Get Privacy Trending: Best Practices for the Social Media Educator.

Social media is an increasingly popular forum for medical education. Many educators, including those in infectious diseases, are now creating and sharing unique and educational patient cases online. Unfortunately, some educators unknowingly threaten patient privacy and open themselves to legal liability. Further, the use of published figures or tables creates risk of copyright infringement. As more and more infectious diseases physicians engage in social media, it is imperative to create best practices to protect both patients and physicians. This summary will define the legal requirements of patient de-identification as well as other practical recommendations as they relate to use of clinical case information, patient images, and attribution of primary references on social media.

Social media is a powerful tool for establishing collaborations and creating content in medical education.

Sharing unique patient cases, including the associated clinical, pathology, and radiology images, has become an increasingly popular mechanism for teaching in this online setting. While disseminating education to a large, diverse audience is impactful, these digital teaching opportunities raise concerns about patient privacy violations and inappropriate use of copyrighted material. We sought to develop a brief guide on best practices for using clinical case information and images on social media, which has been robust within the infectious diseases community [1]. This summary will define legal requirements and provide additional suggestions as they relate to use of clinical cases, patient images, and attribution of primary references.

DE-IDENTIFICATION OF PATIENT INFORMATION

Physician respect for patient privacy is a fundamental part of the social contract that exists between patient and physician. The US Department of Health and Human Services (HHS) published The Standards for Privacy of Individually Identifiable Health Information as part of the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to create federal privacy protections for patients’ identifiable health information [2]. This “Privacy Rule” defined the legal limits of what health care professionals may and may not do regarding protected health information (PHI) [3].

Section 164.514(a) of the HIPAA Privacy Rule does provide a legal standard for de-identification of PHI. Under this standard, if health information does not identify an individual or if there is no reasonable basis to believe that the information can be used to identify an individual, the information is not considered individually identifiable health information by federal law. This text shares 2 de-identification methods that can be summarized with the terms expert determination (§164.514(b)(1)) and safe harbor (§164.514(b)(2)) [4]. Expert determination is a method that requires an expert with appropriate knowledge and experience to decide the risk is small (such as an institutional Privacy Officer), whereas the safe harbor method requires removal of specific identifiers to the degree that the remaining information cannot be used alone or in combination with other information to identify an individual.

Most physicians are attempting to use the safe harbor method when preparing digital education materials. Some parts of the safe harbor method are relatively intuitive, such as removing names and contact information. However, certain cases remain distinct even after identifiers are removed and may lead to inadvertent re-identification—thereby not meeting the requirements of the safe harbor method. Local institutions, states, or journals may require more restrictive measures for de-identification and documentation of patient consent.

The consequences of a HIPAA breach depend on the severity of the violation. The HHS Office for Civil Rights (OCR) and state attorney generals can issue penalties for violations, including monetary fines, corrective action plans, and even criminal liability [5]. State medical boards may also impose penalties including suspension or termination of a medical license [6]. It is critical for medical educators to have the skills to sufficiently alter patient details to ensure patient privacy and mitigate risk, but balancing this process while preserving educational value may be difficult. This is particularly true in infectious disease, where details from epidemiological history that lead to the final diagnosis might be quite specific. Some tips for de-identification are presented in Table 1.

Table 1.

Recommendations for De-identification of Patient Cases

Type of Patient Information	Recommendations
Protected health information as outlined by HIPAA Privacy Rule [3, 16]	• Must be removed completely, and includes:
	○ Name
	○ Address (all geographic subdivisions smaller than a state)
	○ All elements of dates related to individual
	○ Telephone and fax numbers
	○ Email address, web URLs, IP address
	○ Social security number
	○ Medical record, health plan beneficiary, certificate, license, and account numbers
	○ Vehicle and device identifiers and serial numbers
	○ Finger or voice print
	○ Any other unique identifying number, characteristic, or code
Date	• Never include specific dates related to clinical presentation (such as admission, surgery, or discharge date)
	• Never use any elements of dates that are directly related to individual (such as birth date or death date)
	• Lump time frames for prior clinical episodes if necessary for understanding of the case (eg, “2 months before admission”)
Age	• Exclude ages >89 years
	• Consider an approximate age or changed age when possible, even if not legally required; otherwise, aggregate age into category by decades (eg, “patient in 50s”)
	• Avoid precise ages in children
Gender	• Leave out if unnecessary to understanding of clinical case
Race/ethnicity	• Leave out if unnecessary to understanding of clinical case
Geography	• Avoid small geographic locations to ensure subdivisions smaller than a state are removed (eg, county or city); if possible, use regional terms (such as “Northeastern United States”)
Anatomic sites	• Modify clinical history as able to further avoid similarity to patient, such as changing location or laterality of clinical findings
Hobbies, lifestyle activities, occupations	• If activity is identifying, consider altering to a similar activity with similar risk profile
Unusual circumstances	• Avoid information that would allow direct association to patient
	• If using case that is rare, unique, or newsworthy, consider delay in posting (if at all)
Other considerations	• It is helpful to inform the readers that the case was modified to protect patient privacy
	• Consider creating a composite patient that still communicates the learning objective without actual patient details
	• Consult with local or institutional Privacy Officer for any questions about appropriate strategy on ambiguous or unclear cases, as they are able to assist in determining best course of action

CLINICAL IMAGES

Clinical patient images have been a mainstay of infectious disease education for decades, and online venues are now particularly poised to accommodate the unique images that often accompany cases. The implications of publishing images online are far-reaching. Images published to the internet are easily copied, redistributed, indexed by search engines, and retrievable even if deleted from the primary source [7]. Further, meta-data (information on location, date/time, and application used for image capture) are collected in the digital information associated with any image, and these associated details can further risk the privacy of patients.

Many have recommended obtaining mandatory informed consent before taking any images or recordings and/or publicly sharing a clinical image, even if the patient is not identifiable [7-10]. An approach to safeguard patients in the context of audio or visual recordings for education is also outlined by the American Medical Association Code of Medical Ethics Opinion 3.1.3 [11]. We advocate for obtaining informed consent before collecting images and storing the consent in the patient’s clinical chart, similar to the typical written consent process for other medical procedures. The physician should explain the condition being evaluated, the purpose of obtaining an image, and the intended audience with expected distribution (including intent to post online via social media). The potential harms, such as breach of privacy or confidentiality, and the efforts made to protect private information should be thoroughly explained. Further recommendations for clinical images are noted in Table 2. After obtaining consent, educational images are subject to the same standards of proper storage and destruction as other patient information, and images should ideally be directly uploaded to the electronic medical record whenever possible. Images stored on personal devices are subject to both HIPAA regulations and local policies.

Table 2.

Recommendations for Use of Images and References

Clinical Image or Reference	Recommendations
Clinical photographs or videos	• When encountering a clinical scenario where an image or video could be educational, always prioritize patient safety. Be respectful and only take images or videos at appropriate times and locations
	• Obtain explicit patient permission and signed consent before taking image and/or sharing
	• Facial photos or any identifiable photographs represent PHI and should not be used without documented patient consent
	• Use careful cropping and framing of photo to remove identifying features. Avoid unique scars, tattoos, or other identifying features. This principle could include jewelry, clothing, and background features as well. If items cannot be easily removed, use of draping may be helpful (such as surgical towel or paper drape)
	• Consider use of previously published and representative image (ie, case report) in lieu of new patient image
Radiology	• Ensure that no identifying patient information remains on image, including date, time, and location of image
Pathology
	• Consider use of screen capture applications for obtaining image, which can exclude burned-in or overlaid patient information and change associated meta-data
	• Consider use of a representative image from an open-access radiology and pathology resource available online
Figures/tables/graphs from published literature	• Review the license details of the individual article to determine reuse permissions. Licenses can be found directly on the article, typically near the DOI or funding body information, or in the journal table of contents
	• Open Access articles will note their Creative Commons licenses. Typical licenses and their permissions include:
	○ CC BY 4.0 [15]: Allows users to reuse, distribute, adapt, and build upon material in any medium or format without restrictions, so long as attribution is given to the creator. Allows for commercial use
	○ CC BY-NC: Same as CC BY above but for noncommercial use only
	○ CC BY-NC-ND: Allows users to reuse, copy, and distribute in any medium or format in unadapted form for noncommerical purposes only
	• If article is not labeled as Open Access, permission for reuse of text, figures, or tables is determined by the individual journal and/or rights holder. As a general rule, this content may not be distributed on the internet or used commercially without specific written permission (which is typically obtained through contact or online form to journal publisher)
	• With Open Access articles or copyrighted material with granted permission, reuse of any borrowed material must be properly acknowledged:
	○ A direct hyperlink to reference is preferred
	○ An ideal attribution includes the title, creator/author, source, and license
	○ Alternatives when limited in character count include use of PubMed identifier (PMID) or Digital Object Identifier system (DOI). Would note in-text of tweet or directly printed on accompanying image
Images or figures from textbook references	• Cite chapters and pages from books
	• Include hyperlinks if electronic versions of the books are available online
Images from federal agency materials, such as the Centers for Disease Control and Prevention, Agency for Toxic Substances and Disease Registry, and US Department of Health and Human Services [17]	• Most information on the CDC website, such as the Public Health Image Library (at phil.cdc.gov), is in the public domain, royalty-free, and may be freely used or reproduced without copyright permission
	• Attribution to the agency that developed the material should be provided, such as “Source: CDC” or “Material developed by CDC,” with accompanying direct hyperlink
	• The CDC has a public domain website, so one can link to cdc.gov without specific permission
	• Exceptions include resources that are developed and licensed for use by the CDC from third parties or government contractors. If material is copyright-protected and featured on the CDC website, it will include a copyright statement. In these scenarios, the license holder may prohibit reuse of images. For questions, agencies can be contacted directly about specific images
Content from conference presentations, such as slides from local or national conferences	• Materials presented at conferences are subject to copyrights by the conference and original authors. Many conferences now will have direct social media policies or copyright disclaimers to clarify which content may be prohibited for posting
	• Specific research presentations, posters, or slides should only be re-posted or shared on social media if presenter granted consent for posting
	• Appropriate attribution would include: original author by name (tagging where appropriate), presentation title, and conference
	• Presenters should notify the audience if willing for content to be shared on the initial slide. If only certain slides should be shared, this can be noted in the corner of the slide (such as with a camera icon or Twitter symbol)

Abbreviations: CDC, Centers for Disease Control and Prevention; PHI, protected health information.

PATHOLOGY AND RADIOLOGY IMAGES

Pathology and radiology images also provide significant learning opportunities for infectious disease learners. The current HIPAA Privacy Rule permits use of de-identified pathology photographs, including permission to take and publicly share images without explicit patient consent [3]. Ethical and practical guidelines for use of pathology images have been discussed previously and advise that benefits of use of de-identified images without consent greatly outweigh the risks [12, 13]. On the other hand, radiology images do not have separate requirements outlined by law; hence, the same measures to ensure patient privacy should be used that are used for other clinical images [14]. Extra care must be taken with de-identification of the accompanying clinical vignettes if the patient’s pathology or radiology image is used. As noted in the precautions within Table 1, unique cases are easier to re-identify and may require significant change or delay in use.

RESPONSIBLE REFERENCING

Citation of source material is important to ensure correct attribution to the primary source for copyright purposes, but it also provides an avenue for readers to further examine and review topics. Many journals offer Open Access (OA) to individual articles, which is the practice of allowing unrestricted access and reuse of content. OA articles are distributed under the terms of their specific Creative Commons (CC) Attribution License, and common CC licenses for medical journals with suggestions for citation are outlined in Table 2 [15]. If an article is not explicitly labeled as OA, content is distributed under the standard publication reuse rights determined by the individual journal. These rights generally will allow access to view for personal use, but readers may not display or distribute on the internet. Reuse or distribution permission requests for text, tables, or figures with an exclusive license should be directed to the journal press or rights holder, and this process is easily found on the article website.

CONCLUSIONS

Although clinical stories are invaluable in medical education, it is important to ensure that patients cannot be identified, from both a legal and ethical perspective. The professional benefits of teaching on social media are extensive, and we hope that this guidance will assist and encourage content creators in upholding a high standard of responsible use.