304.293.3631Option 3

Use of Social Networking Sites, Blogs, and Instant Messaging

In accordance with HIPAA, FERPA, and WVU Health Sciences Center IT policy, please be advised that faculty, staff, residents, and students are not permitted to post confidential patient information, including protected health information (PHI), educational records protected by FERPA, institutionally-owned asset data, confidential, proprietary, or private information on any social networking sites (Facebook, MySpace, Twitter, YouTube, etc.), personal / business related blogs, and/or instant messaging service.

Make sure you understand the permanency of published material on the Web, and that all involved in health care have an obligation to maintain the privacy and security of patient records under HIPAA and that WVU fully complies with protecting the privacy of education records under FERPA policy.

Always comply with the current institutional policies with respect to the conditions of use of technology and of any proprietary information such as university logos. 

Finally, please note that Facebook, MySpace, and other social networking sites are increasingly being targeted by cyber-criminals drawn to the wealth of personal information supplied by users.  Data posted on the sites (i.e. name, date of birth, address, job details, email and phone numbers) is a windfall for hackers.  Viruses on these networks can hijack the accounts of social networking site users and send messages steering friends to hostile sites containing malware, a malicious software often designed to infiltrate a computer system for illicit purposes.  Malware can be used to steal bank account data or credit card information once installed on a personal computer.  Another danger of social networking sites are the popular quizzes, horoscopes and games made available for free to users which can sometimes be used to hide links to hostile sites.       
 
Examples of information that should not be shared on social networking, blog sites, and instant messaging services are: 

• Reporting on or about official medical activities and/or patient’s personal health information.
• Requiring patients to participate in “social networking” activities to influence or maintain the provider/patient relationship.
• Posting of and/or the discussion of student grades, evaluations, course feedback, etc.
• Reviewing profiles of patients. 
• Participating in activities that may compromise the provider/patient or faculty/student relationship.
• Providing medical advice on social networking sites.