Appropriate Action for Intern Posting Patient Photo on Social Media
The intern must immediately delete the post, provide a formal apology to the patient and family, and the incident must be reported to hospital administration and risk management for formal review and potential disciplinary action, regardless of whether direct patient identifiers are visible. The absence of obvious identification does not eliminate HIPAA violations or ethical breaches.
Why "No Identification" is Not a Valid Defense
The intern's claim that the image shows no identification is legally and ethically insufficient. Even de-identified images can constitute protected health information (PHI) violations when they contain sufficiently unique identifiers 1:
- Date of service (including "today" or "last night") is PHI 1
- Specific institution, practitioner, or limited geographic information is PHI 1
- The combination of timing, location (OR), and unique clinical features can allow patient identification 1
- Once posted online, content is permanent and irrevocable, with no control over dissemination to unintended audiences 1
The majority of HIPAA violations in recent years have occurred from employees mishandling protected health information through inappropriate social sharing 1.
Required Immediate Actions
1. Immediate Post Removal and Apology
- The post must be deleted immediately 1
- When patients or family members request post withdrawal, their wishes must be respected and the post removed 1
- The intern must provide a sincere apology to the patient and family 2, 3
- A complete apology should express regret, acknowledge the fault, and explain steps to prevent recurrence 3
2. Mandatory Institutional Reporting
This incident requires formal reporting to hospital administration, not just an apology and deletion 1:
- State Medical Boards have taken disciplinary actions (restriction, suspension, or revocation of medical licenses) for physician violations of online professionalism in 56% of US State Medical Boards 1
- 14% of UK General Medical Council investigations regarding social media usage resulted in suspended or restricted registrations 1
- The hospital's risk management and ethics committee should be consulted to assess potential HIPAA violations and determine appropriate disciplinary measures 1
Why Consent Was Required Before Posting
Informed consent and HIPAA authorization must be obtained from patients before posting any case-specific information, images, or video on social media 1:
- This applies even to images that appear de-identified 1, 4
- Patients must explicitly consent to each specific use (medical record, teaching, publication, social media) 1, 4
- The photographer must discuss all intended uses, especially electronic publications that reach wider audiences 1
- Patients should review the actual content before posting 1
Potential Consequences of This Violation
The consequences of unprofessional social media behavior are significant 1:
- Fines and litigation exposure
- Medical license restriction, suspension, or revocation
- Permanent damage to professional reputation
- Loss of patient and institutional trust
- Potential criminal penalties for HIPAA violations
Common Pitfall to Avoid
The most dangerous misconception is believing that absence of obvious identifiers (name, face, medical record number) makes posting acceptable. The permanence of online content, combined with contextual clues (timing, location, institution, unique clinical features), can allow patient identification even from seemingly anonymous images 1. Healthcare professionals must obtain explicit consent before any social media posting of patient-related content 1.