Outdated Web Policies Expose Hospitals to Professional and Legal Trouble

Social networking Web sites and modern communication media, such as text messaging, e-mail, and smartphones, are a part of our daily lives. Although such technologies have a place in society, they are taking a toll on the professional image of tomorrow's physicians.

In fact, 60% of medical schools that responded to a recent survey reported incidents of students posting unprofessional content online, according to a study published this month in the Journal of the American Medical Association. Medical schools also reported finding frequent references to intoxication (39%) and sexually suggestive material (38%).

Medical students are not the only Gen Xers or Yers divulging too much information online. A 2008 study in the Journal of General Internal Medicine found that residents are also posting information that they may not have otherwise shared with patients.

Medical educators can address these issues with students and residents using institutional policies or codes of conduct to help guide the discussion. However, these discussions often aren't as strong as they could be because many institutional policies regarding appropriate online behavior are outdated or inadequate, says Nancy Spector, MD, associate pediatric residency program director at St. Christopher's Hospital for Children in Philadelphia.

Most policies are stuck in the early 2000s and only cover e-mail and Internet usage. They neglect to address smartphones or text messaging, which leaves many gray areas.

For example, is it appropriate for residents to use their smartphones to find an answer to patients' questions in front of the patient? Or is it OK for them to look up an answer to a question during an educational session? Appropriate etiquette for such situations is largely undefined.

Consider updating your policies for all hospital employees. When creating guidelines for cell phones, professional e-mails, and smartphones, focus on basic etiquette. Consider specifically delineating when it is or is not appropriate to:

• Answer a cell phone or check voice mails
• Send or check text messages
• Send or respond to e-mails on smartphones
• Use the Web browser feature on smartphones

Outline the kinds of Web sites that are appropriate to access from work computers. This may be specified in an institutional policy, so check to make sure your guidelines align, Spector says.

Other than patient information protected under HIPAA, you can't dictate the content that residents post on their blogs or social networking profiles. You can only help them understand how personal postings can affect them professionally.

HIPAA is another concern hospitals should address in their online policies and in any e-professionalism training.

Residents, faculty, or program managers who blog need to be sure they do not engage in unauthorized disclosure of protected health information in their posts, says Reece Hirsch, Esq., of Sonnenschein Nath & Rosenthal, LLP, in San Francisco. Doing so is a HIPAA violation.

The danger for hospitals is when healthcare workers think they're doing enough to generalize the patient's information in their online post, but they're really not, Hirsch says. Patient data must be de-identified before it can be posted online. The JAMA study reports that 13% of medical schools found violations of patient information on medical students' online pages.

Reviewing HIPAA in the context of blogs, Twitter, Facebook, and MySpace is a must to protecting yourself from legal liabilities.

Also keep in mind that Web 2.0 fads will fade as soon as Web 3.0 is invented. Try to keep up with what's hot—you don't want your presentation to be dated. This is easier said than done, says Spector. "Technology moves so fast, and we've always been behind in knowing what's coming and the potential misuses residents and medical students may find," she says.