What is the appropriate action if an intern takes a picture of a patient's leg in the operating room and posts it on social media?

Consult the Hospital Ethics Committee

The appropriate action is to consult the hospital ethics committee (Option B), as this situation represents a serious HIPAA violation requiring institutional investigation, regardless of whether the intern believes the image shows no identification. 1, 2

Why the Intern's Justification is Invalid

The intern's claim that the image "shows no identification" does not protect against HIPAA violations because:

• Date of service, specific institution, practitioner, or limited geographic information can constitute protected health information (PHI) violations, even without obvious patient identifiers 1, 2
• The combination of timing (posting from the operating room), location (specific hospital), and unique clinical features can allow patient identification through contextual clues 1, 2
• Once posted online, content is permanent and irrevocable, with no control over dissemination to unintended audiences 1

Required Immediate Actions

While consulting the ethics committee is the primary institutional response, several immediate steps must occur:

• The post must be deleted immediately 1, 2
• When patients or family members request post withdrawal (as occurred here), their wishes must be respected and the post removed 1, 2
• The hospital's risk management and ethics committee should assess potential HIPAA violations and determine appropriate disciplinary measures 2

Why Simple Apology and Deletion is Insufficient (Option C)

While deletion and apology are necessary components, they alone are inadequate because:

• State Medical Boards have taken disciplinary actions for physician violations of online professionalism in 56% of US State Medical Boards 1, 2
• 14% of UK General Medical Council investigations regarding social media usage resulted in suspended or restricted registrations 1, 2
• The majority of HIPAA violations stem from employees mishandling protected health information through inappropriate social sharing 1
• Potential consequences include fines, litigation, medical license restriction, suspension, or revocation 1, 2

Why "Doing Nothing" is Unacceptable (Option A)

The intern's belief that no identification was shown is medically and legally incorrect:

• Even de-identified content can potentially be traced back to specific patients if it contains sufficiently unique identifiers 1
• Institutions may use inappropriate social media posts as a basis for disciplining or terminating employed physicians 1
• Reckless social media usage can blur professional boundaries and lead to fines, litigation, and imprisonment 1

The Role of Informed Consent

This case highlights a critical missing element:

• Informed consent and HIPAA authorization must be obtained from patients BEFORE posting any case-specific information, images, or video on social media 1, 2
• Patients must explicitly consent to each specific use, including medical record, teaching, publication, and social media 2, 3
• The photographer must discuss all intended uses with the patient, especially electronic publications that reach wider audiences 2, 3

Common Pitfalls in This Scenario

• Assuming that absence of obvious identifiers (face, name) means HIPAA compliance - contextual information can still identify patients 1, 2
• Believing that educational intent justifies posting without consent - consent is required regardless of educational value 1, 2
• Thinking that deletion alone resolves the violation - institutional reporting and investigation are mandatory 2
• Failing to recognize that the family's discovery represents a breach of trust requiring formal institutional response 1, 2