Social media HIPAA violations: examples, rules and a staff policy

What makes a social post a HIPAA violation

HIPAA protects "individually identifiable health information." Under 45 CFR 160.103 (opens in a new tab), that includes information relating to "the provision of health care to an individual" that identifies the person, or where "there is a reasonable basis to believe the information can be used to identify the individual."

Read that slowly and the social media problem is obvious. You don't need to post a diagnosis. A photo of a recognizable person in your treatment room says they were your patient, which relates to the provision of health care, so the post is a disclosure of PHI.

Disclosing PHI for a promotional purpose is marketing, and marketing uses of PHI need the patient's signed authorization under 45 CFR 164.508(a)(3) (opens in a new tab). Without one, the post is an impermissible disclosure. The full picture of what counts as marketing is in our guide to HIPAA marketing rules.

The common mistakes: photos, check-ins, replies and 'anonymous' stories

Patient photos. Faces are the obvious problem. The Safe Harbor list in 45 CFR 164.514(b)(2) (opens in a new tab) names "full-face photographs and any comparable images," and also "any other unique identifying number, characteristic, or code." A distinctive tattoo, a birthmark or a voice in a video can identify a patient without a face.

Backgrounds. A team photo in the front office can catch the appointment board, a monitor showing the schedule, a chart on the counter or a patient in the waiting room. Zoom in on every photo before posting.

Check-ins and tags. Tagging a patient, or reposting their check-in at your office, confirms the visit. So does a "welcome to the practice" post naming a new patient.

"Anonymous" stories. "A local high-school coach came in last week with a torn ACL" names no one, but in a town of 4,000 everyone knows who it is. The test is whether there's a reasonable basis to identify the person, not whether you typed a name. See the 18 HIPAA identifiers for the full list.

Retargeting followers. Building ad audiences from people who engaged with condition-specific posts or visited service pages raises separate problems, covered in remarketing and HIPAA.

Responding to reviews and comments without confirming someone is a patient

A public reply that confirms the reviewer is your patient discloses PHI, even when the reviewer posted first. They chose to share their own story; your practice has not been authorized to share anything. Replying with details of their visit, their treatment or their bill adds more PHI to the disclosure.

The compliant reply works for any reviewer, patient or not, which is the point. It's worth posting because readers judge practices by how they respond, and a calm, generic reply looks better than an argument. Our guide to HIPAA-safe review responses has more templates, including how to handle false reviews.

The same rule applies to comments on your own posts. If someone writes "Dr. Patel fixed my knee last year!", a "So glad you're feeling better!" reply confirms the relationship. A like, or "Thank you for the kind words!", is safer.

What OCR enforcement actions show

The HHS Office for Civil Rights (OCR) enforces the Privacy Rule mostly through complaints, and a patient who finds their story on your Facebook page is likely to complain. We cite the regulations here rather than individual settlements; OCR's own announcements on hhs.gov carry the case details.

The rules show how a social media case tends to unfold:

• Most cases end in an agreement, not a fine. Under 45 CFR 160.312 (opens in a new tab), OCR "may attempt to reach a resolution of the matter … by informal means," which "may include demonstrated compliance or a completed corrective action plan or other agreement." Showing that you already had a policy, trained staff and fixed the problem is your strongest position.
• The practice answers for its staff. Under 45 CFR 160.402(c) (opens in a new tab), a covered entity is liable for a violation by "any agent of the covered entity, including a workforce member or business associate, acting within the scope of the agency."
• Penalty size depends on facts you control. 45 CFR 160.408 (opens in a new tab) lists the nature and extent of the violation and harm, prior compliance history, how the entity responded to earlier problems, and its financial condition. A practice that had a policy, trained staff and acted fast is in a far better position.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Staff personal accounts: where the practice is still responsible

HIPAA's "workforce" includes "employees, volunteers, trainees, and other persons" under the practice's direct control, paid or not (45 CFR 160.103 (opens in a new tab)). A hygienist posting about a patient from her own Instagram account is still a workforce member disclosing PHI she learned at work.

Two duties follow. The Privacy Rule requires you to "train all members of its workforce" on your privacy policies, and to "have and apply appropriate sanctions" against those who don't comply (45 CFR 164.530(b) and (e) (opens in a new tab)). A policy nobody has read, or a sanction nobody applies, won't help you.

Individuals carry their own risk too. The federal criminal provision at 42 U.S.C. 1320d-6 (opens in a new tab) applies to "a person (including an employee or other individual)" who knowingly discloses individually identifiable health information without authorization.

Posting patient content the right way: authorization first

Patient stories, testimonials and before-and-after photos are legitimate marketing when the patient signs first. The authorization must describe the content, who will use it, the purpose, an expiration date or event, and the patient's right to revoke, among other elements. Our guide to HIPAA authorization forms lists every required element and the extra clauses for photos and video.

Two more rules apply to the content itself. The FTC's Endorsement Guides (16 CFR Part 255) (opens in a new tab) cover testimonials: if a patient's result isn't representative, the ad must disclose "the generally expected performance in the depicted circumstances." Your state licensing board may also restrict testimonials or before-and-after images.

For the wider question of what to post and where, see social media for medical practices. Medfy's free marketing audit scores a practice's social media presence alongside its website, SEO, local listing, AI visibility and ads. Medfy does not manage organic social posting, so the policy below is yours to run.

A staff social media policy you can adopt

Copy this outline into your policy manual and adapt it with your privacy officer. Have your attorney review the final version.

1. Scope. Applies to every workforce member (employees, contractors, students, volunteers) on practice accounts and personal accounts, on and off duty.

2. Never post, on any account:

• Photos or video taken in clinical areas, unless the privacy officer approved the post and a signed authorization covers every identifiable patient
• Any patient's name, initials, face, story, appointment or condition, even without a name
• Screens, schedules, charts, X-rays, wristbands or paperwork
• Replies to reviews or comments that confirm someone is a patient

3. Practice accounts. Only named staff may post. Every post showing a patient, or any patient content, needs a second reviewer and a signed authorization on file before it goes live.

4. Reviews. Use the approved generic reply. Route complaints to the office manager by phone.

5. Training. Covered at onboarding and refreshed every year, with a signed acknowledgment. Retrain after any incident.

6. Sanctions. Violations are handled under the practice's sanctions policy, from retraining and written warning to termination, applied consistently and documented, as 45 CFR 164.530(e) requires.

7. After a mistake:

1. Screenshot the post, then remove it (or ask the platform to).
2. Tell the privacy officer the same day.
3. The privacy officer assesses it as a potential breach. Under 45 CFR 164.402 (opens in a new tab), an impermissible disclosure "is presumed to be a breach" unless a four-factor risk assessment shows a low probability the PHI was compromised.
4. If it's a breach, notify the patient "without unreasonable delay and in no case later than 60 calendar days after discovery" (45 CFR 164.404 (opens in a new tab)).
5. Mitigate any harm, apply sanctions, and keep the documentation for six years (45 CFR 164.530(f) and (j) (opens in a new tab)).

Want to see how patient data moves through Medfy's own forms and inbox? Read how Medfy protects patient data.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Is it a HIPAA violation to post a patient's photo with their permission?

Not if permission means a signed HIPAA authorization that covers that photo, the platforms you'll post on and how long you'll use it. A verbal yes or a text message isn't enough, because the Privacy Rule requires specific written elements. Check the background for other patients, screens and charts too. The FTC Endorsement Guides apply if the post promotes results. Confirm the form with your compliance officer or attorney.

Can I reply to a negative Google review without violating HIPAA?

Yes, if the reply doesn't confirm the reviewer is a patient or mention anything about their care. Thank them, state a general policy, and invite them to call the office manager. Even 'we're sorry your root canal hurt' discloses PHI. Handle specific complaints privately. If a revealing reply has already gone out, remove it and talk to your privacy officer or attorney the same day.

Are employees personally liable for HIPAA violations on social media?

They can be. The federal criminal provision, 42 U.S.C. 1320d-6, reaches a person, including an employee, who knowingly discloses individually identifiable health information without authorization. Civil penalties fall on the practice, which is liable for workforce members acting within the scope of their work and must sanction staff who break its privacy policies. Licensing boards and state law can add consequences. Confirm specifics with an attorney.

What should we do if a staff member posts patient information?

Act the same day. Screenshot the post for your records, then have it removed. Your privacy officer runs the breach risk assessment in 45 CFR 164.402: what was disclosed, who saw it, and how far it spread. If it's a reportable breach, notify the patient within 60 days of discovery. Apply your sanctions policy, retrain, and document every step. Get legal advice before notifying anyone.