Which of the following constitutes a HIPAA social media violation?

Which of the following constitutes a HIPAA social media violation?

• A. Posting a general health tip
• B. Any patient information, describing unique cases, photos, confirming someone is a patient
• C. Sharing de-identified data in a research context
• D. Anonymized case study

Answer: (B)

Protecting patient privacy on social media is the main idea. Sharing information that could identify a patient or confirm their status violates HIPAA. Describing a unique or distinctive case, posting a photo of a patient, or stating that someone is a patient discloses protected health information and breaches confidentiality. In contrast, general health tips that don’t reference any individual are allowed, and data that has been de-identified for research is permissible because identifiers have been removed. Anonymized case material is acceptable only if all identifying details are removed so the person cannot be identified. So the action that constitutes a HIPAA violation is sharing patient information that identifies the patient or confirms their status. If you ever share information, ensure it’s de-identified or obtained with clear consent and adheres to the minimum necessary standard.

Protecting patient privacy on social media is the main idea. Sharing information that could identify a patient or confirm their status violates HIPAA. Describing a unique or distinctive case, posting a photo of a patient, or stating that someone is a patient discloses protected health information and breaches confidentiality. In contrast, general health tips that don’t reference any individual are allowed, and data that has been de-identified for research is permissible because identifiers have been removed. Anonymized case material is acceptable only if all identifying details are removed so the person cannot be identified. So the action that constitutes a HIPAA violation is sharing patient information that identifies the patient or confirms their status. If you ever share information, ensure it’s de-identified or obtained with clear consent and adheres to the minimum necessary standard.