EXECUTIVE SUMMARY
Central Columbia Hospital
Scenario D: Technology/Social Media/HIPAA
Team 8C
REPORT Section
Major/Minor Problems Presented and Causes:
After intense investigation, it was determined that Central Columbia Hospital (CCH) is undergoing
pressing issues. One of the major issues presented is a HIPAA violation. It is important to note
that healthcare professionals including “nurses must not transmit… any patient-related information
or image that is reasonably anticipated to violate patients’ rights to confidentiality or privacy or to
otherwise degrade or embarrass the patient.” 1 The Privacy Rule was established to protect “all
‘individually identifiable health information’ held or transmitted by a covered entity or its business
associates, in any form or media, whether electronic, paper, or oral.” 2 This information is referred
to as protected health information (PHI). The definition of “individually identifiable information”
in 45 C.F.R. § 160.103 relates to demographic information concerning an individual’s health
condition at any time, the health care provided, or the payment of care that “identifies the
individual or for which there is a reasonable basis to believe it can be used to identify the
individual.” 2
Therefore, even though employees involved in the online activity did not specifically state the
patient’s name, a HIPAA violation occurred because information was posted for one to reasonably
identify the patient. Further, although all employees are required to undergo HIPAA training, the
training provided has not been effective because the staff did not consider their actions a violation.
Clearly, transfer of training has not occurred, which is the underlying cause of the staff’s willful
neglect of violating HIPAA.
The next major problem is the Code of Conduct. Currently, a section of the Code of Conduct
broadly discusses the use of electronic media. However, this broad stated excerpt is outdated and
does not provide enough guidance of what can and cannot be done on social media. Additionally,
it is unlawful as it violates Section 7 of the National Labor Relations Act (NLRA), which regards
employees’ rights to engage in concerted activity.3 The cause for these issues is the absence of a
clearly stated and communicated social media policy that outlines discipline. As a result,
employees are vulnerable to legal risks and do not understand the impact their personal behavior
on social media has on both the hospital and their careers. Healthcare professionals are responsible
to uphold patients’ expectations and rights to be treated with dignity and respect. However, CCH
employees breached this privacy and trust by not upholding their professional duties. Thus, they
are not supporting CCH’s mission of maintaining the highest level of professional excellence.
Furthermore, a minor issue presented is the staff feeling overworked but not bringing the concerns
to CCH’s attention during its monthly employee discussion groups. The reason for opting to voice
frustrations on social media signifies low morale due to being understaffed as well as an overall
culture disconnection at CCH. To illustrate, on a daily basis, employees feel the results of upper
1
Spector, N. and Kappel, D., (2012). "Guidelines for Using Electronic and Social Media: The Regulatory Perspective" OJIN:
The Online Journal of Issues in Nursing Vol. 17, No. 3, Manuscript 1.
2 "Summary of the HIPAA Privacy Rule." Summary of the HIPAA Privacy Rule. U.S. Department of Health & Human Services,
26 July 2013. Web. 07 Apr.2015.http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html
3 29 USC § 157.
level management not being in sync and the lack of organizational support for the necessary
changes Green suggests.
Alternatives:
There are myriad corrective action routes CCH could take to address the pressing problems and
remain competitive. CCH must decide what to do with the seven employees involved in the online
discussion and what to do to going forward. An active approach may be taken. This could start by
terminating the HIPAA violators and coaching employees who partook in the conversation and
did not bring it to HR’s attention that PHI was being discussed. To mitigate the occurrence of
violations happening in the future, CCH could retrain all employees on HIPAA as well as update
the Code of Conduct to include a formal social media policy that would outline discipline. Longterm, CCH could deal with the low staffing issues and low morale by focusing on linking the
organization’s business decisions to the mission and culture of the organization. This can be done
by bringing in more proactive, engaged leadership. An organizational structure could be
completely redone to include a Vice President of HR and a compliance officer. Another alternative
that CCH could take is a more passive approach. CCH could decide that since a formal social
media policy was not in place and employees were not effectively trained, it is best to just talk to
the employees and not terminate anyone. Going forward, CCH could remind all employees that
they signed the employee handbook and then redistribute informational HIPAA pamphlets.
Selection for Corrective Action and Implementation:
Due to the fact that CCH can be held liable for its employees’ disclosure of PHI on social media,
the best corrective action route to take is the active approach. Additionally, CCH prides itself on
its strong trusting relationships between staff and patients. It relies on its positive reputation with
the local communities. Therefore, to maintain its trusting relationships and image, HIPAA
violations must be strictly enforced. Thus, CCH must have a zero tolerance policy for violating
HIPAA that results in automatic termination. Consequently, the four HIPAA violators will be
terminated. The other three employees involved will be separately coached. HIPAA compliance
will be further implemented as all employees at CCH will undergo a refresher training seminar.
However, rather than provide training through lecture, a hands-on approach focusing on real case
scenarios and debriefings will be used to increase transfer of training. Further, all employee
relation decisions must be fair and consistent. So, the Code of Conduct will be corrected to
explicitly include a social media policy. When creating this policy, it will have clear examples of
appropriate and inappropriate online behavior and disciplinary actions. The policy will emphasize
the importance of HIPAA compliance and exemplifying ethical practices, which aligns with
CCH’s mission. Further, it will be carefully crafted to ensure it does not infringe on employee’s
rights according to the NLRA. Implementation will include clearly communicating and
redistributing the handbook. All employees will need to re-sign to acknowledge that they read and
understand it. In addition, a one-page summary will be created to serve as a quick reference. This
will be emailed and posted in CCH’s employee lounges. On a long-term basis, CCH will work
towards improving its organizational culture to increase employee morale. To do this, upper level
management must be on the same page and align the business decisions to directly support the
mission and culture at CCH. Eventually, the organizational chart will be restructured to include a
Vice President of HR and a compliance officer. Also, more staff will be hired so employees are
not overworked. Ultimately, CCH must remember that strong, satisfactory patient care is not
possible without strong administration and a synergistic culture.