Q&A: Posting patient photos on social media

Q: My hospital's marketing team is becoming ambitious on social media lately. They like images, of course. What should we know about posting images of patients in social circles as it relates to HIPAA?

A: The HIPAA Privacy Rule considers full-face photographs to be PHI, since they identify individuals. Social media does not fall under the umbrella of healthcare operations which permit PHI sharing. You should obtain written permission from patients before posting pictures of them on your social media sites.

Editor’s note: Question answered by Mary Brandt, a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Heidi Samuelson at hsamuelson@hcpro.com.