SUBJECT: SOCIAL MEDIA - GUIDELINES FOR PERSONAL USE

1. Crossing Rivers Health shall recognize that the use of social media provides a number of benefits for employees during their own time. Within the hospital, however, access to social media shall be restricted. Unauthorized employees may not participate in social media from a network computer.

A. E-mail and Internet access shall be provided to support Crossing Rivers Health business purposes. Crossing Rivers Health understands that employees with this access may make incidental personal use of them; however, extensive personal use of these tools during work or non-work time shall be prohibited. Managers have the right and responsibility to determine extensive use and to revoke access privileges for abuse of the system.

2. For the purposes of this policy, social media shall be considered to be technology and software that allows use-generated content to be shared and exchanged online (i.e., blogs, Facebook, Twitter, YouTube).

3. Blogging and other social networking activities are personal and should be done on the employee’s time, unless said employee is assigned to perform an online activity as a part of the employee’s job responsibilities.

4. Employees may not disclose any confidential or proprietary information of or about this hospital, its affiliates, vendors or suppliers, including but not limited to, business and financial information.

5. All employees shall be prohibited from using social media sites to provide medical advice or medical commentary or to use the social media site to make, recommend or increase referrals to physicians who are not employed by this hospital.

A. Write in the first person: When your affiliation to Crossing Rivers Health is evident, you should make it clear that you are speaking for yourself and not on behalf of the hospital.

B. Use a disclaimer: In instances when your affiliation to Crossing Rivers Health is evident, consider including a disclaimer, such as “The views expressed on this (blog; website) are my own and do not reflect the views of my employer.”

C. Be respectful: Refrain from posting any content that is obscene, defamatory, profane, libelous, threatening, harassing, abusive, hateful or embarrassing to another person or entity.

D. Always protect patient privacy: Never reveal any information that would make the identity of a patient apparent as this would be a HIPAA breach.

E. Adherence to all laws and regulations: Individuals publishing content on social media should be reminded to adhere to all laws and regulations.

F. Confidential information: Be careful not to deliberately or inadvertently disclose confidential information, either organization information or patient information.

G. Identification: Identifying yourself as an employee of an organization associates all of the content you publish with your place of work. Only create content that is consistent with the professional standard to which you wish to be associated.

H. Personal responsibility: Individuals are responsible for any content they publish on social media sites.

I. Don’t “fight” online: Avoid unnecessary arguments. Provide any conversation “counterpoints” in a respectful, factual manner.

J. Trust your instincts: Review the content you are about to publish. If it gives you the slightest pause, delay publication until you are certain the content is appropriate.

A. Crossing Rivers Health shall have the right to monitor, prohibit, restrict, block, suspend, terminate, delete or discontinue an employee’s access to the hospital’s Social Media Site, at any time, without notice and for any reason and in its sole discretion.

B. Employees shall be sanctioned if it has been discovered that protected health information has been breached.

1) Any staff member who knowingly/willingly breaches confidentiality/security of data or information may receive, at a minimum, a written disciplinary warning; at a maximum, possible termination.

2) If the breach of confidentiality was committed accidentally, with no intent to violate confidentiality or security of data/information, all efforts will be made to provide education to the responsible staff member to eliminate repeat incidents.

C. Sanctions shall be applied against employees who fail to comply with the security policies and procedures to ensure the integrity of protected health information.