Social Media Policy Checklist for Eye and Ear Specialty Hospitals

A clear social media policy helps your eye and ear specialty hospital protect patient privacy, support responsible public education, and set consistent expectations for staff. Use this checklist to define what employees may post, who approves official content, and how the hospital responds when something goes wrong.

What should the policy say about patient privacy and protected health information?

State plainly that staff must not post or confirm patient-related information on social media unless the hospital has approved the disclosure and any required authorization is in place. Protected health information (PHI) can include details that identify a person and relate to their health or care—not just a name or medical record number. In a specialty hospital, an eye image, retinal scan, audiogram, distinctive device, appointment detail, or recognizable voice could reveal information about a patient when combined with context.

Explain the HIPAA minimum necessary standard accurately: when it applies, covered entities generally must take reasonable steps to limit certain uses and disclosures to the amount needed for the purpose. It does not apply to every HIPAA disclosure; for example, it does not apply to disclosures to or requests by a health care provider for treatment, or to disclosures made pursuant to an individual’s authorization. A hospital may still set a stricter social media rule: do not post patient details in public channels.

• Prohibit posting patient information, images, or stories from clinical areas on personal accounts, even when names are omitted.
• Direct staff to use approved, secure channels for care-related communication—not public comments, direct messages, or social media chat.
• Remind employees that a patient’s own public post does not give staff permission to confirm the person’s relationship with the hospital or disclose additional details.
• Require staff to report suspected disclosures promptly to the hospital’s privacy or compliance contact.

The HHS summary of the HIPAA Privacy Rule explains when authorization is required and how the minimum necessary standard applies. Staff should also follow the hospital’s own privacy procedures, which may be more restrictive than a particular federal rule.

How should staff handle patient photos, videos, and testimonials?

Set a default rule that employees may not capture or publish patient photos, videos, recordings, or testimonials for hospital promotion without advance review and a valid patient media authorization when required. Under HIPAA, a covered entity generally needs a valid authorization for uses or disclosures of PHI that are not otherwise permitted or required by the Privacy Rule. The authorization must meet the rule’s requirements and the use must stay within its scope.

Make clear that casual consent, a social media message, or a general treatment consent is not automatically a valid HIPAA authorization for promotional use. Have the privacy or legal team verify that the form identifies the information, who may use or disclose it, the recipient or audience, the purpose, an expiration date or event, and the patient’s right to revoke. HHS explains the distinction between consent and authorization, and the required elements appear in 45 CFR § 164.508.

• Specify the channels and uses covered, such as the hospital’s website, social accounts, paid advertising, or printed materials.
• Keep the authorization process separate from treatment decisions; do not imply that care depends on agreeing to promotional use.
• Obtain the required permission before recording or posting, and follow hospital procedures for minors and personal representatives.
• Do not assume that blurring a face, cropping an image, or changing a voice makes an unauthorized disclosure acceptable. HHS says masking identities does not substitute for authorization when media access to PHI requires it.
• Store approved media securely, document its permitted uses, and route requests to withdraw or change permission to the responsible department.

For additional context, see HHS guidance on film and media access in health care facilities.

What approval process should apply to clinical claims and educational content?

Require documented review before official accounts publish clinical claims, treatment information, patient education, or content about services and outcomes. The policy should identify who checks medical accuracy, who reviews privacy and regulatory concerns, and who gives final communications approval. A practical workflow may involve a clinician with relevant specialty expertise, the privacy or compliance team, and communications staff.

For eye and ear care, reviewers should check that a post does not overstate what a test, device, procedure, or treatment can do. Confirm that images and captions are used in context, limitations are clear, and the content does not imply that an individual result is typical or guaranteed. When content functions as advertising, objective claims should be truthful and adequately supported; the FTC’s Health Products Compliance Guidance discusses substantiation for health-related advertising claims and the risks of misleading testimonials.

• Record the reviewer, approval date, source material, and any required update or expiration date.
• Check references and ensure that captions do not go beyond what the evidence supports.
• Use a correction process for outdated, inaccurate, or misleading content.
• Route requests for personalized diagnosis or treatment advice to approved clinical channels rather than answering in public.

These review steps are recommended policy controls; they should not be presented as a special HIPAA pre-approval requirement for every educational post.

Which professional boundaries apply to staff and patient interactions online?

Tell staff to keep online interactions professional and consistent with the boundaries they maintain in person. Employees should not use personal accounts to provide individualized medical advice, discuss a patient’s case, pursue personal relationships with patients, or move a clinical conversation into a personal direct message. Use the hospital’s approved communication and care pathways instead.

Encourage staff who represent the hospital to distinguish official communications from personal opinions, and to avoid implying that a personal account speaks for the organization. A disclaimer does not permit disclosure of PHI or replace required approval. The AMA Code of Medical Ethics guidance on physicians’ social media use advises physicians to respect patient confidentiality, maintain appropriate professional boundaries, and ensure that health information shared online is accurate.

Also warn staff that privacy settings cannot guarantee that a post remains private. Content may be copied, shared, or viewed outside its intended audience, so employees should pause before posting anything that could compromise patient trust or professional responsibilities.

How should the hospital manage comments, complaints, and misinformation?

Assign trained staff to monitor official accounts and define how they should respond to comments, complaints, and inaccurate health information. The policy should set response expectations, escalation contacts, and consistent moderation rules. Staff should not confirm that a commenter is a patient, discuss a visit, or disclose any PHI—even if the commenter has shared personal health details publicly.

Use a neutral response that acknowledges the concern without confirming a care relationship, then offer a private, approved way to contact the hospital. For example: “We take concerns seriously. Please contact our patient relations team through the hospital’s secure channels.” The AMA guidance on responding to online patient reviews similarly recommends avoiding patient disclosures and speaking generally about policies rather than an individual case.

• Refer complaints about care, billing, access, or staff conduct to the appropriate patient relations or grievance process.
• Correct material health misinformation with concise, evidence-based general information and approved sources; do not diagnose or debate an individual’s case.
• Apply published moderation rules consistently. Document removals or restrictions and escalate threats, harassment, or privacy concerns.
• Direct anyone describing an immediate medical emergency to emergency services or an emergency department. Do not use a public social account as an emergency triage channel.

HHS notes that public-facing social platforms are not appropriate for individualized telehealth interactions; a public educational presentation should not identify patients or offer individualized patient advice. See HHS guidance on public-facing and non-public-facing communication products.

What rules govern account access, personal use, and disclosure of affiliation?

Establish social media account governance by identifying each official account, its business owner, authorized publishers, and backup administrator. Limit access to employees who need it, use platform permissions rather than sharing passwords where available, turn on security protections such as multifactor authentication, and promptly remove access when a person changes roles or leaves the hospital. These are recommended account-management practices; do not imply that HIPAA prescribes a particular social media platform or login configuration.

Keep personal and official accounts separate. The policy should state whether staff may use social media during work, whether hospital devices or networks may be used, and when employees must disclose that they are speaking in an official role. If employees discuss the hospital in a personal capacity, a clear affiliation disclosure may help avoid confusion, but it does not authorize release of confidential information.

Train staff on the hospital’s own social media and privacy procedures, including how to report a concern. HHS requires covered entities to train workforce members on relevant policies and procedures and to maintain appropriate sanctions for noncompliance, but a training completion certificate does not establish that an organization is HIPAA compliant. Training frequency and documentation should follow employer policy and applicable requirements; annual certificate renewal is not a universal federal HIPAA requirement. See the HHS summary of the HIPAA Security Rule.

How should policy violations and urgent safety concerns be handled?

Provide a simple reporting route for suspected patient privacy disclosures, compromised accounts, inappropriate posts, and urgent safety concerns. Tell employees to notify the privacy or compliance officer and the designated communications or security contact immediately. They should preserve relevant details—such as the post, account, time, audience, and screenshots—so the hospital can assess the event. Staff should not investigate publicly or promise that an incident is harmless.

The hospital’s breach response protocol should cover containment, documentation, risk assessment, and required notifications. Not every policy violation is automatically a reportable HIPAA breach: HHS explains that an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity determines, through the required assessment, that there is a low probability the PHI was compromised or an exception applies. The HHS Breach Notification Rule guidance describes notification obligations and the need for written policies, workforce training, and appropriate sanctions.

For immediate threats to a patient’s safety, direct the concern to emergency services or the hospital’s established clinical escalation process—not to a social media exchange. A strong policy brings together patient privacy, valid media authorization, careful clinical review, professional boundaries, controlled account access, and a prompt, documented response to incidents.

FAQs

Can hospital staff discuss patient care on personal social media accounts?

Staff should not discuss identifiable patient cases or confirm a person’s relationship with the hospital on personal accounts. Even without a name, a combination of clinical details, timing, images, or location may identify someone. Share only approved, general health information and use authorized clinical channels for patient care.

What consent is required before posting patient images or testimonials?

When a post uses or discloses PHI for a purpose requiring permission, the hospital generally needs a valid HIPAA authorization—not merely informal or verbal consent. The authorization should specifically cover the media and intended use, and the hospital should verify that it meets applicable requirements before publishing. Hospital policy or state law may impose additional safeguards.

How should staff respond to patient complaints on social media?

Respond calmly without confirming the person is a patient or discussing details of care. Acknowledge the concern, offer a secure way to contact patient relations, and route any safety issue through the hospital’s established escalation process. Do not disclose PHI even if the commenter has posted it publicly.

Who should approve clinical content before publication?

The hospital should name an approval workflow that includes a qualified clinical reviewer and, as appropriate, privacy or compliance and communications reviewers. Require documented approval for clinical claims, patient education, service promotions, and content using patient media, with a process to correct or retire outdated material.