For people who work in healthcare, navigating the world of social media is a balancing act between a tell-all online culture and the need to protect the privacy of their patients and clients.

And if healthcare practitioners face a greater challenge than many other professionals, those in the behavioral health field may be at the top of the heap. They deal with some of the most sensitive protected health information (PHI), including mental health diagnoses, prescribed medications, and treatments. And behavioral health providers often have a close relationship with their patients or clients, having discussed some of the most private details of their patients’ personal lives.

With their ever-increasing popularity, social media sites such as Facebook and Twitter blur the lines between private and professional identities. Behavioral health professionals must carefully consider their online lives and recognize that they’re navigating a public space that can raise ethical issues and concerns (Mostaghimi A & Crotty BH, Ann Intern Med 2011;154(8):560–562).

Protecting Patient Privacy

Healthcare providers can think about social media in much the same way they would a hospital or clinic elevator, where there’s likely to be a sign posted to remind staff not to discuss patients in public settings where conversations can easily be overheard. Think of social networks as this millennium’s elevator—a public forum where you have little to no control over who hears what you say. Remember the HIPAA privacy rule mandates you protect the PHI of your patients and clients.

Even if you have no intention of doing anything wrong, social media can get you into trouble with violations of patient privacy. Just consider what happened to a Rhode Island physician. The Rhode Island Board of Medical Licensure and Discipline reprimanded her after she recounted some of her emergency department experiences on Facebook. While she didn’t include patient names and didn’t intentionally disclose confidential information, the nature of one patient’s injuries allowed people to ascertain the person’s identity.

She deleted her account when she learned what had occurred. However, the hospital where she worked terminated her in 2011, revoking her emergency department privileges for posting information about a trauma patient online (Conoby C. For doctors, social media a tricky case. Boston Globe. April 20, 2011:B1).

Therefore, you should assume all posted materials are public and exercise care to protect yourself and patient privacy. If you use social media personally, you must be careful that you do not inadvertently expose information about patients or clients. Blogging or posting details of a case may allow people to identify your patient or client.

It’s important that behavioral health professionals maintain separate personal and professional identities online. Be sure to follow standards developed by any healthcare organizations you work for. Several professional societies, including the American College of Physicians, the American Medical Association, and the General Medical Council in the United Kingdom, have recently published guidance for clinicians on the use of social media (Crotty BH & Mostaghimi A, BMJ 2014;348:g2943). They discuss issues such as online clinician identity, professional behavior, and information security.

While it may be tempting to look up social networking profiles of patients to gain additional insights, clients are likely to view this as intrusive.

In addition, you may have professional obligations to contact clients if their posts seem worrisome or suicidal. Given these gray areas, it is likely best to avoid looking in the first place.

Steps to Protect Yourself

All of this doesn’t mean that you shouldn’t use social media sites, but you need to be thoughtful about the content and tone of what you post online. Remember that posts intended for one audience may be embarrassing or inappropriate if seen by another. Here are some recommendations to guide you in your use of social media:

Be smart and professional about how you conduct yourself online. Carefully consider what information you post, and don’t post something you might later regret. Understand that all posted content must be considered public and permanent, regardless of your privacy settings. Information on the Internet is archived and often transmitted from one individual to another. Once something is posted, it’s almost impossible to take back.

Exhibit online behavior that mirrors office behavior standards. For instance, you wouldn’t discuss a patient’s or client’s mental health in a place where others who have no business knowing that information could overhear it.

Manage your professional identity and image. Protect your professional online identity. Monitor your online presence with electronic self-audits. Google yourself or use other search engines to conduct regular audits to learn what information others can see. What personal information do you share online? Do your political affiliations or personal photos appear? Do physician or other healthcare professional rating sites provide your correct name and office address? Who shares your name, and how can that affect how others might mistakenly view you?

Maximize online privacy settings for personal profiles and social networking sites. Separate your personal and professional lives online. Maximize the privacy settings on your personal Facebook page to control access.

Create a professional biography for patients or clients and others who find you via an online preferential search. If you desire an outward, professional presence on social networking sites, such as Facebook, you can create a public persona to better control information. This method also obviates the need to accept or deny friend requests from patients or others. Alternatively, clinicians can use professional social networking sites, such as LinkedIn. Hospitals and clinics can also create behavioral health professional profiles on their websites that can include office hours, contact information, education, and professional experience.

Establish online “dual citizenship” with separate professional/public and personal/private networking profiles. Maintain a professional identity online and a private identity among friends and family by establishing online dual citizenship. Do this by maintaining a separate online profile intended to appear among the top results when someone searches online for a specific healthcare professional. Create a professional homepage, post an online curriculum vitae, or use services such as GoogleProfiles (www.google.com/profiles).

This is particularly advantageous for those entering the healthcare field because new profiles can redirect traffic from other Internet content that may no longer be under their direct control. Create a professional website, a public Facebook page, or a Twitter account specifically for professional purposes.

Use separate passwords for clinical systems and personal web services.

Know what the HIPAA privacy requirements entail. Understand that patient privacy extends to the Internet. Avoid discussing individual cases without patient or client permission. If you want to write about a patient or client online, you can avoid many problems by securing their permission to write about their story in a public forum.

Social media provides an opportunity for healthcare professionals to promote healthy behaviors among patients or clients, such as writing about new health guidelines or advances on their online profiles. But avoid discussion about specific patients and be sure patients understand that such a system is not meant for communication about clinical matters.

Monitor your social media accounts, and if a patient or client posts sensitive information, take that information offline, and follow up with the patient or client privately.

Remember that all patients may not have access to the Internet. Reach out to those patients or clients through traditional means. Not everyone is using social media to communicate.