What is the appropriate action if an intern posts a picture of a patient's leg in the Operating Room (OR) on social media, potentially breaching patient confidentiality?

Immediate Action Required: Formal Institutional Response

The intern must immediately delete the post, formally apologize to the family, and the incident must be reported to the hospital's risk management and ethics committee for investigation and potential disciplinary action. 1, 2

Why "No Identification" is Not a Valid Defense

The intern's claim that the image shows no identification is legally and ethically insufficient:

• Date of service, specific institution, practitioner, or limited geographic information can constitute Protected Health Information (PHI) violations, even without direct patient identifiers 2
• The combination of timing (OR setting), location (specific hospital), and unique clinical features can allow patient identification by those who know the patient 2
• Patients have a reasonable expectation of privacy in the OR setting, and posting any patient-related content without explicit consent violates this expectation 1
• Once posted online, content is permanent and irrevocable with no control over dissemination to unintended audiences 2

Required Immediate Steps

1. Delete the Post Immediately

• When patients or family members request post withdrawal, their wishes must be respected and the post removed 1, 2
• This is non-negotiable regardless of whether identifiable information is visible 1

2. Formal Apology to the Family

• The intern must provide a sincere apology acknowledging the breach of trust and privacy 1
• This demonstrates accountability and respect for patient autonomy 1

3. Mandatory Institutional Reporting

• The hospital's risk management and ethics committee must be consulted to assess potential HIPAA violations and determine appropriate disciplinary measures 2
• This is not optional—institutional policies require reporting of potential privacy breaches 1

Why Consulting the Ethics Committee is Essential

The ethics committee consultation serves multiple critical functions:

• State Medical Boards have taken disciplinary actions for physician violations of online professionalism in 56% of US State Medical Boards 2
• 14% of UK General Medical Council investigations regarding social media usage resulted in suspended or restricted registrations 2
• The committee can assess whether this represents a HIPAA violation requiring mandatory reporting to regulatory authorities 2
• Institutions may use inappropriate social media posts as a basis for disciplining or terminating employed physicians 1

Potential Consequences for the Intern

This breach carries serious professional ramifications:

• Medical license restriction, suspension, or revocation can occur due to HIPAA violations 2
• Fines and litigation exposure can result from unprofessional social media behavior 2
• Permanent damage to professional reputation and loss of patient and institutional trust 2
• Potential criminal penalties for HIPAA violations 2

The Consent Requirement

Informed consent and HIPAA authorization must be obtained from patients BEFORE posting any case-specific information, images, or video on social media 1, 2

• Patients must explicitly consent to each specific use, including social media posting 2
• Consent should ideally be obtained separately from surgical consent to avoid coercion 1
• The photographer must discuss all intended uses with the patient, especially electronic publications that reach wider audiences 2

Common Pitfall to Avoid

Do not assume that removing obvious identifiers (face, name, medical record number) is sufficient—the context, timing, and circumstances can still allow identification, particularly by family members, friends, or other patients in the same facility 1, 2. The standard is whether the information could lead to patient identification, not whether it definitively does 1.

Educational Opportunity

This incident should trigger institutional review of social media policies and mandatory education for all trainees on:

• What constitutes PHI in the digital age 2
• The permanence of online content 1, 2
• Proper consent procedures for educational content 1
• The professional and legal consequences of violations 2