Healthcare Social Media Policy Template
A HIPAA-minded social media policy for your staff: who may post for the practice, what never gets posted, how to answer online reviews without disclosing anything, when patient photos are allowed, and how personal accounts are handled. Edit it, then print it for signatures.
Pre-filled for a small practice with an official Facebook and Instagram page. Edit the accounts, approvers, and response wording, then print it for staff to sign or copy it into your policy manual.
Social Media Policy
Applies to all workforce members, on practice and personal accounts
1.Purpose and scope
2.Never post
3.Responding to online reviews
4.Photos, videos, and testimonials
5.Personal accounts
6.Enforcement and acknowledgment
Workforce member signature
Date
This policy is a template, not legal advice. Have it reviewed against your state's employment and privacy laws, and keep signed acknowledgments with your HIPAA training records.
Why a Healthcare Practice Needs a Social Media Policy
Most social media problems in healthcare are not hacks. They are a staff member posting a photo with a whiteboard in the background, or an office manager answering a bad review with a little too much detail. HIPAA applies to all of it, because confirming that someone is your patient, or describing their visit, is a disclosure of protected health information.
A written policy gives staff a clear line before they post, and it gives the practice something to point to if a post does go wrong. HIPAA requires you to train your workforce on your privacy policies and to apply sanctions when they are not followed, so the social media rules belong in the same manual.
Can a Practice Respond to Online Reviews Under HIPAA?
Yes, but only without revealing anything about the reviewer's care, including the fact that they are a patient. HHS has settled cases over exactly this. In October 2019 a dental practice paid $10,000 to settle over social media disclosures of patients' health information, and in June 2023 HHS announced an agreement with a New Jersey provider that had disclosed patient information in response to negative online reviews.
A safe review response
Patient Photos, Stories, and Testimonials
Posting a patient's photo, quote, or story requires a signed authorization that meets 45 CFR 164.508: it has to name what will be shared, with whom, for what purpose, and when the permission expires, and the patient can revoke it. Use our HIPAA release form generator and keep the signed form before anything goes live.
Before-and-after photos
Dental, dermatology, and cosmetic practices post these most. Crop out anything identifying you do not have permission for, such as tattoos, jewelry, or a face, and never post from a personal phone that also holds other patient images.
Rolling Out the Policy
- Have every workforce member sign it at hire and once a year, and file the signature with your training log.
- Add a short social media module to your HIPAA training.
- Limit who can post on official accounts and turn on two-step verification for each one.
- If a post with PHI goes up, take it down, then treat it as a security incident and run the incident report.
The policy fits alongside the rest of your HIPAA policies and procedures.