Arizona Board of Nursing — Edition 30
Change Language:
White Paper: A Nurse’s Guide to the Use of Social Media

The use of social media and other electronic communication is increasing exponentially with growing numbers of social media outlets, platforms and applications, including blogs, social networking sites, video sites, and online chat rooms and forums. Nurses often use electronic media both personally and professionally. Instances of inappropriate use of electronic media by nurses have been reported to boards of nursing (BONs) and, in some cases, reported in nursing literature and the media. This document is intended to provide guidance to nurses using electronic media in a manner that maintains patient privacy and confidentiality.

Social media can benefit health care in a variety of ways, including fostering professional connections, promoting timely communication with patients and family members, and educating and informing consumers and health care professionals.

Nurses are increasingly using blogs, forums and social networking sites to share workplace experiences particularly events that have been challenging or emotionally charged. These outlets provide a venue for the nurse to express his or her feelings, and reflect or seek support from friends, colleagues, peers or virtually anyone on the Internet. Journaling and reflective practice have been identified as effective tools in nursing practice. The Internet provides an alternative media for nurses to engage in these helpful activities. Without a sense of caution, however, these understandable needs and potential benefits may result in the nurse disclosing too much information and violating patient privacy and confidentiality.

Health care organizations that utilize electronic and social media typically have policies governing employee use of such media in the workplace. Components of such policies often address personal use of employer computers and equipment, and personal computing during work hours. The policies may address types of websites that may or may not be accessed from employer computers. Health care organizations also maintain careful control of websites maintained by or associated with the organization, limiting what may be posted to the site and by whom.

The employer’s policies, however, typically do not address the nurse’s use of social media outside of the workplace. It is in this context that the nurse may face potentially serious consequences for inappropriate use of social media.

Confidentiality and Privacy
To understand the limits of appropriate use of social media, it is important to have an understanding of confidentiality and privacy in the health care context. Confidentiality and privacy are related, but distinct concepts. Any patient information learned by the nurse during the course of treatment must be safeguarded by that nurse. Such information may only be disclosed to other members of the health care team for health care purposes. Confidential information should be shared only with the patient’s informed consent, when legally required or where failure to disclose the information could result in significant harm. Beyond these very limited exceptions the nurse’s obligation to safeguard such confidential information is universal.

Privacy relates to the patient’s expectation and right to be treated with dignity and respect. Effective nurse-patient relationships are built on trust. The patient needs to be confident that their most personal information and their basic dignity will be protected by the nurse. Patients will be hesitant to disclose personal information if they fear it will be disseminated beyond those who have a legitimate “need to know.” Any breach of this trust, even inadvertent, damages the particular nurse-patient relationship and the general trustworthiness of the profession of nursing.

Federal law reinforces and further defines privacy through the Health Insurance Portability and Accountability Act (HIPAA). HIPAA regulations are intended to protect patient privacy by defining individually identifiable information and establishing how this information may be used, by whom and under what circumstances. The definition of individually identifiable information includes any information that relates to the past, present or future physical or mental health of an individual, or provides enough information that leads someone to believe the information could be used to identify an individual.

Breaches of patient confidentiality or privacy can be intentional or inadvertent and can occur in a variety of ways. Nurses may breach confidentiality or privacy with information he or she posts via social media. Examples may include comments on social networking sites in which a patient is described with sufficient detail to be identified, referring to patients in a degrading or demeaning manner, or posting video or photos of patients. Additional examples are included at the end of this document.

Possible Consequences
Potential consequences for inappropriate use of social and electronic media by a nurse are varied. The potential consequences will depend, in part, on the particular nature of the nurse’s conduct.

BON Implications
Instances of inappropriate use of social and electronic media may be reported to the BON. The laws outlining the basis for disciplinary action by a BON vary between jurisdictions. Depending on the laws of a jurisdiction, a BON may investigate reports of inappropriate disclosures on social media by a nurse on the grounds of:

• Unprofessional conduct;
• Unethical conduct;
• Moral turpitude;
• Mismanagement of patient records;
• Revealing a privileged communication; and
• Breach of confidentiality.

If the allegations are found to be true, the nurse may face disciplinary action by the BON, including a reprimand or sanction, assessment of a monetary fine, or temporary or permanent loss of licensure.

A 2010 survey of BONs conducted by NCSBN indicated an overwhelming majority of responding BONs (33 of the 46 respondents) reported receiving complaints of nurses who have violated patient privacy by posting photos or information about patients on social networking sites. The majority (26 of the 33) of BONs reported taking disciplinary actions based on these complaints. Actions taken by the BONs included censure of the nurse, issuing a letter of concern, placing conditions on the nurse's license or suspension of the nurse's license.

Other Consequences
Improper use of social media by nurses may violate state and federal laws established to protect patient privacy and confidentiality. Such violations may result in both civil and criminal penalties, including fines and possible jail time. A nurse may face personal liability. The nurse may be individually sued for defamation, invasion of privacy or harassment. Particularly flagrant misconduct on social media websites may also raise liability under state or federal regulations focused on preventing patient abuse or exploitation.

If the nurse's conduct violates the policies of the employer, the nurse may face employment consequences, including termination. Additionally, the actions of the nurse may damage the reputation of the health care organization, or subject the organization to a law suit or regulatory consequences.

Another concern with the misuse of social media is its effect on team-based patient care. Online comments by a nurse regarding co-workers, even if posted from home during nonwork hours, may constitute as lateral violence. Lateral violence is receiving greater attention as more is learned about its impact on patient safety and quality clinical outcomes. Lateral violence includes disruptive behaviors of intimidation and bullying, which may be perpetuated in person or via the Internet, sometimes referred to as "cyber bullying." Such activity is cause for concern for current and future employers and regulators because of the patient- safety ramifications. The line between speech protected by labor laws, the First Amendment and the ability of an employer to impose expectations on employees outside of work is still being determined. Nonetheless, such comments can be detrimental to a cohesive health care delivery team and may result in sanctions against the nurse.

Common Myths and Misunderstandings of Social Media
While instances of intentional or malicious misuse of social media have occurred, in most cases, the inappropriate disclosure or posting is unintentional. A number of factors may contribute to a nurse inadvertently violating patient privacy and confidentiality while using social media. These may include:

• A mistaken belief that the communication or post is private and accessible only to the intended recipient. The nurse may fail to recognize that content once posted or sent can be disseminated to others. In fact, the terms of using a social media site may include an extremely broad waiver of rights to limit use of content.1 The solitary use of the Internet, even while posting to a social media site, can create an illusion of privacy.
• A mistaken belief that content that has been deleted from a site is no longer accessible.
• A mistaken belief that it is harmless if private information about patients is disclosed if the communication is accessed only by the intended recipient. This is still a breach of confidentiality.
• A mistaken belief that it is acceptable to discuss or refer to patients if they are not identified by name, but referred to by a nickname, room number, diagnosis or condition. This too is a breach of confidentiality and demonstrates disrespect for patient privacy.
• Confusion between a patient's right to disclose personal information about himself/herself (or a health care organization's right to disclose otherwise protected information with a patient's consent) and the need for health care providers to refrain from disclosing patient information without a care-related need for the disclosure.
• The ease of posting and commonplace nature of sharing information via social media may appear to blur the line between one's personal and professional lives. The quick, easy and efficient technology enabling use of social media reduces the amount of time it takes to post content and simultaneously, the time to consider whether the post is appropriate and the ramifications of inappropriate content.

How to Avoid Problems
It is important to recognize that instances of inappropriate use of social media can and do occur, but with awareness and caution, nurses can avoid inadvertently disclosing confidential or private information about patients.

The following guidelines are intended to minimize the risks of using social media:

• First and foremost, nurses must recognize that they have an ethical and legal obligation to maintain patient privacy and confidentiality at all times.
• Nurses are strictly prohibited from transmitting by way of any electronic media any patient-related image. In addition, nurses are restricted from transmitting any information that may be reasonably anticipated to violate patient rights to confidentiality or privacy, or otherwise degrade or embarrass the patient.
• Do not share, post or otherwise disseminate any information, including images, about a patient or information gained in the nurse-patient relationship with anyone unless there is a patient care related need to disclose the information or other legal obligation to do so.
• Do not identify patients by name or post or publish information that may lead to the identification of a patient. Limiting access to postings through privacy settings is not sufficient to ensure privacy.
• Do not refer to patients in a disparaging manner, even if the patient is not identified.
• Do not take photos or videos of patients on personal devices, including cell phones. Follow employer policies for taking photographs or video of patients for treatment or other legitimate purposes using employer-provided devices.
• Maintain professional boundaries in the use of electronic media. Like in-person relationships, the nurse has the obligation to establish, communicate and enforce professional boundaries with patients in the online environment. Use caution when having online social contact with patients or former patients. Online contact with patients or former patients blurs the distinction between a professional and personal relationship. The fact that a patient may initiate contact with the nurse does not permit the nurse to engage in a personal relationship with the patient.
• Consult employer policies or an appropriate leader within the organization for guidance regarding work related postings.
• Promptly report any identified breach of confidentiality or privacy.
• Be aware of and comply with employer policies regarding use of employer-owned computers, cameras and other electronic devices and use of personal devices in the work place.
• Do not make disparaging remarks about employers or co-workers. Do not make threatening, harassing, profane, obscene, sexually explicit, racially derogatory, homophobic or other offensive comments.
• Do not post content or otherwise speak on behalf of the employer unless authorized to do so and follow all applicable policies of the employer.

Social and electronic media possess tremendous potential for strengthening personal relationships and providing valuable information to health care consumers. Nurses need to be aware of the potential ramifications of disclosing patient-related information via social media. Nurses should be mindful of employer policies, relevant state and federal laws, and professional standards regarding patient privacy and confidentiality and its application to social and electronic media. By being careful and conscientious, nurses may enjoy the personal and professional benefits of social and electronic media without violating patient privacy and confidentiality.

Illustrative Cases
The following cases, based on events reported to BONs, depict inappropriate uses of social and electronic media. The outcomes will vary from jurisdiction to jurisdiction.

Bob, a licensed practical/vocational (LPN/VN) nurse with 20 years of experience used his personal cell phone to take photos of a resident in the group home where he worked. Prior to taking the photo, Bob asked the resident's brother if it was okay for him to take the photo. The brother agreed. The resident was unable to give consent due to her mental and physical condition. That evening, Bob saw a former employee of the group home at a local bar and showed him the photo. Bob also discussed the resident's condition with the former coworker. The administrator of the group home learned of Bob's actions and terminated his employment. The matter was also reported to the BON. Bob told the BON he thought it was acceptable for him to take the resident's photo because he had the consent of a family member. He also thought it was acceptable for him to discuss the resident's condition because the former employee was now employed at another facility within the company and had worked with the resident. The nurse acknowledged he had no legitimate purpose for taking or showing the photo or discussing the resident's condition. The BON imposed disciplinary action on Bob's license requiring him to complete continuing education on patient privacy and confidentiality, ethics and professional boundaries.

This case demonstrates the need to obtain valid consent before taking photographs of patients; the impropriety of using a personal device to take a patient's photo; and that confidential information should not be disclosed to persons no longer involved in the care of a patient.

Sally, a nurse employed at a large long-term care facility arrived at work one morning and found a strange email on her laptop. She could not tell the source of the email, only that it was sent during the previous nightshift. Attached to the email was a photo of what appeared to be an elderly female wearing a gown with an exposed backside bending over near her bed. Sally asked the other dayshift staff about the email/photo and some confirmed they had received the same photo on their office computers. Nobody knew anything about the source of the email or the identity of the woman, although the background appeared to be a resident's room at the facility. In an effort to find out whether any of the staff knew anything about the email, Sally forwarded it to the computers and cell phones of several staff members who said they had not received it. Some staff discussed the photo with an air of concern, but others were laughing about it as they found it amusing. Somebody on staff started an office betting pool to guess the identity of the resident. At least one staff member posted the photo on her blog.

Although no staff member had bothered to bring it to the attention of a supervisor, by midday, the director of nursing and facility management had become aware of the photo and began an investigation as they were very concerned about the patient's rights. The local media also became aware of the matter and law enforcement was called to investigate whether any crimes involving sexual exploitation had been committed.

While the county prosecutor, after reviewing the police report, declined to prosecute, the story was heavily covered by local media and even made the national news. The facility's management placed several staff members on administrative leave while they looked into violations of facility rules that emphasize patient rights, dignity and protection. Management reported the matter to the BON, which opened investigations to determine whether state or federal regulations against "exploitation of vulnerable adults" were violated. Although the originator of the photo was never discovered, nursing staff also faced potential liability for their willingness to electronically share the photo within and outside the facility, thus exacerbating the patient privacy violations, while at the same time, failing to bring it to management's attention in accordance with facility policies and procedures. The patient in the photo was ultimately identified and her family threatened to sue the facility and all the staff involved. The BON's complaint is pending and this matter was referred to the agency that oversees long-term care agencies.

This scenario shows how important it is for nurses to carefully consider their actions. The nurses had a duty to immediately report the incident to their supervisor to protect patient privacy and maintain professionalism. Instead, the situation escalated to involving the BON, the county prosecutor and even the national media. Since the patient was ultimately identified, the family was embarrassed and the organization faced possible legal consequences. The organization was also embarrassed because of the national media focus.

A 20-year-old junior nursing student, Emily, was excited to be in her pediatrics rotation. She had always wanted to be a pediatric nurse. Emily was caring for Tommy, a three-year-old patient in a major academic medical center's pediatric unit. Tommy was receiving chemotherapy for leukemia. He was a happy little guy who was doing quite well and Emily enjoyed caring for him. Emily knew he would likely be going home soon, so when his mom went to the cafeteria for a cup of coffee, Emily asked him if he minded if she took his picture. Tommy, a little "ham," consented immediately. Emily took his picture with her cell phone as she wheeled him into his room because she wanted to remember his room number.

When Emily got home that day she excitedly posted Tommy's photo on her Facebook page so her fellow nursing students could see how lucky she was to be caring for such a cute little patient. Along with the photo, she commented, "This is my 3-year-old leukemia patient who is bravely receiving chemotherapy. I watched the nurse administer his chemotherapy today and it made me so proud to be a nurse." In the photo, Room 324 of the pediatric unit was easily visible.

Three days later, the dean of the nursing program called Emily into her office. A nurse from the hospital was browsing Facebook and found the photo Emily posted of Tommy. She reported it to hospital officials who promptly called the nursing program. While Emily never intended to breach the patient's confidentiality, it didn't matter. Not only was the patient's privacy compromised, but the hospital faced a HIPAA violation. People were able to identify Tommy as a "cancer patient," and the hospital was identified as well. The nursing program had a policy about breaching patient confidentiality and HIPAA violations. Following a hearing with the student, school officials and the student's professor, Emily was expelled from the program. The nursing program was barred from using the pediatric unit for their students, which was very problematic because clinical sites for acute pediatrics are difficult to find. The hospital contacted federal officials about the HIPAA violation and began to institute more strict policies about use of cell phones at the hospital.

This scenario highlights several points. First of all, even if the student had deleted the photo, it is still available. Therefore, it would still be discoverable in a court of law. Anything that exists on a server is there forever and could be resurrected later, even after deletion. Further, someone can access Facebook, take a screen shot and post it on a public website.

Secondly, this scenario elucidates confidentiality and privacy breaches, which not only violate HIPAA and the nurse practice act in that state, but also could put the student, hospital and nursing program at risk for a lawsuit. It is clear in this situation that the student was well-intended, and yet the post was still inappropriate. While the patient was not identified by name, he and the hospital were still readily identifiable.

A BON received a complaint that a nurse had blogged on a local newspaper's online chat room. The complaint noted that the nurse bragged about taking care of her "little handicapper." Because they lived in a small town, the complainant could identify the nurse and the patient. The complainant stated that the nurse was violating "privacy laws" of the child and his family. It was also discovered that there appeared to be debate between the complainant and the nurse on the blog over local issues. These debates and disagreements resulted in the other blogger filing a complaint about the nurse.

A check of the newspaper website confirmed that the nurse appeared to write affectionately about the handicapped child for whom she provided care. In addition to making notes about her "little handicapper," there were comments about a wheelchair and the child's age. The comments were not meant to be offensive, but did provide personal information about the patient. There was no specific identifying information found on the blog about the patient, but if you knew the nurse, the patient or the patient's family, it would be possible to identify who was being discussed.

The board investigator contacted the nurse about the issue. The nurse admitted she is a frequent blogger on the local newspaper site; she explained that she does not have a television and blogging is what she does for entertainment. The investigator discussed that as a nurse, she must be careful not to provide any information about her home care patients in a public forum.

The BON could have taken disciplinary action for the nurse failing to maintain the confidentiality of patient information. The BON decided a warning was sufficient and sent the nurse a letter advising her that further evidence of the release of personal information about patients will result in disciplinary action.

This scenario illustrates that nurses need to be careful not to mention work issues in their private use of websites, including posting on blogs, discussion boards, etc. The site used by the nurse was not specifically associated with her like a personal blog is; nonetheless the nurse posted sufficient information to identify herself and the patient.

Nursing students at a local college had organized a group on Facebook that allowed the student nurses' association to post announcements and where students could frequently blog, sharing day-to-day study tips and arranging study groups. A student- related clinical error occurred in a local facility and the student was dismissed from clinical for the day pending an evaluation of the error. That evening, the students blogged about the error, perceived fairness and unfairness of the discipline, and projected the student's future. The clinical error was described, and since the college only utilized two facilities for clinical experiences, it was easy to discern where the error took place.

The page and blog could be accessed by friends of the students, as well as the general public.

The students in this scenario could face possible expulsion and discipline. These blogs can be accessed by the public and the patient could be identified because this is a small community. It is a myth that it can only be accessed by that small group, and as in Scenario 3, once posted, the information is available forever. Additionally, information can be quickly spread to a wide audience, so someone could have taken a screen shot of the situation and posted it on a public site. This is a violation of employee/ university policies.

Chris Smith, the brother of nursing home resident Edward Smith, submitted a complaint to the BON. Chris was at a party when his friend, John, picked up his wife's phone to read her a text message. The message noted that she was to "get a drug screen for resident Edward Smith." The people at the party who heard the orders were immediately aware that Edward Smith was the quadriplegic brother of Chris. Chris did not want to get the nurse in trouble, but was angered that personal information about his brother's medical information was released in front of others.

The BON opened an investigation and learned that the physician had been texting orders to the personal phone number of nurses at the nursing home. This saved time because the nurses would get the orders directly and the physician would not have to dictate orders by phone. The use of cell phones also provided the ability for nurses to get orders while they worked with other residents. The practice was widely known within the facility, but was not the approved method of communicating orders.

The BON learned that on the night of the party, the nurse had left the facility early. A couple hours prior to leaving her shift she had called the physician for new orders for Edward Smith. She passed this information onto the nurse who relieved her. She explained that the physician must not have gotten a text from her co-worker before he texted her the orders.

The BON contacted the nursing home and spoke to the director of nursing. The BON indicated that if the physician wanted to use cell phones to text orders, he or the facility would need to provide a dedicated cell phone to staff. The cell phone could remain in a secured, private area at the nursing home or with the nurse during her shift.

The BON issued a warning to the nurse. In addition, the case information was passed along to the health board and medical board to follow up with the facility and physician.

This scenario illustrates the need for nurses to question practices that may result in violations of confidentiality and privacy. Nurse managers should be aware of these situations and take steps to minimize such risks.

Jamie has been a nurse for 12 years, working in hospice for the last six years. One of Jamie's current patients, Maria, maintained a hospital-sponsored communication page to keep friends and family updated on her battle with cancer. Jamie periodically read Maria's postings, but had never left any online comments. One day, Maria posted about her depression and difficulty finding an effective combination of medications to relieve her pain without unbearable side effects. Jamie knew Maria had been struggling and wanted to provide support, so she wrote a comment in response to the post, stating, "I know the last week has been difficult. Hopefully the new happy pill will help, along with the increased dose of morphine. I will see you on Wednesday." The site automatically listed the user's name with each comment. The next day, Jamie was shopping at the local grocery store when a friend stopped her and said, "I didn't know you were taking care of Maria. I saw your message to her on the communication page. I can tell you really care about her and I am glad she has you. She's an old family friend, you know. We've been praying for her but it doesn't look like a miracle is going to happen. How long do you think she has left?" Jamie was instantly horrified to realize her expression of concern on the webpage had been an inappropriate disclosure. She thanked her friend for being concerned, but said she couldn't discuss Maria's condition. She immediately went home and attempted to remove her comments, but that wasn't possible. Further, others could have copied and pasted the comments elsewhere.

At her next visit with Maria, Jamie explained what had happened and apologized for her actions. Maria accepted the apology, but asked Jamie not to post any further comments. Jamie self- reported to the BON and is awaiting the BON's decision.

This scenario emphasizes the importance for nurses to carefully consider the implications of posting any information about patients on any type of website. While this website was hospital sponsored, it was available to friends and family. In some contexts it is appropriate for a nurse to communicate empathy and support for patients, but they should be cautious not to disclose private information, such as types of medications the patient is taking.