Should I Interact With Patients on Social Media?

Carolyn Buppert, MSN, JD


January 03, 2018

To submit a legal/professional nursing question for future consideration, write to the editor at (include "Ask the Expert" in subject line).


Friends With Patients on Social Media?

Response from Carolyn Buppert, MSN, JD
Healthcare attorney

A reader asks, "Is it a violation of the Health Insurance Portability and Accountability Act (HIPAA) if a group of patients who were in a class together are social media friends with the clinical staff? Seldom—maybe never—does anyone discuss anything medically personal. It's more of a support group that is just keeping in touch and perhaps sharing something they found on the Internet, such as a positive meme or letting others know if someone in the group has passed away." The staff members recently unfriended everyone, stating that it is a HIPAA violation if they are friends with any of their patients.

The answer to this question is controversial, judging by articles already posted online by various organizations. See, for example, Katherine Chretien's Should I Be "Friends" with My Patients on Social Networking Web Sites? and Committee Opinion No. 622: Professional Use of Digital and Social Media, published in Obstetrics & Gynecology.

On the positive side, clinicians may learn of patients' concerns and informational needs, and in response post helpful information on social media. Being involved in patient support is certainly a worthy endeavor. On the negative side, the potential for violating HIPAA; crossing a professional boundary; or, in the case of befriending patients on one's personal page, giving out too much personal information such that the patient doubts the clinicians' professionalism and credibility is a risk.

Different Standards for Clinicians and Patients

A patient may share whatever he or she wants on social media. However, clinicians need to follow HIPAA's dictates, which say that a clinician may share a patient's protected health information only for the purpose of treatment, payment, and healthcare operations. Use of social media isn't treatment. So, clinicians can't disclose any "protected health information," which is any information created or received by a healthcare provider relating to the past, present, or future physical or mental health or condition, including demographic information and any healthcare provided. For information on deidentifying patient information, see Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.

Appropriate professional boundaries conducive to a therapeutic relationship fall somewhere between underinvolvement and overinvolvement, but exactly where that "somewhere" is is not clear. The perfect balance depends on how the clinicians portray themselves online and how they handle any back-and-forth with the patients. For a discussion on boundaries, see the National Council of State Boards of Nursing document A Nurse's Guide to Professional Boundaries.

As for fostering professional credibility, a clinician can highlight his or her expertise through social media. On the other hand, a clinician could demonstrate lack of judgment, if posting unprofessional photos or divulging protected information about patients.

Clinicians who are afraid of crossing boundary lines or violating HIPAA and opt out of interacting with patients on social media as a result could be missing ways to serve their community, market their expertise, and foster community among patients with a common illness or condition. So, let's work it through using examples of appropriate and inappropriate use of social media.

Examples of Social Media Use

A practice with a social media presence. The clinician is an oncology healthcare provider whose practice has a social media page, which some patients choose to subscribe to or "friend." The practice posts relevant news articles, journal articles, and articles written by the staff. Clinicians monitor the discussion, and when there is interest in a particular topic, a clinician posts an article on that topic. The subscribers comment on the articles. Subscribers or "friends" who are patients might disclose things about themselves to the other commenters and viewers. However, the clinicians do not give out advice on the site to individuals, nor do they comment on any individual's problems or progress.

In my opinion, this is appropriate and legal use of social media. In this example, the clinician is not disclosing information about a patient. If a patient subscribes or comments and uses his or her own name, then the patient may be revealing something, even protected health information, about himself or herself. That's all legal under HIPAA. I see no HIPAA, boundary, or professional credibility issue in this example.

A clinician's personal social media page. In this example, a clinician has his or her own personal social media page, where the clinician posts vacation photos, memes, and cute cat photos. Some patients of the clinician ask to be friended, and the clinician accepts. The clinician doesn't have a separate professional page—just this personal page. A patient uses his own name and posts a comment to a picture, "Too bad my allergies prevent me from having cats." If the clinician responds, "Yes, but if you take that medication I prescribed, it would lessen the symptoms," that could be a HIPAA violation.

That does not mean the clinician shouldn't befriend the patient on social media; it just means the clinician shouldn't reveal that there is a patient/physician relationship or reveal anything about the patient's medical condition. Furthermore, the clinician should maintain awareness that patients, potential patients, employers, potential employers, and faculty members may be viewing the clinician's personal material. In addition, clinicians need to remember that the postings are documented forever, even if taken down.

The Bottom Line

If a clinician thinks it is too burdensome to be constantly attentive to what he or she says or posts on social media, then it may be best to avoid social media or, at minimum, to think twice about each post before posting. The clinician may also decide to set a personal policy not to befriend patients on social media, and may tell patients about that policy. I don't know how it affects a patient when a clinician declines a friend request.

A final consideration is that clinicians will want to be sure they aren't initiating a "duty of care" to an individual through social media. Duty of care is one element of malpractice. An individual cannot sue a clinician for malpractice if there is no duty of care. So one risk-reduction strategy for clinicians is to limit "duty of care" obligations to those seen in clinic, office, or facility. Some clinicians post disclaimers on their professional social media pages, such as "What I post here is general medical information and not meant as individualized advice. For personalized information or advice, suitable to a reader's situation, readers should consult their healthcare provider."


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.
Post as: