Jackson Health Investigates Social Media HIPAA Violation Involving a Nurse

Jackson Health is investigating a privacy violation after photos of a baby that has a birth defect were posted on Facebook by a nurse.

A nurse who was employed in the neonatal intensive care unit at Jackson Memorial Hospital shared two pictures on Facebook of a baby having gastroschisis – an uncommon birth defect of the abdominal wall that could make the intestines stick out from the body. The pictures included the captions, “Your intestines posed (sic) to be inside not outside baby! #gastroschisis” and “My night was going great then boom!” The troubling photos were published on accounts that belong to Sierra Samuels.

The sharing of images of patients on social platforms without authorization is a serious violation of patient data privacy. Pictures of patients are considered as protected health information (PHI) and publishing pictures on social media platforms, even in closed Facebook groups, is a violation of the Health Insurance Portability and Accountability Act (HIPAA) except if prior consent is acquired from the patient.

HIPAA calls for healthcare organizations to provide privacy policy training to personnel. Training should be given within a sensible time frame after a staff joins a covered entity’s staffing and training need to be routinely reinforced. The best practice is to give refresher HIPAA privacy instruction yearly. A sanctions policy should also be created and enforced that clearly states the sanctions workers will deal with in case they violate the HIPAA Laws.

After being informed about the social media posts Jackson Health started an investigation into the privacy breach and quickly placed the nurse on administrative leave impending the outcome of the investigation. Safeguarding patient privacy is the first concern at Jackson Health System. Any probable privacy breach is taken seriously and carefully investigated, stated a Jackson Health spokesperson. Jackson Health additionally confirmed that when staff break patient privacy, in spite of the training, they will be under disciplinary action which may include suspension or dismissal.