Corporate Compliance

Q&A: Patient stories on the internet

Compliance Monitor, May 25, 2011

Q: I've been struggling with HIPAA authorization requirements regarding website postings of patients' healthcare stories. If patients voluntarily post their stories on our Facebook or other social media sites, can we use those stories in other media, such as fundraising brochures, without obtaining specific authorization?


A: No. Even though patients sometimes post their stories on an organization's social media website, you should not use these stories for other ¬purposes without the patient's written authorization. Patients may be willing to share their stories publicly, but they may not want them used for other purposes, such as fundraising.

Mary D. Brandt, MBA, RHIA, CHE, CHPS, a nationally recognized expert on patient privacy, information security, and regulatory compliance, answered this question for the Briefings on HIPAA newsletter. Advice given is general. Readers should consult professional counsel for specific legal, ethical, or clinical questions.

Most Popular