ICU Social Media & PHI: Protecting
Patients, Protecting You.
Protected Social Media
Health Best
Information Practices
(PHI)
PHI = any data that
Post general
identifies a patient
education; do not
(name, MRN,
post anything on
diagnoses, vitals,
patient stories.
ventilator settings,
Pause before posting
medications, even Privacy, — if it’s patient-
room numbers).
ICU patients are Security & related, don’t share.
Use secure hospital
critically ill and easily Confidentiality systems, not public
identifiable — even
platforms.
small details can
Privacy: This refers to
compromise
the patient’s right to
confidentiality.
decide how their
HIPAA requires that
health information is
PHI must only be
shared.
shared with
Confidentiality: This
authorized staff
refers to the staffs’
directly involved in
professional duty to
patient care.
keep patient
information private.
Security: These are the
safeguards (technical
What NOT to & administrative) that
Do prevent unauthorized
Steps if a
access to PHI.
ICU Risks: Breach
EHRs left open on
Don’t post photos or
computer screens. Occurs
updates about patients.
Don’t share shift Conversations in Report immediately to
experiences that hint at hallways or elevators privacy officer.
patient details. about patients. Remove the post as
Don’t engage in Weak passwords or quickly as possible.
“venting” online — the failing to log out of Document the
context may reveal PHI. devices. incident and follow
Posting social media corrective steps.
posts like “young trauma Learn from the event
in bed 4.” — prevent recurrence
Patients, Protecting You.
Protected Social Media
Health Best
Information Practices
(PHI)
PHI = any data that
Post general
identifies a patient
education; do not
(name, MRN,
post anything on
diagnoses, vitals,
patient stories.
ventilator settings,
Pause before posting
medications, even Privacy, — if it’s patient-
room numbers).
ICU patients are Security & related, don’t share.
Use secure hospital
critically ill and easily Confidentiality systems, not public
identifiable — even
platforms.
small details can
Privacy: This refers to
compromise
the patient’s right to
confidentiality.
decide how their
HIPAA requires that
health information is
PHI must only be
shared.
shared with
Confidentiality: This
authorized staff
refers to the staffs’
directly involved in
professional duty to
patient care.
keep patient
information private.
Security: These are the
safeguards (technical
What NOT to & administrative) that
Do prevent unauthorized
Steps if a
access to PHI.
ICU Risks: Breach
EHRs left open on
Don’t post photos or
computer screens. Occurs
updates about patients.
Don’t share shift Conversations in Report immediately to
experiences that hint at hallways or elevators privacy officer.
patient details. about patients. Remove the post as
Don’t engage in Weak passwords or quickly as possible.
“venting” online — the failing to log out of Document the
context may reveal PHI. devices. incident and follow
Posting social media corrective steps.
posts like “young trauma Learn from the event
in bed 4.” — prevent recurrence
