Social Media Policy Checklist for Pediatric Colorectal Centers

How should centers protect patient privacy and obtain authorization?

Before posting, determine whether the content identifies a patient or reveals information about their health, care, or presence at the center. A child’s name is not the only concern: a recognizable image, a distinctive story, or details that can be combined to identify a patient may also expose protected health information (PHI).

As a policy safeguard, require a valid, written patient authorization before publishing identifiable patient photos, videos, stories, or care details on a public center account. The authorization should specify what information may be used, the purpose, where it may be posted, and an expiration date or event. Explain that public posts can be copied or reshared, and do not condition treatment on providing authorization. HIPAA requires authorization for uses or disclosures of PHI not otherwise permitted by the Privacy Rule; see HHS guidance on consent and authorization.

For pediatric patients, verify who is legally authorized to act for the child before accepting authorization. A parent or guardian is often the child’s personal representative, but state law and specific circumstances can affect that status. A center should check applicable rules and consider the child’s age, understanding, and preferences. See HHS guidance on personal representatives.

If the center plans to rely on photographic de-identification instead of authorization, have privacy staff review the image and surrounding details before publication. HIPAA’s Safe Harbor method lists full-face photographs and comparable images among identifiers that must be removed; removing a name or blurring a face alone may not address other identifying details. See HHS guidance on de-identification.

What should staff avoid sharing in photos and videos?

Do not capture or publish patients, family members, or patient-identifying details unless the center has approved the content and obtained any required authorization. Check the entire frame and audio track—not just the subject—for faces, names, voices, charts, appointment lists, computer screens, wristbands, room labels, and other PHI.

For a pediatric colorectal center, take extra care with images that could reveal a child’s diagnosis or treatment, including surgical or examination areas, ostomy supplies, care equipment, or distinctive clinical settings. A patient may be identifiable even when their face is not visible. Avoid recording in clinical areas unless the center has put safeguards in place to prevent exposure of other patients’ information. HHS explains that patient information can be visible or audible in treatment areas and that blurring after filming does not replace authorization when PHI was accessible to the camera crew; see HHS guidance on filming and patient information.

Use approved devices and workflows for center content. Staff should not store patient images in personal photo libraries, send them through personal accounts, or upload them to unapproved editing or artificial-intelligence tools. The center should specify who may capture, review, approve, and publish content, and how any working files are securely handled.

How should social media care requests be handled?

Treat comments and direct messages as public or potentially accessible communications, not as secure clinical records. Staff should not assess symptoms, provide individualized treatment advice, discuss a patient’s care, or request medical details in social media replies.

Use a brief, approved response that directs the person to the center’s phone number, patient portal, or another secure clinical communication channel. For urgent or emergency concerns, direct the person to emergency services or the appropriate urgent-care resource; do not imply that a social account is monitored continuously. HHS distinguishes public-facing platforms from private communications and says public-facing services should not be used to identify patients or provide individualized advice in a livestream; see HHS guidance on public-facing communication products.

Do not confirm whether someone is a patient, even if they identify themselves first. Avoid asking them to post their child’s name, symptoms, photos, appointment details, or other PHI. The center’s response should acknowledge the request without confirming a care relationship and explain how to contact the appropriate clinical team privately.

What professional boundaries should staff maintain online?

Set clear patient-provider social media boundaries. Staff should not use personal accounts to follow, friend, message, or otherwise build private social connections with current patients or their families. Direct all care-related communication to center-approved channels, and follow the center’s process if a patient initiates a personal connection.

Ask staff to separate personal and professional activity where practical, use appropriate privacy settings, and remember that privacy settings do not prevent content from being copied or shared. Staff should not discuss cases—even without names—if a patient could be recognized from the details. The AMA Code of Medical Ethics guidance on social media advises physicians to protect confidentiality, maintain professional boundaries, and recognize that online content may remain accessible.

Center accounts should share accurate, reviewed health information and disclose relevant sponsorships or financial relationships. Staff should not imply that general educational content is individualized medical advice.

What staff conduct and reporting rules belong in the policy?

Give staff practical rules for posting, commenting, messaging, tagging, photographing, and using personal devices. Specify who may speak for the center, who reviews posts before publication, which accounts and tools are approved, and what conduct is prohibited. Training should explain how the rules apply to all workforce members and how they align with the center’s privacy, security, and professional-conduct policies.

Require staff to report suspected privacy incidents promptly through the center’s privacy or security reporting process. Examples include a post containing patient details, a misdirected message, an unauthorized image, a lost device with patient content, or a comment that reveals a patient relationship. Staff should preserve relevant information and follow instructions from the response team rather than independently investigate or promise that an incident is resolved.

The center should document and assess reported incidents. HIPAA’s breach notification requirements apply to breaches of unsecured PHI, not automatically to every social media mistake; an impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the organization documents a risk assessment showing a low probability that PHI was compromised. See HHS guidance on the Breach Notification Rule.

How should center accounts and public comments be managed?

Assign account ownership to designated staff and use center-controlled email addresses, strong authentication, and a process for promptly removing access when someone changes roles or leaves. Keep an up-to-date list of account administrators, establish an approval workflow for posts, and make clear who monitors incoming messages and during what hours.

Adopt social media content moderation rules that describe how staff handle comments, direct messages, spam, threats, misinformation, and posts containing PHI. Remove or hide content according to a consistent, documented process, and avoid replying in a way that confirms a patient’s identity or care. If a commenter posts identifiable health details, limit further exposure where possible, notify the privacy team, and follow the incident response process.

Publish a short notice explaining that the account is not for medical emergencies or private clinical communication. Tell users how to reach the center through approved channels, and do not promise that comments or messages will receive immediate review.

What risks remain after a post is deleted?

Deleting a post can reduce further exposure, but it cannot guarantee that the information is gone. Someone may have taken a screenshot, copied the text, downloaded the image, or reshared the post; the platform may also retain copies or records. The AMA cautions that online content may remain accessible even after publication, so staff should report an incident promptly rather than assume deletion resolves it. See the AMA’s social media ethics guidance.

When a post exposes patient information, remove or restrict access if directed, preserve relevant records for the center’s review, and notify the privacy or security team immediately. The center should assess the facts, document its response, and determine whether notification is required under applicable law and policy. A sound checklist combines authorization, careful image review, secure clinical communication channels, professional boundaries, consistent moderation, and prompt privacy incident reporting procedures.

FAQs.

Is written authorization required before posting a patient photo?

When a photo identifies a patient and its publication would disclose PHI, a covered center generally needs a valid HIPAA-compliant authorization unless a specific Privacy Rule permission or exception applies. For a child, verify that the person signing is authorized to act as the child’s personal representative under applicable law. See HHS guidance on authorization and HHS guidance on personal representatives.

Can staff answer patient-specific questions in social media comments?

Staff should not provide individualized clinical advice or confirm a person’s patient status in public comments. Use an approved, neutral response directing the person to a secure clinical communication channel; for urgent concerns, provide appropriate emergency guidance.

Should staff connect with current patients on personal accounts?

As a professional-boundaries safeguard, centers should generally direct staff not to friend or follow current patients or their families from personal accounts. Care-related contact should happen through center-approved channels. The AMA advises physicians to maintain appropriate patient-physician boundaries in online interactions; see its social media ethics guidance.

Can deleting a post prevent it from being shared or retained?

No. Deletion may limit continued access on the account, but it cannot ensure that copies, screenshots, or shares do not remain elsewhere. If a post may have exposed PHI, notify the center’s privacy or security team and follow its incident-review process.