Avoiding Social Media Missteps: Protecting Patient Privacy
Avoiding Social Media Missteps: Protecting Patient Privacy
Purpose
Social media is deeply embedded in everyday life. While it offers opportunities for connection and self-expression, it also presents significant professional and legal risks for healthcare workers. This education material reinforces expectations related to social media use, explains how seemingly minor posts can result in HIPAA violations, and highlights real-world consequences experienced by healthcare professionals and organizations.
Why This Matters
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted to protect the privacy and security of patients’ protected health information (PHI). These requirements apply to all healthcare workforce members, regardless of role, setting, or intent.
Posting about work-related experiences on social media whether out of frustration, humor, or pride can expose patient information and place both the employee and the organization at risk.
• HIPAA violations do not require malicious intent.
• Patient names are not required for information to be considered identifiable.
• Small or vague details, when combined, may allow others to identify a patient.
Violations may result in disciplinary action, termination, loss of professional licensure, civil monetary penalties, and, in extreme cases, criminal prosecution.
Consent Is Required
Specific written authorization from a patient or their legal guardian must be obtained before posting:
• Any patient-related information
• Any images or videos taken in patient care areas
• Any photos where a patient, patient chart, monitor, room number, or other identifying detail is visible
This requirement applies even if the patient’s face is not shown, the patient’s name is not used, or the post is shared in a private group or account.
An exception applies when photographs or recordings are taken strictly for treatment or care-related purposes. This exception is governed by Carilion’s General Consent and Carilion’s Privacy Policy: Photographs, Videos and Recordings, which outlines appropriate use, access, and safeguards for such images.
Failure to obtain written consent can lead to serious consequences for both the individual and the organization.
Real-World Examples and Outcomes
Individual Workforce Consequences
Yazz Scott – Medication Administration on TikTok Live
A nurse recorded herself administering medications during a live TikTok stream, stated a patient’s name, and made a medication error on camera. The incident resulted in immediate termination and loss of her nursing license, along with a Board of Nursing investigation.
Source: Steve Alder, “TikTok Live Incident Results in Termination and Board of Nursing Investigation,” June 2025.
Texas Nurse – Pediatric Measles Case
A nurse in Texas posted multiple social media comments criticizing a pediatric patient with measles. Although the patient was not named, the nurse’s profile identified her employer and referenced a rare condition, making the patient potentially identifiable. The nurse was terminated for an inappropriate disclosure of PHI.
Source: Steve Alder, “Texas Nurse Fired for Social Media HIPAA Violation,” September 13, 2018.
Sierra Samuels – NICU Social Media Photos
A NICU nurse at Jackson Memorial Hospital posted photographs of an infant born with gastroschisis, a rare congenital condition. Despite no malicious intent, the posts violated HIPAA. The nurse was terminated, and the hospital initiated a formal investigation.
Source: Steve Alder, “Jackson Health Investigating Nurse Social Media HIPAA Violation,” September 14, 2021.
Organizational Consequences
Cadia Healthcare Facilities – Delaware
A group of five nursing homes paid $182,000 in HIPAA penalties after posting a patient’s name, photograph, and care-related information on their website and social media without written authorization. The Office for Civil Rights (OCR) intervened following the impermissible disclosures.
Source: Kimberly Marselas, “Nursing Home Chain Pays $182K for HIPAA Violations on Website, Social Media,” October 1, 2025.
Sansum Healthcare – Professional Conduct Case (Non-HIPAA)
Multiple employees were terminated after posting images that appeared to mock patients by photographing bodily fluids left behind in exam rooms. Although the posts did not involve PHI, the reputational harm and perceived lack of professionalism resulted in termination and public scrutiny.
Source: EDHAT Staff, “UPDATE: Sansum Healthcare Employees Fired for Social Media Posts Allegedly Mocking Patients,” September 4, 2025.
Key Takeaways for Carilion Employees
COMMON MISCONCEPTIONS
• “I didn’t use a name, so it’s not a HIPAA violation.”
Patient names are not required for information to be identifiable.
• “My account is private.”
Privacy settings do not eliminate HIPAA risk or professional accountability.
• “The photo was taken for treatment reasons, so I can post it.”
Images taken for treatment purposes may never be shared on social media.
• Never post patient-related information or images without specific written consent
• Do not discuss work-related incidents, conditions, or patient behaviors on social media
• Be mindful of backgrounds when taking photos at work
• Remember that private accounts are not truly private
• When in doubt, do not post
Professional conduct extends beyond the workplace and into online spaces.
STOP & THINK: SOCIAL MEDIA DECISION AID
Before posting anything related to work, ask yourself:
1. Does this include a patient, patient story, image, diagnosis, or event?
2. Could someone identify the patient based on details, timing, or context?
3. Was this photo, video, or information created only for treatment or care purposes?
4. Do I have written patient authorization to share this publicly?
5. Would I be comfortable explaining this post to my leader, Privacy, or HHS/OCR?
If the answer to ANY of these questions raises doubt — do not post.
