Social media consults may harbor dangers
■ When is an online network a good choice for consultations?
Scenario: Online curbsiding offers advantages, but also poses some legal and ethical dangers. Physicians are advised to be aware of the circumstances and restrictions under which such consults are both professionally acceptable and beneficial to the patient.
Reply: In a recent episode of the medical TV series "House," two main characters -- young, smart physicians -- are stumped by a particularly difficult case and decide to send out a request for help on the Internet. They receive a wide range of opinions, including one that resolves the case. In an added twist, the physicians do not disclose to the master clinician, protagonist Dr. House, the source of their brilliant inductive diagnosis.
The truism "Two heads are better than one" applies well to the complex realm of modern medicine. Physician consultation with expert colleagues is important to medical practice. Failure to consult can be a successful allegation in medical malpractice actions.
As the nation moved online to the Internet, so did physicians. In a recent study by Google, 86% of U.S. physicians said they use the Internet to gather health, medical or prescription drug information. Internet technology allows physicians to also offer their opinions on medicine, or other matters, through blogs (including links to other sources of information) and to consult colleagues by e-mail and through social networking.
Using electronic technology to facilitate consultations with physician colleagues is not new. Telephone consultation is a long-established way to transmit patient information for expert opinion. E-mail communications among physicians have become widespread, although communicating with patients by e-mail has not.
Social networking is the online connection of people who share interests or activities in groups or communities such as Facebook, MySpace and LinkedIn. Twitter is a service for sending short text messages ("tweets") to an online community of subscribers (called followers) who, in turn, can tweet to other followers.
Social networking has tripled in the past year, a Nielsen Company survey showed, and physicians have joined the social networking revolution. According to a survey by Medimix International, 34% of physicians use social media.
The lure of social media is strong. This past year was marked by a new intersection of medicine and social media, with surgeries tweeted live (with patient permission) by surgeons and medical centers.
Physician use of social networking as a means to solicit an array of expert opinions is relatively new. Medically oriented social network communities that are restricted to physicians (some require verification of credentials for membership) include: Sermo, Medscape Physician Connect, Ozmosis and iMedExchange.
With the advent of medically oriented social media, physicians can take advantage of online expert consultation with communities of physician colleagues from across the country -- and beyond -- to weigh in on complex and vexing problems. These physician-only sites invite physicians to post questions, to discuss and, in some cases, to solicit opinions from colleagues.
This ability to obtain expert advice from a social media community can benefit patients greatly, but it is not an unalloyed good. With this benefit comes the concomitant ethical and legal concerns about preserving patient confidentiality and protecting patient privacy.
The Hippocratic mandate for physicians to maintain confidentiality is more than two millennia old. The physician, who holds information that was disclosed in the patient-physician relationship, has an ethical -- and legally enforceable -- duty of confidentiality. Disclosing confidential information to an unauthorized person is a breach of that confidentiality, even when it is an inadvertent disclosure. A third party who intentionally obtains unauthorized medical information violates the patient's privacy.
Concerns about patient confidentiality became even more heightened with the introduction of the electronic medical record and widening access to the Internet. Persons who might obtain unauthorized access to a patient record could broadcast that information to almost anyone. In some well-known instances, online disclosures were made about medical conditions of famous people.
The Health Insurance Portability and Accountability Act contains privacy provisions, in part, to counter the increasing challenges posed by electronic medical records and electronic transmission of information. HIPAA applies to electronically transmitted or stored protected health information and sets civil and criminal penalties for violations. HIPAA also specifies 18 "identifiers" that must be removed before health information can be considered de-identified information that is not personal data.
According to the Dept. of Health and Human Services, consulting "with another health care provider about a patient is within the HIPAA Privacy Rule's definition of 'treatment' and, therefore, is permissible. In addition, a health care provider ... is expressly permitted to disclose protected health information about an individual to a health care provider for that provider's treatment of the individual."
Nonetheless, an online consultation using social networks can go wrong in myriad ways. The dissemination of patient information in an electronic form to an open forum is fraught with risk. The relative openness and permanence of online postings in nonsecure areas should preclude use, even with de-identified patient information. The patient's identity may become obvious from enough information or inference.
One might think that confidentiality of medical information needs to be especially reinforced among the new generation of physicians who are more comfortable with social media. But there is some evidence that medical students understand the importance of patient confidentiality in online postings. A 2009 survey of medical school deans in the Journal of the American Medical Association concerning unprofessional comments made by medical students online showed that, although most respondents (60%) had encountered incidents of unprofessional postings by students, postings that violated patient confidentiality were extremely rare (six incidents among all respondents).
Restricting consultation to an online medical community of verified physician colleagues can reduce the likelihood that information would enter an unsecured area of the Internet.
Pitfalls for those who would consult an online medical community include:
- Inadvertent disclosure to individuals other than health care personnel who are providing consultation.
- Security breaches at the online medical site that would allow nonauthorized users to access or publish the information on the Internet.
- Misuse of patient information by any of the health care professionals who are providing consultation.
- Intentional deception by an individual posing as a health care professional.
- Intentional disclosure by a health care professional of identifiable information to a nonsecure open social network. A recent egregious example of open network posting: In January, the BBC reported that photos of patients having operations were posted on Facebook without their permission.
Each of these pitfalls presents a risk of legal action for unauthorized disclosure and violation of HIPAA.
What factors should be weighed in considering when online consultation in a medical social network would be acceptable?
First, how likely is an online consultation to produce an opinion that is better than those available locally? If a nonlocal opinion would be more likely to benefit the patient, consider whether secure e-mail to a specific consultant would be as effective as the use of a social network of physicians. If an online consultation through a medical social network would be likely to benefit the patient, and the risks of disclosure are minimized, then consider using a secure HIPAA-compliant, physician-credential-verified network site with secure transmission in communication.
Even with a secure HIPAA-compliant network with credential-verified physicians using secure transmission, it is important to ensure that case descriptions not include HIPAA-protected identifiers and use as few details as possible that could connect a specific patient or individual to the information. As the patient becomes more identifiable, the risk of breach of confidentiality increases. For example, even a few details involving a unique diagnosis might be able to be connected to a patient. Consider consulting only with the minimum number of identified and verified physician-consultants needed to provide advice necessary for patient benefit. Even when observing these precautions, be aware that online expert colleague consultation entails significant ethical and legal risk. (Note that the information and opinions expressed in this article do not constitute legal advice. Readers are advised to consult with appropriate legal advisers in their own jurisdiction).
The potential benefit to the patient of a discussion with national expert colleagues brings with it concomitant ethical and legal risks of breach of confidentiality, violation of privacy and violation of HIPAA regulations.
We know what the hip physician characters on "House" would do, but what would Hippocrates do? Whether Hippocrates and his followers would have used technology to widen their access to expert opinions in difficult cases is an unanswerable question. But we know that they held confidentiality in paramount esteem. Any consideration by physicians of online consultation with expert colleagues in a social network should begin with the tweetable Hippocratic aphorism, "First, do no harm."
Arthur R. Derse, MD, director for Medical and Legal Affairs and interim director, Center for the Study of Bioethics; professor of Bioethics and Emergency Medicine, Medical College of Wisconsin