CMS Mandates Nursing Home Social Media Policy: A Good Idea for HME?

Posted on: in [ CMS, cybersecurity, health care, healthcare, HIPAA, legal, social media policy ]

CMS Mandates Nursing Home Social Media Policy: A Good Idea for HME?

By Dorothy de Souza Guedes, VGM Education

Cybersecurity is top priority for health care companies concerned about hacking that can expose patient information and result in HIPAA violations. But, have you thought about employee use of social media that may expose patients to privacy breaches?

In a memo to state survey agency directors on August 5, the Centers for Medicare and Medicaid Services (CMS) responded to reports of social media violations in nursing homes by mandating that facilities immediately create policies and procedures and train employees to avoid violating patient privacy online.

Although CMS has not mandated social media policies for HMEs, following its guidelines for social media is a good business practice for all health care providers.

Right to Privacy and Confidentiality

CMS’s mandate relates to the nursing home resident’s right to privacy and confidentiality of their body and personal space including accommodations and all aspects of personal care. Taking photos, videos or other recordings of a resident or their personal space without their written consent, or consent of a designated representative, is a violation of those rights. This includes group settings or pictures of personal space when residents are not present.

Residents also have a right not be subjected to verbal and nonverbal mental abuse. Prohibited actions include not sharing photos or recordings of residents on social media sites or through multimedia messages. Depending on what is depicted, investigators may also identify physical or sexual abuse.

In the HME Setting

Think about how this may apply in the HME setting, whether in your showroom or at a customer’s home. Your staff or visitors to your locations may inadvertently violate patient confidentiality by sharing photos or videos online that include patients or their possessions.

But, there is also intentional posting on personal social media pages in which details about interactions with patients are disclosed. Employees have always inappropriately shared patient information: social media is just a new avenue for sharing. It doesn’t matter if the disclosure is sympathetic or in support of the patient, it’s still a violation.

Train employees to understand that social media isn’t private, no matter their privacy settings. If you wouldn’t or shouldn’t put it on a billboard in your front yard, don’t post it on social media.

Read the entire article on the VGM Connect blog.