses may inadvertently run into trouble: <a href=\"https:\/\/pabau.com\/blog\/hipaa-compliance-simplified-guide\/\">HIPAA compliance<\/a> and social media. Because while private practices will typically have stringent processes in place regarding <a href=\"https:\/\/pabau.com\/blog\/best-practice-tips-for-managing-data-protection\/\">data security and patient confidentiality<\/a> in other areas of the business \u2014 from a <a href=\"https:\/\/pabau.com\/blog\/hipaa-compliant-crm\/\">HIPAA compliant CRM<\/a> to secure record storage \u2014 social media can sometimes be where things slip through the cracks.<\/span><\/p><p><span style=\"font-weight: 400;\">Today, we\u2019ll walk you through some of the common pitfalls and knowledge gaps that practitioners may experience when it comes to HIPAA compliance and social media.<\/span><\/p><p><span style=\"font-weight: 400;\">Because you 100% do not want to end up breaking the trust of your clients, losing your hard-won reputation that you\u2019ve spent years building, and being slapped with a massive fine. You could even end up on the HIPAA wall of shame &#8211; a real thing, by the way.\u00a0<\/span><\/p><p>And if something does go wrong, it helps to know <a href=\"https:\/\/pabau.com\/blog\/what-to-do-if-you-violate-hipaa\/\" target=\"_blank\" rel=\"noopener\">what to do if you violate HIPAA, <\/a>including how investigations work and what the OCR will expect from your practice.<\/p><p><span style=\"font-weight: 400;\">Here\u2019s our guide to HIPAA compliance and social media.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-209deca8 elementor-widget elementor-widget-text-editor\" data-id=\"209deca8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What is HIPAA compliance?\u00a0<\/h2><p><span style=\"font-weight: 400;\">HIPAA stands for the Health Insurance Portability and Accountability Act. <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\">HIPAA is a law that safeguards personal health information. It ensures that medical providers like doctors and hospitals keep patients\u2019 health details private and only share them with authorized personnel. If someone doesn&#8217;t follow these rules and shares confidential information, they can face serious consequences &#8211; we\u2019re talking big fines and even imprisonment.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ead9bf3 elementor-widget elementor-widget-text-editor\" data-id=\"4ead9bf3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">What do HIPAA guidelines say about social media?\u00a0<\/span><\/h2><p><span style=\"font-weight: 400;\">That\u2019s a good question. HIPAA guidelines were enacted in 1996. That\u2019s in the very early days of the internet and long before Facebook, Instagram, or Tik Tok were a thing.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">While HIPAA rules don\u2019t mention social media directly, privacy protections regarding personal health information (PHI) apply to &#8211; and can be breached by &#8211; your social media content.\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">Key principles of HIPAA related to social media\u00a0<\/span><\/h2><p><span style=\"font-weight: 400;\">The crux of the matter is PHI: protected health information. According to the <\/span><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#protected\"><span style=\"font-weight: 400;\">US Department of Health and Human Servic<\/span><\/a><span style=\"font-weight: 400;\">e, PHI is any information that relates to an:\u00a0<\/span><i><\/i><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Individual\u2019s past, present, or future physical or mental health or condition<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">The provision of health care to the individual, or<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">The past, present, or future payment for the provision of health care to the individual<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Common identifiers such as name, address, birth date, and Social Security Number, when they can be associated with the health information listed above.<\/span><\/i><\/li><\/ul><p><span style=\"font-weight: 400;\">Sharing patients\u2019 protected health information is strictly prohibited and healthcare employees need to be vigilant of potential breaches &#8211; on social media and more broadly.\u00a0 <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b8f2864 elementor-widget elementor-widget-html\" data-id=\"b8f2864\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"pro_tip\">\n<div class=\"img\">\n<svg width=\"42\" height=\"42\" viewBox=\"0 0 42 42\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M12.6383 19.5238C12.6632 21.2071 12.8734 22.9926 12.0685 24.5523C11.0341 26.8917 8.45076 28.169 7.56292 30.5918C6.63082 33.1061 7.19505 36.185 9.31371 37.9786C10.929 39.5678 13.4183 39.9873 15.6061 39.5463C17.4592 39.073 19.1049 37.8388 19.9706 36.1608C20.781 34.7141 20.7866 32.9904 20.5293 31.3985C20.1006 29.3092 18.3775 27.8705 16.9807 26.362C14.8814 24.1005 14.6684 20.6854 15.595 17.8915C16.4331 15.4768 19.0026 14.2344 20.0425 11.9461C20.7202 10.6769 20.7506 9.20327 20.6068 7.81304C20.1864 5.40098 18.3139 3.23631 15.8716 2.56674C13.9742 2.03969 11.8224 2.30052 10.1739 3.37614C8.70522 4.34688 7.5878 5.86618 7.28356 7.58178C6.76081 9.82981 7.53525 12.2822 9.20307 13.9118C10.7658 15.4741 12.4806 17.2273 12.6383 19.5238Z\" fill=\"#2BADD4\"><\/path><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M22.7048 19.8387C22.6822 22.3279 24.4507 24.6234 26.7493 25.4682C28.0531 25.961 29.4725 25.9183 30.7989 25.5487C32.0575 24.9955 33.301 24.2237 34.0069 23.0092C34.8384 21.5811 35.2982 19.8286 34.7832 18.2094C34.3611 16.2507 32.8739 14.6541 31.0275 13.9426C28.6736 12.9595 25.8073 13.7942 24.1719 15.7001C23.2022 16.8366 22.6143 18.3326 22.7048 19.8387Z\" fill=\"#2BADD4\"><\/path><\/svg>\n<\/div>\n<div class=\"text\">\n<h3>Pro Tip<\/h3>\n<p>When you post patient testimonials or before-and-after photos on social media, ensure you've obtained written consent and removed all identifiable information\u2014many practices unknowingly violate HIPAA by including names, dates of treatment, or specific conditions that could identify patients, even in seemingly innocuous posts.<\/p>\n<\/div>\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1bf44877 elementor-widget elementor-widget-text-editor\" data-id=\"1bf44877\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">Examples of social media mistakes leading to HIPAA breaches<\/span><\/h2><p><span style=\"font-weight: 400;\">There are numerous ways that social media mistakes can lead to HIPAA breaches.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">For example, imagine a hospital employee posting something about a patient they treated at work that day on their personal social media account. You might think it\u2019s OK because the post is generic and they haven\u2019t named the patient. However, the patient may be still identifiable if, say, the employee has the name of the hospital they work at on their profile. <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\">Here are a few other examples of HIPAA breaches on social media:\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sharing photos of the patient without their consent\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Venting about a patient online, even if you don\u2019t identify them<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Responding to comments or reviews and revealing patient information\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sharing patient information in a post without realising <\/span><span style=\"font-weight: 400;\"><br \/><\/span><\/li><\/ul><h3><span style=\"font-weight: 400;\">Consequences of HIPAA breaches on social media<br \/><\/span><\/h3><p><span style=\"font-weight: 400;\">Here are just some examples of HIPAA breaches and the consequences\u2026<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/www.hipaajournal.com\/texas-nurse-fired-for-social-media-hipaa-violation\/\"><span style=\"font-weight: 400;\">nurse at a children\u2019s hospital in Texas <\/span><\/a><span style=\"font-weight: 400;\">was fired after she posted on social media about a child who had a rare case of measles at the hospital she worked at. The nurse was an anti-vaxxer but posted on Facebook about how it was \u201crough\u201d seeing the boy suffering from measles, a disease which would be preventable through vaccination.\u00a0\u00a0<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/www.paubox.com\/blog\/dental-practice-hit-with-social-media-hipaa-violation\"><span style=\"font-weight: 400;\">dental practice<\/span><\/a><span style=\"font-weight: 400;\"> was hit with a HIPAA violation for disclosing PHI on a social media review site. The practice breached HIPAA because of how they responded to reviews on Yelp. While the patients had posted under a Yelp moniker, the responder used full names and also disclosed information about patient visits and insurance.<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">One <\/span><a href=\"https:\/\/www.medpagetoday.com\/special-reports\/exclusives\/102460\"><span style=\"font-weight: 400;\">patient in Michigan was threatened with jail <\/span><\/a><span style=\"font-weight: 400;\">for filming an interaction between another patient and a member of staff in a hospital &#8211; which was documented in a series of videos uploaded to Tik Tok &#8211; an example of a newer platform to be aware of.\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7ac7e591 elementor-widget elementor-widget-text-editor\" data-id=\"7ac7e591\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4><b style=\"color: var( --e-global-color-primary ); font-family: var( --e-global-typography-f89edde-font-family ),Sans-serif; font-size: var( --e-global-typography-f89edde-font-size ); letter-spacing: var( --e-global-typography-f89edde-letter-spacing ); word-spacing: var( --e-global-typography-f89edde-word-spacing ); background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">\ud83d\udca1<\/b><b style=\"color: var( --e-global-color-primary ); font-family: var( --e-global-typography-f89edde-font-family ),Sans-serif; font-size: var( --e-global-typography-f89edde-font-size ); letter-spacing: var( --e-global-typography-f89edde-letter-spacing ); word-spacing: var( --e-global-typography-f89edde-word-spacing ); background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">Did you know?\u00a0<\/b><\/h4><p><span style=\"font-weight: 400;\">It\u2019s not just healthcare businesses that can run into trouble with HIPAA compliance and social media.\u00a0<\/span><span style=\"background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">Meta has had a lawsuit filed against them for violating patient privacy.<\/span><\/p><p><span style=\"font-weight: 400;\">This followed an<\/span><a href=\"https:\/\/www.theverge.com\/2022\/8\/2\/23288612\/meta-hosptials-sued-patient-privacy-facebook-data-hipaa\"><span style=\"font-weight: 400;\"> investigation<\/span><\/a><span style=\"font-weight: 400;\"> which found that 33 of the top 100 hospitals in the US use the Meta Pixel on their website.\u00a0<\/span><span style=\"background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">At seven hospitals, it was sending confidential patient information to Facebook and the patients were then being served advertisements related to this information.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-21b3f901 e-con-full e-flex e-con e-parent\" data-id=\"21b3f901\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-45f6d5a elementor-widget elementor-widget-author-box\" data-id=\"45f6d5a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.pmalconsulting.com\/\" target=\"_blank\" class=\"elementor-author-box__avatar\">\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/jessica_ellis-wilson_in_black_jacket-1-300x200.jpg\" alt=\"Foto van Jessica Ellis-Wilson, FACMPE\" loading=\"lazy\">\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/www.pmalconsulting.com\/\" target=\"_blank\">\n\t\t\t\t\t\t<h4 class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tJessica Ellis-Wilson, FACMPE\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-author-box__bio\">\n\t\t\t\t\t\t<p>Consultant, trainer, and speaker<br \/>\nPractical Management and Leadership Consulting<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-24a07ea elementor-widget elementor-widget-text-editor\" data-id=\"24a07ea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>\ud83d\udc49<strong><em>As a former HIPAA Privacy Officer, consultant and speaker Jessica Ellis-Wilson, FACMPE, was responsible for both safeguarding protected information and training all employees on best practices for compliance. She shares some of the biggest red flags she sees in clinics regarding HIPAA and social media&#8230;&nbsp;<\/em><\/strong><\/p>\n<p><em>&#8220;The biggest mistake I see is that organizations do not conduct appropriate privacy law training for the people responsible for social media engagement. <\/em><\/p>\n<p><em>&#8220;Whether they&#8217;re using interns, existing staff, or hiring social media or marketing staff specifically &#8211; or outsourcing to social media management companies &#8211; there is often a disconnect regarding these folks&#8217; understanding of HIPAA and other applicable privacy laws and what they <\/em><em>believe to be best practices for marketing and engagement.<\/em><\/p>\n<p><em>&#8220;It&#8217;s great to have a robust social media presence &#8211; it allows for more organic engagement with patients and potential patients, and can be used to educate and inform your audience about important health-related issues in a non-identifiable way. <\/em><\/p>\n<p><em>&#8220;However, it&#8217;s easy to cross the line into impermissible activities. I<\/em><em>f a patient comments or asks a question on one of your social media posts, for example, you have to be certain that answering them does not violate HIPAA or other privacy regulations.<\/em><\/p>\n<p><strong><em>Jessica&#8217;s tips on how NOT to breach HIPAA violations on social media<\/em><\/strong><\/p>\n<ol>\n<li><em><strong>Be careful of photography errors:<\/strong> &#8220;If you&#8217;re posting photos of your office\/employees\/clinicians, obviously you need a photo release if patients are being shown. But it&#8217;s easy to snap a couple pictures of smiling staff, and forget to zoom in on every area of the picture to ensure no patient information is visible!&#8221;<\/em><\/li>\n<li><em><b>Have clear policies you communicate to staff: <\/b>&#8220;Make sure you have clear HIPAA and privacy policies that are communicated to your staff, and be sure that they include things like a cell phone policy, voice and image recording policies, content policies for company and personal social media, etc.&#8221;<\/em><\/li>\n<li><em><b>Don&#8217;t forget personal social media accounts:<\/b> &#8220;An employee who posts a picture of their newly-cleaned desk to their own social media account may be unwittingly violating HIPAA if you can zoom in and read the display on their computer&nbsp;<\/em><em>monitor, or patient information on a sticky note. Double and triple-check that you&#8217;ve de-identified any information or graphic that you want to post!&#8221;<br><\/em><\/li>\n<li><em><b>Check your software: <\/b>&#8220;With the rise of telehealth since the onset of the COVID-19 pandemic, many practices have adopted virtual teleconferencing, email, texting, and private\/direct messaging systems. Not every system is HIPAA compliant in terms of its encryption or other security features, and even fewer systems are compliant with some of the stricter state-level privacy and security regulations. Double-check that the messaging and connection platforms you&#8217;ve adopted are compliant!&#8221;<\/em><\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73ea3d elementor-widget elementor-widget-text-editor\" data-id=\"73ea3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><strong>Dos and don\u2019ts for avoiding HIPAA violations on social media<\/strong><\/h2><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do consider your personal accounts<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">It\u2019s not just about your official social media accounts. Possibly even more critical is what you &#8211; and your staff &#8211; post from your personal accounts. People may feel more relaxed posting on a personal social media account, but that\u2019s often where you run into issues.<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Don\u2019t post \u2018gossip\u2019 online<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">There have been various instances of individuals posting about patient cases in Facebook groups or simply on their news feed. But just because you\u2019re posting in a closed group, your settings are set to \u2018private\u2019, or you don\u2019t name the patient, it doesn\u2019t make it OK.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do always seek consent first\u00a0<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">If a client is delighted with their treatment results, it makes sense that you may want to include photos in your marketing &#8211; on your social media or even on your website. If you want to share photos of a patient then always, always, always seek permission first &#8211; make sure you have written consent before you hit publish.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Don\u2019t respond to comments carelessly<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">This is an interesting one because it highlights that it\u2019s not just about what you post on social media, but also how you respond. For example, a patient may tag you on social media because they\u2019re happy with their treatment, but if you acknowledge that post you could be in breach of HIPAA.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do be careful with reviews\u00a0<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">Be careful about how you respond to online reviews. We mentioned an example above where a practice shared personal information when they responded to reviews. Make sure your team are briefed on how they should and shouldn\u2019t respond to reviews.\u00a0<\/span><\/p><p>\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8679e2 elementor-widget elementor-widget-html\" data-id=\"e8679e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"expert_picks\">\n<div class=\"header\">\n<img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" src=\"https:\/\/pabau.com\/wp-content\/uploads\/2025\/11\/Expert-Picks.svg\" alt=\"Expert Picks\" height=\"42\" width=\"42\">\n<h3>Expert Picks<\/h3>\n<\/div>\n<div class=\"content\">\n<div class=\"item\">\n<div><svg width=\"20\" height=\"27\" viewBox=\"0 0 20 27\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M18.6223 14.3857C19.1246 13.8975 19.1246 13.1045 18.6223 12.6162L12.1938 6.36621C11.6915 5.87793 10.8759 5.87793 10.3737 6.36621C9.87143 6.85449 9.87143 7.64746 10.3737 8.13574L14.6125 12.2529H2.28571C1.57455 12.2529 1 12.8115 1 13.5029C1 14.1943 1.57455 14.7529 2.28571 14.7529H14.6085L10.3777 18.8701C9.87545 19.3584 9.87545 20.1514 10.3777 20.6396C10.8799 21.1279 11.6955 21.1279 12.1978 20.6396L18.6263 14.3896L18.6223 14.3857Z\" fill=\"#54B2D3\"><\/path><\/svg><\/div>\n<p><strong>How can clinics stay HIPAA compliant online?<\/strong> <a href=\"https:\/\/pabau.com\/features\/compliance-management-software\/\">Compliance Management Software<\/a> Helps practices implement safeguards and maintain compliance standards across all business operations including digital channels.<\/p>\n<\/div>\n<div class=\"item\">\n<div><svg width=\"20\" height=\"27\" viewBox=\"0 0 20 27\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M18.6223 14.3857C19.1246 13.8975 19.1246 13.1045 18.6223 12.6162L12.1938 6.36621C11.6915 5.87793 10.8759 5.87793 10.3737 6.36621C9.87143 6.85449 9.87143 7.64746 10.3737 8.13574L14.6125 12.2529H2.28571C1.57455 12.2529 1 12.8115 1 13.5029C1 14.1943 1.57455 14.7529 2.28571 14.7529H14.6085L10.3777 18.8701C9.87545 19.3584 9.87545 20.1514 10.3777 20.6396C10.8799 21.1279 11.6955 21.1279 12.1978 20.6396L18.6263 14.3896L18.6223 14.3857Z\" fill=\"#54B2D3\"><\/path><\/svg><\/div>\n<p><strong>What documentation proves HIPAA compliance efforts?<\/strong> <a href=\"https:\/\/pabau.com\/features\/digital-forms\/\">Digital Forms<\/a> Secure digital forms ensure patient data collection meets HIPAA standards while maintaining audit trails for compliance verification.<\/p>\n<\/div>\n<div class=\"item\">\n<div><svg width=\"20\" height=\"27\" viewBox=\"0 0 20 27\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M18.6223 14.3857C19.1246 13.8975 19.1246 13.1045 18.6223 12.6162L12.1938 6.36621C11.6915 5.87793 10.8759 5.87793 10.3737 6.36621C9.87143 6.85449 9.87143 7.64746 10.3737 8.13574L14.6125 12.2529H2.28571C1.57455 12.2529 1 12.8115 1 13.5029C1 14.1943 1.57455 14.7529 2.28571 14.7529H14.6085L10.3777 18.8701C9.87545 19.3584 9.87545 20.1514 10.3777 20.6396C10.8799 21.1279 11.6955 21.1279 12.1978 20.6396L18.6263 14.3896L18.6223 14.3857Z\" fill=\"#54B2D3\"><\/path><\/svg><\/div>\n<p><strong>Why is HIPAA compliance essential for practices?<\/strong> <a href=\"https:\/\/pabau.com\/hipaa-compliance\/\">HIPAA Compliance<\/a> Comprehensive guide covering HIPAA requirements, implementation strategies, and best practices for protecting patient confidentiality.<\/p>\n<\/div>\n<\/div>\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afd39b4 elementor-widget elementor-widget-text-editor\" data-id=\"afd39b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">How to build a HIPAA-compliant social media presence<\/span><\/h2><p><span style=\"font-weight: 400;\">It\u2019s crucial to educate your teams about what is HIPAA compliant\u2026 and isn\u2019t. Here are five tips to empower your teams so you can feel confident about your social media content.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">1. Establish roles and responsibilities\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">Your social media accounts shouldn\u2019t be a free-for-all where everyone has login details and there\u2019s no clear chain of command. Put someone in charge of your social media accounts, such as your practice manager, and ensure a clear approval process for content.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">2. Create documented processes and policies<\/span><\/h3><p><span style=\"font-weight: 400;\">Documentation is everything. There\u2019s no point in having a social media policy that lives in your head &#8211; if you ever have a breach you need to be able to show that you have policies in place. Detail your policies and processes with examples, channels, and do\u2019s and don\u2019ts. The same rules should cover every outbound channel, including the <a href=\"https:\/\/pabau.com\/features\/email-sms-campaigns\/\" target=\"_blank\" rel=\"noopener\">email and SMS campaigns<\/a> you send to patients.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">3. Ensure your team is fully trained<\/span><\/h3><p><span style=\"font-weight: 400;\">You shouldn\u2019t hand over the keys to your accounts without appropriate training. Make sure you train all new staff and run refresher training sessions at regular intervals so everyone knows what is appropriate and what isn\u2019t &#8211; across professional and personal accounts.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">4. Stay on top of trends and channels\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">There are always new social media channels popping up and so it\u2019s important to update your policies and processes accordingly. While platforms like Tik Tok are often where brands and businesses loosen up on the formality, this can pose a risk. Be ready for that.\u00a0\u00a0\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">5. Always be prepared for audits\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">If you ever require an audit of your social media accounts you need to be prepared. Instead of having to pull data from multiple sources, using a social media management tool, where you\u2019ll be able to track and export your previous posts, will be helpful.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">One last thing<\/span><\/h3><p><span style=\"font-weight: 400;\">So if it doesn\u2019t violate HIPAA then it\u2019s OK, right? It\u2019s not quite as clear-cut as that.\u00a0 <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/>Even if you don&#8217;t directly break HIPAA rules, there\u2019s still a fine line to walk. A social media video might not break federal law, but that still doesn\u2019t mean you should post it.\u00a0<\/span><\/p><p>There\u2019s been a lot of <a href=\"https:\/\/www.entrepreneur.com\/business-news\/tiktok-influencer-doctors-and-nurses-unethical-or\/442929\">discussion<\/a> lately about the ethics of doctors and nurses turned TikTok influencers. While the content can be captivating &#8211; \u201ca new medium of med drama\u201d &#8211; it\u2019s not without controversy. What can be intended to be a playful or comedic post might simply not translate to a wider audience. And that can have potentially serious consequences.<\/p><p><span style=\"font-weight: 400;\">So, even beyond the HIPAA conversation, it\u2019s worth erring on the side of caution. If you\u2019re ever in any doubt about whether to post something or not, sense check it first. If you think it could offend your clients or have a negative impact on your brand, don\u2019t post.<\/span><\/p><h2><span style=\"font-weight: 400;\">The key takeaway\u00a0<\/span><span style=\"font-weight: 400;\"><br \/><\/span><\/h2><p>When it comes to\u00a0<a href=\"https:\/\/pabau.com\/hipaa-compliance\/\" target=\"_blank\" rel=\"noopener\">HIPAA compliance<\/a>, it&#8217;s important to take a holistic approach.<\/p><p>Perhaps because it\u2019s a more informal mode of communication, social media often inadvertently trips people up &#8211; and they post without even realising they may be breaching the regulations. That\u2019s why robust measures are non-negotiable for healthcare businesses.\u00a0<\/p><p><span style=\"font-weight: 400;\">Anything else simply isn\u2019t worth the risk.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4e43dc1 e-flex e-con-boxed e-con e-parent\" data-id=\"4e43dc1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3489b3a elementor-widget elementor-widget-html\" data-id=\"3489b3a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"wp-block-heading\">FAQs<\/h2>\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n<div class=\"schema-faq wp-block-yoast-faq-block\">\n<div class=\"schema-faq-section\" id=\"faq-question-1773925097705\"><strong class=\"schema-faq-question\">What types of patient information are considered protected health information (PHI) that I need to protect on social media?<\/strong> <p class=\"schema-faq-answer\">PHI includes any information relating to a patient's past, present, or future physical or mental health condition, the provision of healthcare to that individual, or payment information for healthcare services. On social media, this means you must be careful not to share patient names, medical conditions, treatment details, appointment information, or any identifiable health-related content, even if shared with good intentions.<\/p> <\/div>\n<div class=\"schema-faq-section\" id=\"faq-question-1773924855631\"><strong class=\"schema-faq-question\">Why is social media a common area where medical practices accidentally violate HIPAA compliance?<\/strong> <p class=\"schema-faq-answer\">While medical businesses typically have strict data security processes in place for other business areas, social media is often where HIPAA compliance gaps occur because practitioners may not realize that privacy protections apply to social platforms. The casual nature of social media can lead to inadvertent sharing of patient information or PHI that would never be disclosed through traditional channels.<\/p> <\/div>\n<div class=\"schema-faq-section\" id=\"faq-question-1773924215069\"><strong class=\"schema-faq-question\">Does HIPAA directly address social media use, and what are the consequences of non-compliance?<\/strong> <p class=\"schema-faq-answer\">Although HIPAA was enacted in 1996 before social media existed and doesn't mention these platforms directly, HIPAA privacy protections still apply to any PHI shared through social channels. Violations can result in substantial fines, potential imprisonment, damage to your professional reputation, and your practice being listed on the HIPAA wall of shame, which is a real public record of violations.<\/p> <\/div>\n<div class=\"schema-faq-section\" id=\"faq-question-1773924400061\"><strong class=\"schema-faq-question\">What should I do if my practice has violated HIPAA on social media?<\/strong> <p class=\"schema-faq-answer\">If a HIPAA violation occurs, it's important to understand how investigations work and what the Office for Civil Rights (OCR) will expect from your practice during the process. The post provides guidance on what to do if you violate HIPAA, including steps to take during investigations and how to work with regulatory authorities to address the breach.<\/p> <\/div>\n<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Let\u2019s talk about HIPAA compliance. It\u2019s one little acronym, one enormous can of worms to get your head around.\u00a0 This blog will drill into one area where medical businesses may inadvertently run into trouble: HIPAA compliance and social media. Because while private practices will typically have stringent processes in place regarding data security and patient [&hellip;]<\/p>\n","protected":false},"author":27,"featured_media":46247,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_linkdex":"88","_yoast_wpseo_content_score":"30","_yoast_wpseo_is_cornerstone":"","_yoast_wpseo_keywordsynonyms":"","_yoast_wpseo_focuskw_text_input":"","_seo_original_html":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"46181\" class=\"elementor elementor-46181\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-73a782f4 e-flex e-con-boxed e-con e-parent\" data-id=\"73a782f4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1c9f9473 elementor-widget elementor-widget-text-editor\" data-id=\"1c9f9473\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Let\u2019s talk about HIPAA compliance.<\/span><\/p><p><span style=\"font-weight: 400;\">It\u2019s one little acronym, one enormous can of worms to get your head around.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">This blog will drill into one area where medical businesses may inadvertently run into trouble: <a href=\"https:\/\/pabau.com\/blog\/hipaa-compliance-simplified-guide\/\">HIPAA compliance<\/a> and social media. Because while private practices will typically have stringent processes in place regarding <a href=\"https:\/\/pabau.com\/blog\/best-practice-tips-for-managing-data-protection\/\">data security and patient confidentiality<\/a> in other areas of the business, social media can sometimes be where things slip through the cracks.<\/span><\/p><p><span style=\"font-weight: 400;\">Today, we\u2019ll walk you through some of the common pitfalls and knowledge gaps that practitioners may experience when it comes to HIPAA compliance and social media.<\/span><\/p><p><span style=\"font-weight: 400;\">Because you 100% do not want to end up breaking the trust of your clients, losing your hard-won reputation that you\u2019ve spent years building, and being slapped with a massive fine. You could even end up on the HIPAA wall of shame &#8211; a real thing, by the way.\u00a0<\/span><\/p><p>And if something does go wrong, it helps to know <a href=\"https:\/\/pabau.com\/blog\/what-to-do-if-you-violate-hipaa\/\" target=\"_blank\" rel=\"noopener\">what to do if you violate HIPAA, <\/a>including how investigations work and what the OCR will expect from your practice.<\/p><p><span style=\"font-weight: 400;\">Here\u2019s our guide to HIPAA compliance and social media.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-209deca8 elementor-widget elementor-widget-text-editor\" data-id=\"209deca8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What is HIPAA compliance?\u00a0<\/h2><p><span style=\"font-weight: 400;\">HIPAA stands for the Health Insurance Portability and Accountability Act. <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\">HIPAA is a law that safeguards personal health information. It ensures that medical providers like doctors and hospitals keep patients\u2019 health details private and only share them with authorized personnel. If someone doesn&#8217;t follow these rules and shares confidential information, they can face serious consequences &#8211; we\u2019re talking big fines and even imprisonment.\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ead9bf3 elementor-widget elementor-widget-text-editor\" data-id=\"4ead9bf3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">What do HIPAA guidelines say about social media?\u00a0<\/span><\/h2><p><span style=\"font-weight: 400;\">That\u2019s a good question. HIPAA guidelines were enacted in 1996. That\u2019s in the very early days of the internet and long before Facebook, Instagram, or Tik Tok were a thing.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">While HIPAA rules don\u2019t mention social media directly, privacy protections regarding personal health information (PHI) apply to &#8211; and can be breached by &#8211; your social media content.\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">Key principles of HIPAA related to social media\u00a0<\/span><\/h2><p><span style=\"font-weight: 400;\">The crux of the matter is PHI: protected health information. According to the <\/span><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#protected\"><span style=\"font-weight: 400;\">US Department of Health and Human Servic<\/span><\/a><span style=\"font-weight: 400;\">e, PHI is any information that relates to an:\u00a0<\/span><i><\/i><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Individual\u2019s past, present, or future physical or mental health or condition<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">The provision of health care to the individual, or<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">The past, present, or future payment for the provision of health care to the individual<\/span><\/i><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><i><span style=\"font-weight: 400;\">Common identifiers such as name, address, birth date, and Social Security Number, when they can be associated with the health information listed above.<\/span><\/i><\/li><\/ul><p><span style=\"font-weight: 400;\">Sharing patients\u2019 protected health information is strictly prohibited and healthcare employees need to be vigilant of potential breaches &#8211; on social media and more broadly.\u00a0 <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1bf44877 elementor-widget elementor-widget-text-editor\" data-id=\"1bf44877\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">Examples of social media mistakes leading to HIPAA breaches<\/span><\/h2><p><span style=\"font-weight: 400;\">There are numerous ways that social media mistakes can lead to HIPAA breaches.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">For example, imagine a hospital employee posting something about a patient they treated at work that day on their personal social media account. You might think it\u2019s OK because the post is generic and they haven\u2019t named the patient. However, the patient may be still identifiable if, say, the employee has the name of the hospital they work at on their profile. <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\">Here are a few other examples of HIPAA breaches on social media:\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sharing photos of the patient without their consent\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Venting about a patient online, even if you don\u2019t identify them<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Responding to comments or reviews and revealing patient information\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sharing patient information in a post without realising <\/span><span style=\"font-weight: 400;\"><br \/><\/span><\/li><\/ul><h3><span style=\"font-weight: 400;\">Consequences of HIPAA breaches on social media<br \/><\/span><\/h3><p><span style=\"font-weight: 400;\">Here are just some examples of HIPAA breaches and the consequences\u2026<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/www.hipaajournal.com\/texas-nurse-fired-for-social-media-hipaa-violation\/\"><span style=\"font-weight: 400;\">nurse at a children\u2019s hospital in Texas <\/span><\/a><span style=\"font-weight: 400;\">was fired after she posted on social media about a child who had a rare case of measles at the hospital she worked at. The nurse was an anti-vaxxer but posted on Facebook about how it was \u201crough\u201d seeing the boy suffering from measles, a disease which would be preventable through vaccination.\u00a0\u00a0<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/www.paubox.com\/blog\/dental-practice-hit-with-social-media-hipaa-violation\"><span style=\"font-weight: 400;\">dental practice<\/span><\/a><span style=\"font-weight: 400;\"> was hit with a HIPAA violation for disclosing PHI on a social media review site. The practice breached HIPAA because of how they responded to reviews on Yelp. While the patients had posted under a Yelp moniker, the responder used full names and also disclosed information about patient visits and insurance.<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">One <\/span><a href=\"https:\/\/www.medpagetoday.com\/special-reports\/exclusives\/102460\"><span style=\"font-weight: 400;\">patient in Michigan was threatened with jail <\/span><\/a><span style=\"font-weight: 400;\">for filming an interaction between another patient and a member of staff in a hospital &#8211; which was documented in a series of videos uploaded to Tik Tok &#8211; an example of a newer platform to be aware of.\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7ac7e591 elementor-widget elementor-widget-text-editor\" data-id=\"7ac7e591\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4><b style=\"color: var( --e-global-color-primary ); font-family: var( --e-global-typography-f89edde-font-family ),Sans-serif; font-size: var( --e-global-typography-f89edde-font-size ); letter-spacing: var( --e-global-typography-f89edde-letter-spacing ); word-spacing: var( --e-global-typography-f89edde-word-spacing ); background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">\ud83d\udca1<\/b><b style=\"color: var( --e-global-color-primary ); font-family: var( --e-global-typography-f89edde-font-family ),Sans-serif; font-size: var( --e-global-typography-f89edde-font-size ); letter-spacing: var( --e-global-typography-f89edde-letter-spacing ); word-spacing: var( --e-global-typography-f89edde-word-spacing ); background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">Did you know?\u00a0<\/b><\/h4><p><span style=\"font-weight: 400;\">It\u2019s not just healthcare businesses that can run into trouble with HIPAA compliance and social media.\u00a0<\/span><span style=\"background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">Meta has had a lawsuit filed against them for violating patient privacy.<\/span><\/p><p><span style=\"font-weight: 400;\">This followed an<\/span><a href=\"https:\/\/www.theverge.com\/2022\/8\/2\/23288612\/meta-hosptials-sued-patient-privacy-facebook-data-hipaa\"><span style=\"font-weight: 400;\"> investigation<\/span><\/a><span style=\"font-weight: 400;\"> which found that 33 of the top 100 hospitals in the US use the Meta Pixel on their website.\u00a0<\/span><span style=\"background-color: var( --e-global-color-42eeb8a ); text-align: var(--text-align);\">At seven hospitals, it was sending confidential patient information to Facebook and the patients were then being served advertisements related to this information.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-21b3f901 e-con-full e-flex e-con e-parent\" data-id=\"21b3f901\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-45f6d5a elementor-widget elementor-widget-author-box\" data-id=\"45f6d5a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.pmalconsulting.com\/\" target=\"_blank\" class=\"elementor-author-box__avatar\">\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/jessica_ellis-wilson_in_black_jacket-1-300x200.jpg\" alt=\"Picture of Jessica Ellis-Wilson, FACMPE\" loading=\"lazy\">\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/www.pmalconsulting.com\/\" target=\"_blank\">\n\t\t\t\t\t\t<h4 class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tJessica Ellis-Wilson, FACMPE\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-author-box__bio\">\n\t\t\t\t\t\t<p>Consultant, trainer, and speaker<br \/>\nPractical Management and Leadership Consulting<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-24a07ea elementor-widget elementor-widget-text-editor\" data-id=\"24a07ea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>\ud83d\udc49<strong><em>As a former HIPAA Privacy Officer, consultant and speaker Jessica Ellis-Wilson, FACMPE, was responsible for both safeguarding protected information and training all employees on best practices for compliance. She shares some of the biggest red flags she sees in clinics regarding HIPAA and social media&#8230;&nbsp;<\/em><\/strong><\/p>\n<p><em>&#8220;The biggest mistake I see is that organizations do not conduct appropriate privacy law training for the people responsible for social media engagement. <\/em><\/p>\n<p><em>&#8220;Whether they&#8217;re using interns, existing staff, or hiring social media or marketing staff specifically &#8211; or outsourcing to social media management companies &#8211; there is often a disconnect regarding these folks&#8217; understanding of HIPAA and other applicable privacy laws and what they <\/em><em>believe to be best practices for marketing and engagement.<\/em><\/p>\n<p><em>&#8220;It&#8217;s great to have a robust social media presence &#8211; it allows for more organic engagement with patients and potential patients, and can be used to educate and inform your audience about important health-related issues in a non-identifiable way. <\/em><\/p>\n<p><em>&#8220;However, it&#8217;s easy to cross the line into impermissible activities. I<\/em><em>f a patient comments or asks a question on one of your social media posts, for example, you have to be certain that answering them does not violate HIPAA or other privacy regulations.<\/em><\/p>\n<p><strong><em>Jessica&#8217;s tips on how NOT to breach HIPAA violations on social media<\/em><\/strong><\/p>\n<ol>\n<li><em><strong>Be careful of photography errors:<\/strong> &#8220;If you&#8217;re posting photos of your office\/employees\/clinicians, obviously you need a photo release if patients are being shown. But it&#8217;s easy to snap a couple pictures of smiling staff, and forget to zoom in on every area of the picture to ensure no patient information is visible!&#8221;<\/em><\/li>\n<li><em><b>Have clear policies you communicate to staff: <\/b>&#8220;Make sure you have clear HIPAA and privacy policies that are communicated to your staff, and be sure that they include things like a cell phone policy, voice and image recording policies, content policies for company and personal social media, etc.&#8221;<\/em><\/li>\n<li><em><b>Don&#8217;t forget personal social media accounts:<\/b> &#8220;An employee who posts a picture of their newly-cleaned desk to their own social media account may be unwittingly violating HIPAA if you can zoom in and read the display on their computer&nbsp;<\/em><em>monitor, or patient information on a sticky note. Double and triple-check that you&#8217;ve de-identified any information or graphic that you want to post!&#8221;<br><\/em><\/li>\n<li><em><b>Check your software: <\/b>&#8220;With the rise of telehealth since the onset of the COVID-19 pandemic, many practices have adopted virtual teleconferencing, email, texting, and private\/direct messaging systems. Not every system is HIPAA compliant in terms of its encryption or other security features, and even fewer systems are compliant with some of the stricter state-level privacy and security regulations. Double-check that the messaging and connection platforms you&#8217;ve adopted are compliant!&#8221;<\/em><\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73ea3d elementor-widget elementor-widget-text-editor\" data-id=\"73ea3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><strong>Dos and don\u2019ts for avoiding HIPAA violations on social media<\/strong><\/h2><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do consider your personal accounts<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">It\u2019s not just about your official social media accounts. Possibly even more critical is what you &#8211; and your staff &#8211; post from your personal accounts. People may feel more relaxed posting on a personal social media account, but that\u2019s often where you run into issues.<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Don\u2019t post \u2018gossip\u2019 online<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">There have been various instances of individuals posting about patient cases in Facebook groups or simply on their news feed. But just because you\u2019re posting in a closed group, your settings are set to \u2018private\u2019, or you don\u2019t name the patient, it doesn\u2019t make it OK.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do always seek consent first\u00a0<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">If a client is delighted with their treatment results, it makes sense that you may want to include photos in your marketing &#8211; on your social media or even on your website. If you want to share photos of a patient then always, always, always seek permission first &#8211; make sure you have written consent before you hit publish.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Don\u2019t respond to comments carelessly<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">This is an interesting one because it highlights that it\u2019s not just about what you post on social media, but also how you respond. For example, a patient may tag you on social media because they\u2019re happy with their treatment, but if you acknowledge that post you could be in breach of HIPAA.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><h3><span style=\"font-weight: 400;\">Do be careful with reviews\u00a0<\/span><\/h3><\/li><\/ul><p><span style=\"font-weight: 400;\">Be careful about how you respond to online reviews. We mentioned an example above where a practice shared personal information when they responded to reviews. Make sure your team are briefed on how they should and shouldn\u2019t respond to reviews.\u00a0<\/span><\/p><p>\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afd39b4 elementor-widget elementor-widget-text-editor\" data-id=\"afd39b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"font-weight: 400;\">How to build a HIPAA-compliant social media presence<\/span><\/h2><p><span style=\"font-weight: 400;\">It\u2019s crucial to educate your teams about what is HIPAA compliant\u2026 and isn\u2019t. Here are five tips to empower your teams so you can feel confident about your social media content.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">1. Establish roles and responsibilities\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">Your social media accounts shouldn\u2019t be a free-for-all where everyone has login details and there\u2019s no clear chain of command. Put someone in charge of your social media accounts, such as your practice manager, and ensure a clear approval process for content.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">2. Create documented processes and policies<\/span><\/h3><p><span style=\"font-weight: 400;\">Documentation is everything. There\u2019s no point in having a social media policy that lives in your head &#8211; if you ever have a breach you need to be able to show that you have policies in place. Detail your policies and processes with examples, channels, and do\u2019s and don\u2019ts.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">3. Ensure your team is fully trained<\/span><\/h3><p><span style=\"font-weight: 400;\">You shouldn\u2019t hand over the keys to your accounts without appropriate training. Make sure you train all new staff and run refresher training sessions at regular intervals so everyone knows what is appropriate and what isn\u2019t &#8211; across professional and personal accounts.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">4. Stay on top of trends and channels\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">There are always new social media channels popping up and so it\u2019s important to update your policies and processes accordingly. While platforms like Tik Tok are often where brands and businesses loosen up on the formality, this can pose a risk. Be ready for that.\u00a0\u00a0\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">5. Always be prepared for audits\u00a0<\/span><\/h3><p><span style=\"font-weight: 400;\">If you ever require an audit of your social media accounts you need to be prepared. Instead of having to pull data from multiple sources, using a social media management tool, where you\u2019ll be able to track and export your previous posts, will be helpful.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">One last thing<\/span><\/h3><p><span style=\"font-weight: 400;\">So if it doesn\u2019t violate HIPAA then it\u2019s OK, right? It\u2019s not quite as clear-cut as that.\u00a0 <\/span><span style=\"font-weight: 400;\"><br \/><\/span><span style=\"font-weight: 400;\"><br \/>Even if you don&#8217;t directly break HIPAA rules, there\u2019s still a fine line to walk. A social media video might not break federal law, but that still doesn\u2019t mean you should post it.\u00a0<\/span><\/p><p>There\u2019s been a lot of <a href=\"https:\/\/www.entrepreneur.com\/business-news\/tiktok-influencer-doctors-and-nurses-unethical-or\/442929\">discussion<\/a> lately about the ethics of doctors and nurses turned TikTok influencers. While the content can be captivating &#8211; \u201ca new medium of med drama\u201d &#8211; it\u2019s not without controversy. What can be intended to be a playful or comedic post might simply not translate to a wider audience. And that can have potentially serious consequences.<\/p><p><span style=\"font-weight: 400;\">So, even beyond the HIPAA conversation, it\u2019s worth erring on the side of caution. If you\u2019re ever in any doubt about whether to post something or not, sense check it first. If you think it could offend your clients or have a negative impact on your brand, don\u2019t post.<\/span><\/p><h2><span style=\"font-weight: 400;\">The key takeaway\u00a0<\/span><span style=\"font-weight: 400;\"><br \/><\/span><\/h2><p>When it comes to\u00a0<a href=\"https:\/\/pabau.com\/hipaa-compliance\/\" target=\"_blank\" rel=\"noopener\">HIPAA compliance<\/a>, it&#8217;s important to take a holistic approach.<\/p><p>Perhaps because it\u2019s a more informal mode of communication, social media often inadvertently trips people up &#8211; and they post without even realising they may be breaching the regulations. That\u2019s why robust measures are non-negotiable for healthcare businesses.\u00a0<\/p><p><span style=\"font-weight: 400;\">Anything else simply isn\u2019t worth the risk.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4e43dc1 e-flex e-con-boxed e-con e-parent\" data-id=\"4e43dc1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","footnotes":""},"categories":[863,32,28],"tags":[382,410,865,1058,1066,1061,864,886],"class_list":["post-46181","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-and-security","category-practice-management-tips","category-starting-a-practice","tag-compliance","tag-hipaa-compliance","tag-patient-data","tag-posts-en-us","tag-posts-only-us","tag-posts-uk","tag-security","tag-social-media"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.2 (Yoast SEO v28.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>HIPAA compliance and social media | Pabau<\/title>\n<meta name=\"description\" content=\"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HIPAA compliance and social media | Pabau\" \/>\n<meta property=\"og:description\" content=\"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/\" \/>\n<meta property=\"og:site_name\" content=\"Pabau\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Pabau\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-15T15:23:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-12T10:03:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"750\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lucy Galloway\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@pabaucrm\" \/>\n<meta name=\"twitter:site\" content=\"@pabaucrm\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lucy Galloway\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minuut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/\"},\"author\":{\"name\":\"Lucy Galloway\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#\\\/schema\\\/person\\\/29d8d8d6615e55bfcbf54421f66673bb\"},\"headline\":\"HIPAA compliance and social media: What you need to know\",\"datePublished\":\"2023-09-15T15:23:09+00:00\",\"dateModified\":\"2026-08-12T10:03:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/\"},\"wordCount\":2451,\"publisher\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png\",\"keywords\":[\"compliance\",\"HIPAA compliance\",\"patient data\",\"posts-en-us\",\"posts-only-us\",\"posts-uk\",\"Security\",\"social media\"],\"articleSection\":[\"Compliance and security\",\"Practice Management Tips\",\"Starting a practice\"],\"inLanguage\":\"nl-NL\"},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/\",\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/\",\"name\":\"HIPAA compliance and social media | Pabau\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png\",\"datePublished\":\"2023-09-15T15:23:09+00:00\",\"dateModified\":\"2026-08-12T10:03:00+00:00\",\"description\":\"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.\",\"mainEntity\":[{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773925097705\"},{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924855631\"},{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924215069\"},{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924400061\"}],\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png\",\"contentUrl\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2023\\\/09\\\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png\",\"width\":750,\"height\":500,\"caption\":\"HIPAA compliance and social media\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#website\",\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/\",\"name\":\"Pabau\",\"description\":\"Clinic Software for your Business | Go Paperless Today\",\"publisher\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/pabau.com\\\/nl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#organization\",\"name\":\"Pabau\",\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/Logo-4-e1654525062364.png\",\"contentUrl\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/Logo-4-e1654525062364.png\",\"width\":736,\"height\":195,\"caption\":\"Pabau\"},\"image\":{\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Pabau\\\/\",\"https:\\\/\\\/x.com\\\/pabaucrm\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/pabau-ltd\\\/\",\"https:\\\/\\\/www.instagram.com\\\/pabausoftware\\\/\"],\"description\":\"Pabau is an all-in-one healthcare practice management software platform designed for clinics, medspas, therapists, and medical professionals. It combines scheduling, electronic health records, clinical forms, payments, marketing automation, reporting, and patient engagement tools into one secure cloud system to help practices streamline operations and grow their business.\",\"foundingDate\":\"2011-10-20\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"201\",\"maxValue\":\"500\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/#\\\/schema\\\/person\\\/29d8d8d6615e55bfcbf54421f66673bb\",\"name\":\"Lucy Galloway\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/cropped-Snip20260222_69-96x96.png\",\"url\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/cropped-Snip20260222_69-96x96.png\",\"contentUrl\":\"https:\\\/\\\/pabau.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/cropped-Snip20260222_69-96x96.png\",\"caption\":\"Lucy Galloway\"},\"description\":\"Lucy is the Head of Content at Pabau, where she leads the strategy, creation, and optimisation of educational resources for healthcare professionals and clinics worldwide. With a strong passion for medical topics and clinical education, she specialises in translating complex healthcare concepts into clear, practical content that supports clinicians in their day-to-day work. Lucy enjoys writing about medical software, patient care workflows, compliance, and emerging trends across medical aesthetics, wellness, and allied health - helping practices stay informed while improving how they operate and deliver care.\",\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/author\\\/lucy-galloway\\\/\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773925097705\",\"position\":1,\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773925097705\",\"name\":\"What types of patient information are considered protected health information (PHI) that I need to protect on social media?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"PHI includes any information relating to a patient's past, present, or future physical or mental health condition, the provision of healthcare to that individual, or payment information for healthcare services. On social media, this means you must be careful not to share patient names, medical conditions, treatment details, appointment information, or any identifiable health-related content, even if shared with good intentions.\",\"inLanguage\":\"nl-NL\"},\"inLanguage\":\"nl-NL\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924855631\",\"position\":2,\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924855631\",\"name\":\"Why is social media a common area where medical practices accidentally violate HIPAA compliance?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"While medical businesses typically have strict data security processes in place for other business areas, social media is often where HIPAA compliance gaps occur because practitioners may not realize that privacy protections apply to social platforms. The casual nature of social media can lead to inadvertent sharing of patient information or PHI that would never be disclosed through traditional channels.\",\"inLanguage\":\"nl-NL\"},\"inLanguage\":\"nl-NL\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924215069\",\"position\":3,\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924215069\",\"name\":\"Does HIPAA directly address social media use, and what are the consequences of non-compliance?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Although HIPAA was enacted in 1996 before social media existed and doesn't mention these platforms directly, HIPAA privacy protections still apply to any PHI shared through social channels. Violations can result in substantial fines, potential imprisonment, damage to your professional reputation, and your practice being listed on the HIPAA wall of shame, which is a real public record of violations.\",\"inLanguage\":\"nl-NL\"},\"inLanguage\":\"nl-NL\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924400061\",\"position\":4,\"url\":\"https:\\\/\\\/pabau.com\\\/nl\\\/blog\\\/hipaa-and-social-media\\\/#faq-question-1773924400061\",\"name\":\"What should I do if my practice has violated HIPAA on social media?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If a HIPAA violation occurs, it's important to understand how investigations work and what the Office for Civil Rights (OCR) will expect from your practice during the process. The post provides guidance on what to do if you violate HIPAA, including steps to take during investigations and how to work with regulatory authorities to address the breach.\",\"inLanguage\":\"nl-NL\"},\"inLanguage\":\"nl-NL\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"HIPAA compliance and social media | Pabau","description":"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/","og_locale":"nl_NL","og_type":"article","og_title":"HIPAA compliance and social media | Pabau","og_description":"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.","og_url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/","og_site_name":"Pabau","article_publisher":"https:\/\/www.facebook.com\/Pabau\/","article_published_time":"2023-09-15T15:23:09+00:00","article_modified_time":"2026-08-12T10:03:00+00:00","og_image":[{"width":750,"height":500,"url":"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png","type":"image\/png"}],"author":"Lucy Galloway","twitter_card":"summary_large_image","twitter_creator":"@pabaucrm","twitter_site":"@pabaucrm","twitter_misc":{"Geschreven door":"Lucy Galloway","Geschatte leestijd":"1 minuut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#article","isPartOf":{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/"},"author":{"name":"Lucy Galloway","@id":"https:\/\/pabau.com\/nl\/#\/schema\/person\/29d8d8d6615e55bfcbf54421f66673bb"},"headline":"HIPAA compliance and social media: What you need to know","datePublished":"2023-09-15T15:23:09+00:00","dateModified":"2026-08-12T10:03:00+00:00","mainEntityOfPage":{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/"},"wordCount":2451,"publisher":{"@id":"https:\/\/pabau.com\/nl\/#organization"},"image":{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#primaryimage"},"thumbnailUrl":"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png","keywords":["compliance","HIPAA compliance","patient data","posts-en-us","posts-only-us","posts-uk","Security","social media"],"articleSection":["Compliance and security","Practice Management Tips","Starting a practice"],"inLanguage":"nl-NL"},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/","url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/","name":"HIPAA compliance and social media | Pabau","isPartOf":{"@id":"https:\/\/pabau.com\/nl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#primaryimage"},"image":{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#primaryimage"},"thumbnailUrl":"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png","datePublished":"2023-09-15T15:23:09+00:00","dateModified":"2026-08-12T10:03:00+00:00","description":"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.","mainEntity":[{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773925097705"},{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924855631"},{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924215069"},{"@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924400061"}],"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/"]}]},{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#primaryimage","url":"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png","contentUrl":"https:\/\/pabau.com\/wp-content\/uploads\/2023\/09\/01_HIPAA-compliance-and-social-media_-What-you-need-to-know_Blog-1.png","width":750,"height":500,"caption":"HIPAA compliance and social media"},{"@type":"WebSite","@id":"https:\/\/pabau.com\/nl\/#website","url":"https:\/\/pabau.com\/nl\/","name":"Pabau","description":"Clinic Software for your Business | Go Paperless Today","publisher":{"@id":"https:\/\/pabau.com\/nl\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pabau.com\/nl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Organization","@id":"https:\/\/pabau.com\/nl\/#organization","name":"Pabau","url":"https:\/\/pabau.com\/nl\/","logo":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/pabau.com\/nl\/#\/schema\/logo\/image\/","url":"https:\/\/pabau.com\/wp-content\/uploads\/2022\/05\/Logo-4-e1654525062364.png","contentUrl":"https:\/\/pabau.com\/wp-content\/uploads\/2022\/05\/Logo-4-e1654525062364.png","width":736,"height":195,"caption":"Pabau"},"image":{"@id":"https:\/\/pabau.com\/nl\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Pabau\/","https:\/\/x.com\/pabaucrm","https:\/\/www.linkedin.com\/company\/pabau-ltd\/","https:\/\/www.instagram.com\/pabausoftware\/"],"description":"Pabau is an all-in-one healthcare practice management software platform designed for clinics, medspas, therapists, and medical professionals. It combines scheduling, electronic health records, clinical forms, payments, marketing automation, reporting, and patient engagement tools into one secure cloud system to help practices streamline operations and grow their business.","foundingDate":"2011-10-20","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"201","maxValue":"500"}},{"@type":"Person","@id":"https:\/\/pabau.com\/nl\/#\/schema\/person\/29d8d8d6615e55bfcbf54421f66673bb","name":"Lucy Galloway","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/pabau.com\/wp-content\/uploads\/2026\/02\/cropped-Snip20260222_69-96x96.png","url":"https:\/\/pabau.com\/wp-content\/uploads\/2026\/02\/cropped-Snip20260222_69-96x96.png","contentUrl":"https:\/\/pabau.com\/wp-content\/uploads\/2026\/02\/cropped-Snip20260222_69-96x96.png","caption":"Lucy Galloway"},"description":"Lucy is the Head of Content at Pabau, where she leads the strategy, creation, and optimisation of educational resources for healthcare professionals and clinics worldwide. With a strong passion for medical topics and clinical education, she specialises in translating complex healthcare concepts into clear, practical content that supports clinicians in their day-to-day work. Lucy enjoys writing about medical software, patient care workflows, compliance, and emerging trends across medical aesthetics, wellness, and allied health - helping practices stay informed while improving how they operate and deliver care.","url":"https:\/\/pabau.com\/nl\/blog\/author\/lucy-galloway\/"},{"@type":"Question","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773925097705","position":1,"url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773925097705","name":"What types of patient information are considered protected health information (PHI) that I need to protect on social media?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"PHI includes any information relating to a patient's past, present, or future physical or mental health condition, the provision of healthcare to that individual, or payment information for healthcare services. On social media, this means you must be careful not to share patient names, medical conditions, treatment details, appointment information, or any identifiable health-related content, even if shared with good intentions.","inLanguage":"nl-NL"},"inLanguage":"nl-NL"},{"@type":"Question","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924855631","position":2,"url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924855631","name":"Why is social media a common area where medical practices accidentally violate HIPAA compliance?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"While medical businesses typically have strict data security processes in place for other business areas, social media is often where HIPAA compliance gaps occur because practitioners may not realize that privacy protections apply to social platforms. The casual nature of social media can lead to inadvertent sharing of patient information or PHI that would never be disclosed through traditional channels.","inLanguage":"nl-NL"},"inLanguage":"nl-NL"},{"@type":"Question","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924215069","position":3,"url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924215069","name":"Does HIPAA directly address social media use, and what are the consequences of non-compliance?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Although HIPAA was enacted in 1996 before social media existed and doesn't mention these platforms directly, HIPAA privacy protections still apply to any PHI shared through social channels. Violations can result in substantial fines, potential imprisonment, damage to your professional reputation, and your practice being listed on the HIPAA wall of shame, which is a real public record of violations.","inLanguage":"nl-NL"},"inLanguage":"nl-NL"},{"@type":"Question","@id":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924400061","position":4,"url":"https:\/\/pabau.com\/nl\/blog\/hipaa-and-social-media\/#faq-question-1773924400061","name":"What should I do if my practice has violated HIPAA on social media?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"If a HIPAA violation occurs, it's important to understand how investigations work and what the Office for Civil Rights (OCR) will expect from your practice during the process. The post provides guidance on what to do if you violate HIPAA, including steps to take during investigations and how to work with regulatory authorities to address the breach.","inLanguage":"nl-NL"},"inLanguage":"nl-NL"}]}},"yoast":{"focus_keyword":"HIPAA compliance and social media","seo_title":"HIPAA compliance and social media | Pabau","meta_description":"We unpack the common pitfalls and knowledge gaps that practitioners may experience in relation to HIPAA compliance and social media.","content_score":"30","is_cornerstone":"","related_keyphrases":[]},"_links":{"self":[{"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/posts\/46181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/comments?post=46181"}],"version-history":[{"count":5,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/posts\/46181\/revisions"}],"predecessor-version":[{"id":176610,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/posts\/46181\/revisions\/176610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/media\/46247"}],"wp:attachment":[{"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/media?parent=46181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/categories?post=46181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pabau.com\/nl\/wp-json\/wp\/v2\/tags?post=46181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}