Protecting Patient Privacy: Navigating HIPAA in Digital Landscapes

PRESENTED BY
PAUL R. HALES, J.D.
HIPAA COMPLIANCE FOR
WEB SITES & SOCIAL MEDIA
NEW - TRACKING TECHNOLOGIES
AND PATIENT REVIEWS
EDUCATIONAL WEBINAR
1
www.thehipaaetool.com Protecting Patient Privacy is our Job® © 2024 ET&C Group LLC

Health Information – HIPAA
Protecting Patient Privacy is Our Job®
Legal Education – Not Legal Advice
AttorneyHales.com @hipaaetool 314-534-3534
PaulHales@AttorneyHales.com
HIPAA Rules - Web Sites, Social Media & Patient Reviews
PAUL R. HALES
ATTORNEY AT LAW
2

What Are We Going to Cover?
Why is this Important?
HIPAA Rules for Web Sites and Social Media
Web Sites Subject to HIPAA Rules
Covered Entity’s Web Site
Covered Entity’s Social Media Web Site
2 Simple Web Site Safeguards
Major New HIPAA Web Site Liability – Tracking Technologies
How to Avoid Tracking Tech Liability
HIPAA Rules covering Patient Reviews
How Patient Reviews Violate HIPAA
Simple Patient Review Safeguards
3

2024 – OCR HIPAA Compliance Audits
HIPAA Compliance Audits are Back
February 20, 2024
The HHS Office for Civil Rights (OCR) announced HIPAA compliance audits
resume in 2024 in line with a ramped-up enforcement program.
They're Back: HHS OCR Plans to Resurrect Random HIPAA Audits
February 13, 2024
The HIPAA audits - and the planned potential update to the HIPAA security
rule - help round out HHS' evolving strategy to push healthcare sector
entities into implementing stronger cybersecurity programs.
4

FOR IMMEDIATE RELEASE
June 5, 2023
HHS Office for Civil Rights Reaches Agreement with Health Care Provider in
New Jersey That Disclosed Patient Information in Response to Negative
Online Reviews
New Jersey psychiatry practice pays $30,000 to settle complaint about impermissible disclosure of protected
health information by disclosing this information in online review
OCR continues to receive complaints about health care providers disclosing their
patients’ protected health information on social media or on the internet in response
to negative reviews. Simply put, this is not allowed,” said OCR Director Melanie
Fontes Rainer.
“The HIPAA Privacy Rule expressly protects patients from this type of activity, which is
a clear violation of both patient trust and the law. OCR will investigate and take action
when we learn of such impermissible disclosures, no matter how large or small the
organization.”
5

Highly Visible ?
The Internet
Provider Web Sites
Provider Social Media
Patient Reviews
6

Why Protecting PHI Privacy is Essential
Medical Identity Theft – Criminal Black Market
Criminals Attack People of All Ages &
All Walks of Life
• Social Engineering
Clever Scripts & Messages
• Vishing
• Phishing
• Smishing
• Quishing – Malicious QR Codes – FBI
7

XXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXX
XXXXXXXXXXXXXXX
The Hospitals’ Facebook Web Site
Hospitals, both facilities,
provide comprehensive inpatient and outpatient services that serve the larger
Community.
XXXXXXXXXXXXXXXX
Services at include the XXXXXXXXXXX Cancer Center, Breast
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
Health and Women’s Center, the Cardiology Center, and the Outpatient Surgery
and Endoscopy Center.
Services at include general surgery, disease management and
prevention, comprehensive women’s services and a pediatric emergency
department in partnership with .
Compassion - We promise to care about you.
Respect - We promise to treat you with dignity.
“covered entity's customer services or benefits”
Facebook
8
Web Sites subject to HIPAA Rules

9
Safeguard # 2 – Before posting PHI Get a Valid HIPAA Authorization
Facebook Posts by Patients and Others
You'll need to be an admin to control what visitors can post on your Page.
To control what visitors can post on your Page:
• Click Settings at the top of your Page.
• From General, click Visitor Posts.
• Select Allow visitors to the Page to publish posts or Disable posts by
other people on the Page.
If you allow visitors to publish posts, you can choose to:
• Allow photo and video posts
• Review posts by other people before they're published to the Page

Tracking Technologies Background – What is Tracking Technology?
OCR’s Description
Tracking technologies are used to collect and analyze information
about how users interact with regulated entities’ websites or
mobile applications (“apps”).
Key Points
• Tracking Technologies are complex
• There are many types of Tracking Technologies
• Until 2022, Tracking Technology functions and risks were largely
unknown to Health Care Provider senior management and
compliance officials
10

Due Diligence
Careful Audit (Risk Analysis) – All Your Organization’s Web Sites
Identify Tracking Technology Locations
Inclusive, Multi-Specialty Expert Audit Team
• Information Technology and Security
• Privacy/Compliance
• Legal
• Marketing – in house and Marketing Consultants and Vendors
• Senior Management
• Others as necessary and appropriate
11

Due Diligence
Risk Management
Remove all Tracking Technology
Google Analytics & Facebook provide instructions
Develop and implement Policies and Procedures to
• Regularly Monitor Websites, Apps, and locations of Tracking Tech
• Vett (Due Diligence) all vendors
• Web Site Builders
• Patient Engagement Specialists
• Marketing Consultants
• Review Regularly – HIPAA Compliance is a Process
12

In conclusion, we have covered
Why this is Important
HIPAA Rules for Web Sites and Social Media
Web Sites Subject to HIPAA Rules
Covered Entity’s Web Site
Covered Entity’s Social Media Web Site
2 Simple Web Site Safeguards
Major New HIPAA Web Site Liability – Tracking Technologies
HIPAA Rules covering Patient Reviews
How Patient Reviews Violate HIPAA
Simple Patient Review Safeguards
13

Thank You
Paul Hales, J. D.
PaulHales@AttorneyHales.com
314-534-3534
14
Register Now

Protecting Patient Privacy: Navigating HIPAA in Digital Landscapes

Recommended

Recommended

More Related Content

Similar to Protecting Patient Privacy: Navigating HIPAA in Digital Landscapes

Similar to Protecting Patient Privacy: Navigating HIPAA in Digital Landscapes (20)

More from Conference Panel

More from Conference Panel (20)

Recently uploaded

Recently uploaded (20)

Protecting Patient Privacy: Navigating HIPAA in Digital Landscapes