#NOFILTER: A CRITICAL LOOK AT PHYSICIANS SHARING PATIENT INFORMATION ON SOCIAL MEDIA ELISSA TUCCI* I. INTRODUCTION A. The Issue: Social Media Is Ripe for HIPAA Breaches Despite long-standing privacy rules set out in the Health Insurance Portability and Accountability Act (“HIPAA”), blatant violations have made headlines as recently as September 2017 when disturbing images posted to Snapchat by nurses at a naval hospital went viral.1 One image depicted a nurse flipping her middle finger at an infant with the caption, “[h]ow I currently feel about these mini Satans.”2 Another post was a video of a nurse mishandling a newborn by making it appear to dance as music played in the background.3 Such violations are clearly problematic for numerous reasons, including the erosion of patient trust.4 A cornerstone of the patient-physician relationship is that the patient can reasonably rely upon the physician to maintain confidentiality of private health information, including information divulged by the patient “about [his or her] health, symptoms, and medical history.”5 It is imperative that physicians maintain confidentiality in order to receive complete and accurate information about the patient, because “[i]n the absence of full and accurate information, there is a serious risk that the treatment plan will be inappropriate to the patient’s situation.”6 Patients need to have trust in their physicians that their private health information will not be inappropriately disclosed, which, in turn, ensures patients continue to freely provide that information. As the use of social media becomes more integrated in society, physicians have begun to incorporate its use in daily practice.7 Professional use of social * J.D. Candidate, 2019, Indiana University Robert H. McKinney School of Law; B.A. History and Political Science 2012, Saint Mary’s College. 1. Kristine Philips, Disturbing Images Show Navy Hospital Staffers Mishandling Infant, Calling Babies ‘Mini Satans’, WASH. POST (Sept. 19, 2017), https://www.washingtonpost. com/news/checkpoint/wp/2017/09/19/disturbing-images-show-hospital-staffers-mishandling-an- infant-calling-babies-mini-satans/?utm_term=.77506ecc1ba5 [https://perma.cc/AQ76-HES4]. 2. Id. 3. Id. 4. Charles Ornstein, Small Violations of Medical Privacy Can Hurt Patients and Erode Trust, NAT’L PUB. RADIO (Dec. 10, 2015, 4:59 AM), https://www.npr.org/sections/health- shots/2015/12/10/459091273/small-violations-of-medical-privacy-can-hurt-patients-and-corrode- trust [https://perma.cc/DMX8-HE6B]. 5. See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462-01, 82,467 (Dec. 28, 2000) (to be codified at 45 C.F.R. pts. 160 & 164). 6. Id. 7. Taylor Bryant, Why We Can’t Get Enough of Snapchat Surgeries, REFINERY29 (June 6, 2016, 6:00 PM), http://www.refinery29.com/2016/06/112898/snapchat-surgeons 326 INDIANA HEALTH LAW REVIEW [Vol. 16:325 media has been lauded as an “effective method to connect with colleagues, advance professional expertise, educate patients, and enhance the public profile and reputation of [the] profession.”8 However, the concern remains that information posted by physicians to social media must comply with legal standards and meets general standards for ethics and professionalism within the medical community.9 Despite clear laws regarding how to obtain authorization for disclosure of patient health information, any guidance relating to how to professionally or ethically disclose that information on social media is vague at best. Part of the reason behind the ambiguity is because applicable regulations set forth by the Department of Health and Human Services (“HHS”) are not intended to provide definitive measures for implementing safeguards.10 The lack of clear guidelines to assist physicians in crafting social media posts has led to mixed results in the level of professionalism or ethics in posted content. Although this is a concern for all social media platforms, it is particularly problematic in regards to Snapchat, where a number of physicians have been able to amass large followings due to the clinical content they post.11 Snapchat has relatively lax community standards for posted content, enabling physicians to post raw, graphic glimpses into their days in almost real time.12 This form of posting in real time can have serious consequences because content posted on Snapchat rarely undergoes the same rigor of review given to posts on other media platforms. Snapchat’s lax community guidelines concerning content, coupled with current ethical standards that need updating and clearer definitions, creates a breeding ground ripe for privacy violations. Ameliorating the problems associated with physicians’ use of social media will require implementing a professional responsibility test, creating clear guidelines, or even imposing a heightened duty on physicians who post to social media. B. Roadmap Section II of this Note will examine the growing role social media plays in the practice of modern medicine. Although they developed from humble origins, the giants of social media now play a tremendous role in shaping the way people [https://perma.cc/38UM-PVKS]. 8. KERRY ANN HAYON ET AL., MASS. MED. SOC’Y, A GUIDE TO SOCIAL MEDIA FOR THE PHYSICIAN PRACTICE 12 (2014). 9. Katherine C. Chretien & Terry Kind, Social Media and Clinical Care: Ethical Professional, and Social Implications, 127 CIRCULATION 1413, 1413-21 (2013). 10. Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462-01, 82,562 (2000) (to be codified at 45 C.F.R. pts. 10 & 164) (“We do not prescribe the particular measures that covered entities must take to meet this standard, because the nature of the required policies and procedures will vary with the size of the covered entity and the type of activities that the covered entity undertakes.”). 11. Bryant, supra note 7. 12. Community Guidelines, SNAPCHAT, https://support.snapchat.com/en-GB/a/guidelines [https://perma.cc/M9ZS-GGPW]. 2019] #NOFILTER 327 interact through online communications. Snapchat first launched after the more well-known platforms, like Facebook and Instagram, had already solidified their influence. However, Snapchat’s innovative features and transitory nature carved an unmistakable niche into the landscape of social media. In recent years, physicians have begun to incorporate Snapchat into their daily office routines, including regularly posting consultations and follow-ups with actual patients. This move has reaped tangible benefits for these physicians in the form of improved patient trust and increased booking rates for procedures. Yet, due to the nature of the content, these types of posts have been met with skepticism from other physicians and media alike. Section III will lay out some of the important regulations that preserve patient privacy and check the free distribution of information across social media platforms. This section of the Note will examine HIPAA’s Privacy Rule, which sought to protect patient information in the increasingly digital age, and reveal what providers need to do in order to post patient information on social media. This section will also examine guidelines that medical administrative bodies, such as HHS, the American Medical Association (“AMA”), and the Federation of State Medical Boards (“FSMB”), have issued in an attempt to establish standards for proper behavior on social media. Section IV takes a hard look at whether the current climate for social media use in the practice of medicine is over- or under-regulated. Federal and state laws are surprisingly sparse when it comes to this cutting-edge dilemma. Of the existing cases and laws that address this issue, most give deliberately vague guidance. Major medical groups tend to defer to these laws, leaving doctors with more questions than answers. In an effort to avoid the severe penalties associated with HIPAA violations, many major medical groups have enacted blanket bans on physicians posting to social media. As a result, most of the physician Snapchat accounts used in the clinical setting belong to independent physicians or to physicians who are part of small group practices. Such accounts tend not to have nearly as much of the administrative policing that is found in larger health care organizations. This Note will then explore how this lack of oversight has led to mixed results regarding the value or ethicalness of posted content and provide examples demonstrative of this range. Section V of this Note will provide some potential suggestions to improve the situation that will preserve the free spirit of Snapchat while curtailing breaches of patient information or unethical behavior. First, the medical field could implement a mandatory medical ethics exam as part of the physician licensing requirements. This examination could mirror the Multistate Professional Responsibility Examination (“MPRE”) that lawyers have to pass. Just as the MPRE is based upon the American Bar Association’s (“ABA”) Model Rules of Professional Conduct, the AMA could expand on its Code of Medical Ethics, which could then be tested by the FSMB. Secondly, while existing laws or guidelines have provided a barebones framework for the issue, they lack clear, specific language to inform proper standards for physician social media behavior. An update providing this much needed clarity would be valuable to make informed choices before uploading any content. A third proposal explores whether the imposition of a heightened duty for physicians who post to social 328 INDIANA HEALTH LAW REVIEW [Vol. 16:325 media would encourage more careful social media practices. Finally, in Section VI, this Note will conclude with outlooks of the future for physicians using Snapchat if these plans are fully executed. II. SOCIAL MEDIA A. Social Media’s Rise to Dominance Social media’s role as a conduit of online communications emerged not long after computers were integrated in the work-place; the late 1970s saw the introduction of virtual newsletters and bulletin boards.13 By the mid-1990s, the creation of GeoCities became the first instance of social networking as we recognize it today.14 This first online community set off a wave of innovation in the late 1990s and beyond; “Blogger (1999), Wikipedia (2001), Myspace (2003), Facebook (2004), Flickr (2004), YouTube (2005), Twitter (2006), and a wide array of ensuing platforms began to offer web tools that sparked old and new online communication tactics.”15 Each new iteration of these platforms was influenced by previous ones and used as a stepping stone for creating new, innovative ways to communicate. Since their emergence, “social media platforms have penetrated deeply into the mechanics of everyday life, affecting people's informal interactions, as well as institutional structures and professional routines.”16 By tapping into our underlying enjoyment of social interactions, this wave of platforms, based on user participation, content creation, and interaction, has quickly gained popularity.17 As of August 2017, the estimated number of monthly active users for Twitter, Instagram, and Facebook were 328 million, 700 million, and 2.047 billion, respectively.18 B. Snapchat Changed the Game Although media giants Facebook, Twitter, and Instagram already dominated the market, Snapchat managed to quickly become a major competitor. Since its inception in 2011, Snapchat boasts one of the most unprecedented growth rates of any social networking platform—estimates report the number of active daily 13. Erin K. Wise & Jack D. Shorter, Social Networking and the Exchange of Information, 15 ISSUES INFO. SYS. 103, 103 (2014). 14. Id. 15. JOSÉ VAN DIJCK, THE CULTURE OF CONNECTIVITY: A CRITICAL HISTORY OF SOCIAL MEDIA 7 (2013). 16. José van Dijck & Thomas Poell, Understanding Social Media Logic, 1 MEDIA & COMM. 2, 3 (2013). 17. VAN DIJCK, supra note 15, at 10-14. 18. Brett Williams, There are Now Over 3 Billion Social Media Users in the World—About 40 Percent of the Global Population, MASHABLE (Aug. 7, 2017), http://mashable.com/ 2017/08/07/3-billion-global-social-media-users/#tIwwfvqrkaq0 [https://perma.cc/H4LX-LY2Y]. 2019] #NOFILTER 329 users grew from 10 million to 100 million between mid-2012 and early 2015.19 With 188 million daily active users and more than 10 billion mobile videos viewed per day as of October 2018, Snapchat maintains a modest, yet strong presence in the online community.20 The platform’s defining feature is precisely what allowed it to flourish. While other social networks focus on creating features that allow users to get “#gramworthy” photos,21 Snapchat takes a decidedly different approach by limiting any user-generated content to be ephemeral in nature.22 Due to its roots as a mobile application, Snapchat’s features center on instantly sharing photos or videos wherever its users may have their phones in hand.23 Snapchat differentiates itself from other platforms by taking a contrasting approach to the temporal duration in which content may be viewed; whereas traditional social media like Facebook operate “like a modern day time capsule,” Snapchat retains relatively little content for users to later revisit, maintaining an “in-the-moment example of what’s going on.”24 Content shared on Snapchat may only be viewed temporarily, where the length of view time can range from as little as one to ten seconds for direct messages, all the way up to twenty-four hours for content posted to a Snap Story.25 A crucial element of Snapchat’s functionality allows users to select an audience for postings. As opposed to direct Snaps, which can only be viewed by intended recipients, Snap Stories compile the Snaps posted by the user to their story that day and allow potentially anybody to view them an unlimited amount of times for a 24-hour period.26 Like any other social networking platform, users 19. Lukasz Piwek & Adam Joinson, “What Do They Snapchat About?” Patterns of Use in Time-Limited Instant Messaging Service, 54 COMPUTERS HUM. BEHAV. 358, 358 (2015). 20. Snapchat – Statistics & Facts, STATISTA, https://www.statista.com/topics/2882/snapchat/ [https://perma.cc/W8QD-QBXK]. 21. See Teigan Stafford-Bush, Is it #Gramworthy? An Investigation of Self-Concept Clarity, Social Media and Body Related Issues and How This Relates to Teenage Self Presentation on Instagram (2017) (unpublished M.S. thesis, Massey University) (on file with Massey University) (noting how features like filters and hashtags assisted with discovery of content and optimization of profiles). 22. Brian Hart, Snapchat’s Appeal is the Ephemeral Nature of its User-Generated Content, MEDIUM (Oct. 23, 2016), https://medium.com/@bbhart/snapchats-appeal-is-the-ephemeral-nature- of-its-user-generated-content-though-that-ephemerality-b6dfc0c09d6f [https://perma.cc/X8KK- TRBR]. 23. Joseph B. Bayer et al., Sharing the Small Moments: Ephemeral Social Interaction on Snapchat, 19 INFO., COMM. & SOC’Y 956, 959 (2015). 24. Id. at 968. 25. Andrew C. Billings, et al., Permanently Desiring the Temporary? Snapchat, Social Media, and the Shifting Motivations of Sports Fans, 5 Comm. & Sport 10, 11 (2015); Create a Snap, SNAPCHAT, https://support.snapchat.com/en-US/a/capture-a-snap [https://perma.cc/AW68- Z5ER]; My Story, SNAPCHAT, https://support.snapchat.com/en-US/article/view-stories [https:// perma.cc/77MM-YLH7]. 26. My Story, supra note 25. 330 INDIANA HEALTH LAW REVIEW [Vol. 16:325 are given options regarding their privacy settings. For example, in regards to who can view posts, users not only have the option of allowing their posts to be viewed either publicly or only by their friends, but there is also an option for blocking selected individuals.27 Through the use of Stories, some Snapchatters have amassed large followings by giving a glimpse into their daily lives.28 The subject matter or composition of content generated by users exemplifies another way in which Snapchat noticeably diverges from traditional media sharing platforms. Content generated by Snapchat users reflects a carefree attitude, where a majority of the images shared focus on mundane or everyday occurrences.29 Common themes include pets, food, weather, or sharing the viewpoint of the poster’s current location.30 Many posts take the form of “selfies,” where users take a photograph of themselves, “often with an exaggerated expression related to the immediate context.”31 These posts are less concerned with exuding an artistic expression and, instead, embrace realism to its furthest extent. Snapchat has a clear understanding of how its user base utilizes the platform, and the platform even goes so far as encouraging these deliberately bad32 images by providing “face lenses” and “world lenses” to superimpose over images.33 Available lens options have included flower crowns, animal caricatures, and face swapping effects.34 This focus on extemporaneous, raw multimedia sharply contrasts with the polished works encountered on Instagram, where users strive to carefully cultivate and curate content to achieve a desired aesthetic.35 Snapchat’s privacy policy also distinguishes it from its peers. Content is automatically deleted by Snapchat’s servers.36 The photos and videos exchanged are not only deleted from what the user is able to access, but Snapchat also 27. Privacy Settings, SNAPCHAT, https://support.snapchat.com/en-US/a/privacy-settings [https://perma.cc/ZH55-8FS4]. 28. Ravi R. Patel et al., Dermatology on Snapchat, 23 DERMATOLOGY ONLINE J. 1, 1 (2017). 29. Bayer et al., supra note 23, at 967. 30. Id. 31. Id. 32. While the phenomenon of posting deliberately bad photographs is not unique to Snapchat, it is certainly ubiquitous on this platform. It is not difficult to spot photos that fit this category. There are a myriad of reasons why a photo may deviate from conventional understandings of what constitutes a good image, including poor lighting, not having the subject in focus, white balance, or even making an ugly face. 33. Face Lenses & World Lenses, SNAPCHAT, https://support.snapchat.com/en-US/a/face- world-lenses [https://perma.cc/WW5L-J7GW]. 34. Grace Palmer, How to Use Filters on Snapchat and the Most Popular Ones, TELEGRAPH (June 30, 2017, 5:27 PM), http://www.telegraph.co.uk/technology/0/use-filters-snapchat-popular- ones [https://perma.cc/E384-PSHX]. 35. Anna Guerrero, How to Establish an Instagram Aesthetic: 10 Brands Doing It Right, HU B SP O T , h t tps://blog.hubspot.com/marketing/establish-an-instagram-aesthetic [https://perma.cc/766R-HMET] (last updated Oct. 31, 2017). 36. When Does Snapchat Delete Snaps and Chats?, SNAPCHAT, https://support.snapchat.com/ en-US/a/when-are-snaps-chats-deleted [https://perma.cc/58XZ-23KU]. 2019] #NOFILTER 331 deletes the content of those Snaps from its servers.37 The timing of the deletion depends on the form of the post—direct messages are automatically deleted once they have been viewed by the recipient and Stories are automatically deleted after twenty-four hours.38 Because of this policy, Snapchat advises its users that it is “unable to provide copies of Snaps to Snapchatters.”39 However, Snapchat is careful to warn users that although content is automatically deleted from its servers, there is no guarantee that other users will not employ their own image- capture software to store copies of Snaps.40 In contrast, other platforms have features to help users produce account content. For example, while Facebook will produce account content in certain contexts, including in response to “a valid subpoena issued in connection with an official criminal investigation,”41 users can produce an archived copy of their account’s content using Facebook’s archival tool, which is accessible through the Settings page.42 Although Snapchat remains relevant in its own right, other platforms like Facebook and Instagram have recognized the value of Snapchat’s key features and have, in turn, created their own versions for use in their applications.43 A perfect example of this can be seen in the rollout of Instagram’s Stories; critics note it feels like a carbon copy of Snapchat’s defining features, down to the “face filters, location tags, stickers, drawing tools, and disappearing photo messages.”44 As often happens in quickly growing markets, competition from Instagram has eroded Snapchat’s base of users to the point that Instagram boasts more daily users than Snapchat.45 Furthermore, for some of the features common to both platforms, some users have indicated a preference for Instagram’s version over Snapchat’s.46 In recent quarters, Snapchat’s growth rate has been sluggish, leading to speculation that Snapchat is struggling to innovate as competition from 37. Privacy Policy, SNAPCHAT, https://www.snap.com/en-US/privacy/privacy-policy/ [https://perma.cc/C35Z-2WSP] (last modified Oct. 1, 2018). 38. When Does Snapchat Delete Snaps and Chats?, supra note 36. 39. Request a Copy of a Snap, SNAPCHAT, https://support.snapchat.com/en-GB/article/snap- content [https://perma.cc/Q2KN-QKD3]. 40. Privacy Policy, supra note 37. 41. Information for Law Enforcement Authorities, FACEBOOK, https://www.facebook.com/ safety/groups/law/guidelines/ [https://perma.cc/KX4Y-APMP]. 42. How Can I Download My Information from Facebook?, FACEBOOK, https://www. facebook.com/help/212802592074644 [https://perma.cc/955H-SWKQ]. 43. Sarah Frier, Instagram Copies Snapchat Again, This Time with Fun Face Masks, BLOOMBERG (May 16, 2017, 9:00 AM), https://www.bloomberg.com/news/articles/2017-05- 1 6 / in s t agram -copies -sn apch a t -aga in -th is -t ime-w ith -fu n -face -m asks -j2 rkfu u t [https://perma.cc/F28S-V8DZ]. 44. Avery Hartmans, We Compared Snapchat and Instagram to Find Out Which App Is Better—Here’s the Winner, BUS. INSIDER (July 22, 2017, 10:00 AM), http://www.businessinsider. com/instagram-vs-snapchat-which-is-the-better-app-2017-7 /# test-no-1-stories-1 [https://perma.cc/LZC8-4VD6]. 45. Id. 46. Id. 332 INDIANA HEALTH LAW REVIEW [Vol. 16:325 other platforms cuts into its market share.47 These trends may be indicative that, while Snapchat, as a platform, could be a fleeting trend, the fundamental features of Snapchat will endure in some form. C. Physicians Incorporating Snapchat into Practice There have been an emerging number of doctors who are on the forefront of integrating social media into their daily practice. One of the first physicians to gain notoriety for the use of social media was dermatologist Sandra Lee, M.D. It all started when she got a marked response to a blackhead extraction video uploaded to her YouTube channel in December 2014; in response, she created an Instagram account dedicated solely to her practice.48 Using this platform, she began regularly posting photos and videos of her patients’ dermatological conditions, the treatment provided, and products from her skin care line.49 Since then, Dr. Lee’s social media presence has ballooned to over “3.1 million YouTube subscribers, 2.6 million Instagram followers, and 2 million Facebook fans” as of January 2018.50 Inspired by the success of Dr. Lee, other physicians followed suit, creating social media accounts to educate the public to the services they provide. Physicians who turned to social media early on soon realized that the graphic nature of their work could run afoul of community guidelines. Plastic surgeon Michael Salzhauer, M.D., or as his fans know him, Dr. Miami, began experimenting with Snapchat after Instagram removed photos from his account in 2015 for violating its terms and conditions.51 The problem? Instagram’s community guidelines clearly prohibit users from posting content containing nudity, including “close-ups of fully-nude buttocks.”52 For physicians like Dr. Miami who showcase work involving nudity, such as breast or buttocks augmentations, such strict guidelines prevented them from making those kinds of posts. However, Snapchat has comparatively lax censorship community guidelines—“depictions of nudity in non-sexual contexts are okay.”53 The upshot of this difference in guidelines was that Snapchat could be the vehicle for 47. Josh Constine, What Is Snapchat, Now That Story Sharing has Stopped Growing?, TECHCRUNCH (Jan. 10, 2018), https://techcrunch.com/2018/01/09/the-ever-ending-story/ [https://perma.cc/MK3N-3PNA]. 48. Liz Krieger, This Pimple-Popping Doc Is Taking Over the Internet, REFINERY29 (Dec. 18, 2015, 4:30 PM), http://www.refinery29.com/2015/12/99665/sandra-lee-dr-pimple-popper- youtube-star#slide-1 [https://perma.cc/34AH-9DS4]. 49. See Sandra Lee (@drpimplepopper), INSTAGRAM, https://www.instagram.com/ drpimplepopper/?hl=en [https://perma.cc/8LAD-48HD]. 50. About Dr. Pimple Popper, DR. PIMPLE POPPER, http://www.drpimplepopper.com/about- dr-pimple-popper/ [https://perma.cc/5Z3L-8N7V]. 51. Bryant, supra note 7. 52. Community Guidelines, INSTAGRAM, https://help.instagram.com/477434105621119 [https://perma.cc/2QQG-NTH6]. 53. Id. 2019] #NOFILTER 333 physicians who wanted to share posts without risk of censure. Dr. Miami stumbled onto this workaround when he became “the first surgeon to broadcast on [Snapchat].”54 Matthew Schulman, M.D., owner of @nycplasticsurg, was next to follow suit and reported that as of September 1, 2017, his professional Snapchat received 4.5 million daily views.55 Through the use of Snapchat, these and similar physicians have sought to provide a window into their work, allowing followers to see everything from patient check-ups to invasive surgeries.56 Physician usage of Snapchat highlights an interesting phenomenon which may explain its mass appeal—a glimpse into a physician’s daily routine of checking patients or performing surgeries sharply juxtaposes with the mundane content uploaded by the average user. Another crucial difference that plays into the popularity of Snapchat physicians beyond that of the average user is “[t]he ‘gawker’ or ‘rubbernecking’ phenomenon, where people can't resist looking at disturbing things.”57 Both characteristics help explain the explosive growth rate in followers recently seen by Snapchat physicians. 1. The Positive Role of Social Media in Medicine Providers utilizing such platforms have expressed the view that social media can be a useful educational tool, help close the information gap between patients and physicians, and enable patients to gain a realistic understanding as to what exactly certain treatments entail.58 Information gaps, or asymmetries, occur when one party to a transaction has greater knowledge than the other. In health care settings, informational asymmetries are common because physicians possess greater medical knowledge than the patient.59 These asymmetries create significant problems because patients end up relinquishing varying degrees of autonomy to the physician when faced with choices related to their care.60 The idea behind closing these gaps is it may ameliorate some of the associated problems by enabling an elevation in the level of discourse between patients and physicians. With this exclusive access to the operating room, prospective patients may 54. Kayleen Schaefer, How to Snapchat a Brazilian Butt Lift: Crossing the Final Privacy Frontier with Dr. Miami, VANITY FAIR (May 13, 2016, 1:42 PM), https://www.vanityfair.com/ style/2016/05/dr-miami-snapchat-plastic-surgery [https://perma.cc/8PCJ-33AK]. 55. Matthew Schulman (@nycplasticsurg), INSTAGRAM (Sept. 1, 2017), h t tps:/ /www.instagram.com/p/BYhK1kUH2m3/?hl=en&taken-by=nycplast icsurg [https://perma.cc/LS67-NHSH]. 56. Bryant, supra note 7. 57. Id. 58. Motherboard, Meet the Plastic Surgeon Who Shares His Surgeries on Snapchat, YOUTUBE (Dec. 13, 2016), https://www.youtube.com/watch?v=jJiY0ImF25Q&index=1&list= PLAeOFONhyY-0N-0gIIrNjlvYxGyYI4-xW&t=125s. 59. NICOLE HUBERFELD ET AL, THE LAW OF AMERICAN HEALTH CARE 39 (2017). 60. Id. at 38-39. 334 INDIANA HEALTH LAW REVIEW [Vol. 16:325 gain a realistic understanding of what they can expect from their own procedures. For example, in an interview, Dr. Miami iterated his belief that it is a common misconception that operating rooms “are always solemn or intense places,” noting that within his practice, the experience is more akin to what one would have seen when watching the television show M*A*S*H.61 The thinking goes, that exposure to this more realistic portrayal will help patients’ viewpoints to undergo a paradigm shift because what they encounter on Snapchat is quite unlike what they have come to expect from watching medical dramas on cable television. Further, it can help illuminate the idea of “standard of care” to patients. There is no one definition for the standard of care.62 In Indiana, the standard of care for physicians has been described to mean that “a physician must exercise that degree of care, skill, and proficiency exercised by reasonably careful, skillful, and prudent practitioners in the same class to which he belongs, acting under the same or similar circumstances.”63 Although it is unlikely that anyone will explicitly describe the standard of care, those who watch may gain a general understanding of what a reasonably prudent physician would do under the circumstances. Snapchat’s ability to expose patients to the standard of care renders it a unique and valuable teaching tool. Moreover, social media can “enable new ways of access to and sharing of information, social support, emphasize collaboration and participation of the stakeholders involved, and increase individuals’ connectivity and enable users’ direct participation.”64 By affording patients the opportunity to view a physician’s portfolio of work and becoming familiarized with their personality, patients are able to choose physicians whom they find agreeable and who produce the type of results they desire. Physicians who have implemented Snapchat into their practice have even reported higher booking rates for patients as a result because it serves as a quasi- prescreening process before any initial consultation has occurred.65 Dr. Schulman shared anecdotal evidence regarding how Snapchat has impacted his patient population, estimating that about eighty percent of patients who schedule consultations are already following him on Snapchat prior to the appointment.66 Another aspect of this self-selection is that patients who find physicians through social media are aware of what type of behavior is shown on post content; some call this level of awareness “the ultimate informed consent.”67 61. Nick Keppler, Out-of-Control Plastic Surgeons’ Snapchat Hijinks Are Putting Patients at Risk, LIFEHACKER: VITALS (Nov. 4, 2017, 12:00 PM), https://vitals.lifehacker.com/out-of- control-plastic-surgeons-snapchat-hijinks-are-pu-1819113914 [https://perma.cc/RZZ3-P49P]. 62. Peter Moffett & Gregory Moore, The Standard of Care: Legal History and Definitions: the Bad and Good News, 12 WESTERN J. EMERGENCY MED. 109, 109 (2011). 63. Vergara v. Doan, 593 N.E.2d 185, 187 (Ind. 1992). 64. Marjorlijn L. Antheunis et al., Patients’ and Health Professionals’ Use of Social Media in Health Care: Motives, Barriers and Expectations, 92 PATIENT EDUC. & COUNSELING 426, 426 (2013). 65. Motherboard, supra note 58. 66. Id. 67. Keppler, supra note 61. 2019] #NOFILTER 335 More to the point, familiarization, by way of social media, can make information as to the expected results more readily available, which in turn alleviates patient apprehension. For example, candidates for plastic or cosmetic surgery often experience anxiety before undergoing the procedures because of the known risks involved.68 Watching reality television shows that focus on cosmetic surgery is associated with improved attitudes towards these procedures. Portraying cosmetic surgery in a positive light increases patients’ receptivity towards subsequent advertising.69 On the other hand, television shows like “Botched” have shed light on how complications during surgery or physician negligence can lead to horrible disfigurement, requiring costly revisionary procedures to remedy.70 When candidates review a physician’s work on Snapchat, it can alleviate some of that anxiety because they have a better understanding of what type of results the physician can routinely produce and the timeline for any recovery after surgery.71 2. Lingering Apprehensions Related to Social Media’s Use In the background of all this innovation are patient privacy rules that predate social media’s existence. HIPAA was enacted nearly two decades ago and saw the addition of a Privacy Rule in 2003.72 Because physicians are posting about patients on social media, it begs the question whether protected health information is being adequately handled.73 In many instances, privacy violations on social media are inadvertent, and the lack of clear social media guidelines for physicians only exacerbates the problem.74 There has also been a concern whether the information posted by physicians to social media not only complies with legal standards, but also meets general standards for ethics and professionalism within the medical community.75 For a topic that has received so much criticism, it is baffling that “there have been no peer-reviewed articles in the plastic surgery literature discussing the ethical implications of such broadcasts.”76 The content physicians post to their social 68. Motherboard, supra note 58; Marlene Rankin & Gregory Borah, Anxiety Disorders in Plastic Surgery, 100 PLASTIC & RECONSTRUCTIVE SURGERY 535, 535 (1997). 69. Joshua Fogel & Kahlil King, Perceived Realism and Twitter Use, 134 PLASTIC RECONSTRUCTIVE SURGERY 233, 233 (2014). 70. Damien W. Riggs & Elizabeth Peel, Tools of Critique, in CRITICAL KINSHIP STUDIES 51, 51 (2016). 71. Motherboard, supra note 58. 72. HIPAA History, HIPAA J., https://www.hipaajournal.com/hipaa-history/ [https://perma. cc/WNN7-GTDJ]. 73. Carleen Hawn, Take Two Aspirin and Tweet Me in the Morning: How Twitter, Facebook, Other Social Media Are Reshaping Health Care, 28 HEALTH AFF. 361, 366 (2009). 74. Kimbra Ratliff, Note, HIPAA Violations on Social Media: Will HHS Continue to Ignore?, 45 U. MEM. L. REV. 633, 648-67 (2015). 75. Chretien & Kind, supra note 9, at 1413-21. 76. Robert Dorfman et al., The Ethics of Sharing Plastic Surgery Videos on Social Media: 336 INDIANA HEALTH LAW REVIEW [Vol. 16:325 media accounts is ordinarily disseminated immediately and rarely undergoes the careful scrutiny applied to other materials distributed, such as journal articles subject to peer review process prior to publication.77 Unfortunately, due to the Internet’s universality and indelibility, anyone can then access that content at any point in the future, meaning “[t]he spread of inaccurate and misinformation is often a concern when it comes to the social health experience”78 Generally, the average person lacks the requisite expertise to discern the reliability or veracity of the medical information he or she comes across on the Internet, which is why it is imperative that medical professionals abstain from disseminating false or misleading information. This corrosion of physicians’ credibility or integrity is not the only storm that the medical profession’s image must weather as a result of social media posts. Carelessness and bad behavior by physicians or staff in the office also have the potential to be placed on public display virally. There is a great deal of concern “about compromising patient confidentiality, or eroding public confidence in the medical profession through posted content containing profanity, discriminatory language, depictions of intoxication or sexually explicit behavior.”79 While some physicians see their content as a more accurate, genuine representation of their work environment, others view the “tawdry, attention-grabbing tactics” used by some of the most popular accounts as an affront to medical ethics.80 Critics concede that images or videos of patients can have educational value; but, when obscene behavior is on display, they worry that such “broadcasts [are] done more for the purposes of entertainment and marketing than education.”81 Specifically, when this type of poor behavior is put on display during surgery, it raises concerns of distorting a patient’s understanding of the surgery such that the patient does not appreciate the serious risks involved when “going under the knife, such as infection, excessive bleeding or possibly blood clots.”82 By glamorizing complex surgical procedures in their posts, physicians may inadvertently trivialize procedures and may be complicit in degrading the high standards to which all physicians hold themselves.83 Finally, even if a patient gives the physician consent to post content from Systematic Literature Review, Ethical Analysis, and Proposed Guidelines, 140 PLASTIC RECONSTRUCTIVE SURGERY 825, 834 (2017). 77. Id. at 833. 78. R. Craig Lefebvre & Alexandra S. Bornkessel, Digital Social Networks and Health, 127 CIRCULATION 1829, 1832 (2013). 79. Tara Fenwick, Social Media and Medical Professionalism: Rethinking the Debate and the Way Forward, 89 ACAD. MED. 1331, 1331(2014). 80. Keppler, supra note 61. 81. Marla Paul, End to Circus in Plastic Surgery Social Media Videos?, NORTHWESTERN: NORTHWESTERN NOW (Oct. 4, 2017, 12:00 PM), https://news.northwestern.edu/stories/2017/ september/end-to-circus-in-plastic-surgery-social-media-videos/ [https://perma.cc/J5TN-RNH8]. 82. Id. 83. Dimitris Reissis et al., Advertising on Social Media: The Plastic Surgeon’s Prerogative, 37 AESTHETIC SURGERY J. NP1, NP1 (2017). 2019] #NOFILTER 337 their interaction onto social media, some question whether that consent was truly voluntary.84 Of note, the physician-patient relationship is inherently hierarchical.85 Thus, the worry is that due to this power imbalance between the parties, “[t]he patient may feel coerced—even if subconsciously—to participate in being filmed in order to be a ‘good patient.’”86 III. REGULATION OF SOCIAL MEDIA IN MEDICINE A. HIPAA and its Privacy Rule At its inception, HIPAA was originally “created to ‘improve the portability and accountability of health insurance coverage’ for employees between jobs.”87 Another goal of the Act includes, among other things, the simplification of the administration of health insurance; this has “bec[o]me a vehicle to encourage the healthcare industry to computerize patients’ medical records.”88 HIPAA’s Privacy Rule was added at a later date and stemmed, in part, from concerns “that advances in electronic technology could erode the privacy of health information.”89 Although constrained in its reach, HIPAA is the most commonly invoked regulation governing health care providers’ ability to disclose their patients’ records and information. When a case is brought in state courts, HIPAA does not fully preempt the extant confidentiality laws.90 HIPAA is limited in who it applies to. The rule is applicable to covered entities, which are statutorily defined to include health plans, health care clearinghouses, and health care providers that transmit specific information electronically.91 More plainly stated, this designation means HIPAA is applicable to people or groups involved in health care, such as physicians, hospitals, insurers, or other similar entities who interact with patients and transmit information about the patient in the normal course of business. 1. Uses and Disclosure of Protected Health Information HIPAA’s Privacy Rule speaks specifically to what type of information falls under its protection. Known as “protected health information” (“PHI”), it refers to certain transmitted or maintained information that is identifiable to patients 84. Paul, supra note 81. 85. Dror Limon & Salomon Stemmer, Doctor-Patient Hierarchy May Have a Therapeutic Role, 351 BMJ h6906, h6906 (2015). 86. Paul, supra note 81. 87. HIPAA History, supra note 72. 88. Id. 89. HIPAA for Professionals, U.S. DEP’T OF HEALTH & HUMAN SERVS., https://www.hhs. gov/hipaa/for-professionals/index.html [https://perma.cc/9GSJ-7GFM]. 90. Nicolas P. Terry, Physicians and Patients Who 'Friend' or 'Tweet': Constructing a Legal Framework for Social Networking in a Highly Regulated Domain, 43 IND. L. REV. 285, 316 (2010). 91. 45 C.F.R. §§ 160.102, 160.103 (2017). 338 INDIANA HEALTH LAW REVIEW [Vol. 16:325 regarding their health status, provision of health care, or payment for health care, and which is created or received by a health care provider, health plan, employer, or health care clearinghouse.92 The Privacy Rule bars covered entities from disclosing PHI except as the Rule permits or requires, or if the entities obtain written authorization from the patient allowing for specific use or disclosure.93 However, the Privacy Rule does not apply to “de-identified” health information. This type of information is such that the patient’s identity cannot be readily determined if viewed by a third party.94 A covered entity is permitted to use or disclose this information without an authorization, regardless of whether it received the information in de-identified form or if the “entity itself took proper steps to ‘de-identify.’”95 Commonly employed techniques for de-identifying written materials include superimposing opaque, black “redacted” bars over anything that could fall under the eighteen types patient identifiers listed in 45 C.F.R. § 164.514(b).96 The same technique can be employed on photographs to obscure facial features, tattoos, or other identifying marks. While it is possible for a covered entity to run afoul of HIPAA for disclosing information that has not been properly de-identified, this type of breach represents only a fraction of HIPAA breaches. As indicated on the “Wall of Shame” published on HHS Office of Civil Rights (“OCR”) website,97 many of the larger HIPAA breaches involve incidences such as hacking, theft, unauthorized access, or losing a device containing health information.98 When it comes to disclosing PHI, the Privacy Rule differentiates between authorizations and consent.99 Providers are permitted, but not required, to get consent to disclose PHI when using the information for treatment, payment or 92. 45 C.F.R. §§ 160.103, 164.501 (2017). 93. 45 C.F.R. § 164.502(a) (2017). 94. 45 C.F.R. § 164.514(a) (2017). 95. Ratliff, supra note 74, at 642. 96. U.S. DEP’T OF HEALTH & HUMAN SERVS. OFFICE FOR CIVIL RIGHTS, GUIDANCE REGARDING METHODS FOR DE-IDENTIFICATION OF PROTECTED HEALTH INFORMATION IN ACCORDANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) PRIVACY RULE 19 (2012). 97. Jessica Davis, HHS Overhauls 'Wall of Shame' Breach Reporting Website, HEALTHCARE IT NEWS (July 26, 2017, 11:29 AM), http://www.healthcareitnews.com/news/hhs-overhauls-wall- shame-breach-reporting-website [https://perma.cc/UQ9C-9PNW]; see also What are the Penalties for HIPAA Violations?, HIPAA J., https://www.hipaajournal.com/what-are-the-penalties-for-hipaa- violations-7096/ [https://perma.cc/SYK6-XPZD] (mentioning the settlement amounts for certain HIPAA violations, including some listed on the OCR “Wall of Shame.”). 98. Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information, U.S. DEP’T OF HEALTH & HUMAN SERVS. OFF. FOR C.R., https://ocrportal.hhs.gov/ ocr/breach/breach_report.jsf [https://perma.cc/CUC5-E4RP]. 99. What is the Difference Between “Consent” and “Authorization” Under the HIPAA Privacy Rule?, U.S. DEP’T OF HEALTH & HUMAN SERVS., https://www.hhs.gov/hipaa/for- professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html [https://perma.cc/4F77-XWAW] (last reviewed July 26, 2013). 2019] #NOFILTER 339 health care operations (“TPO”).100 However, a written authorization must be obtained from the individual patient if a covered entity wants to disclose a patient’s PHI for any use that is not related to TPO, or if the use is not otherwise permitted or required by the Privacy Rule.101 For an authorization to be considered valid, it must be in plain language.102 At a minimum, valid general authorizations must contain the following core elements: (1) “[a] description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;”103 (2) “[t]he name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;”104 (3) “[t]he name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure;”105 (4) “[a] description of each purpose of the requested use or disclosure. The statement ‘at the request of the individual’ is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose;”106 (5) “[a]n expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;”107 and (6) “[s]ignature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.”108 In addition to the core elements, valid authorizations must also contain adequate statements to put a patient on notice regarding his or her right to revoke the authorization in writing, “the ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization,” and that “information disclosed pursuant to the authorization [is] subject to disclosure by the recipient and no longer be protected” by the Rule.109 If a covered entity seeks authorization from a patient, a copy of the signed authorization must be provided to the patient.110 An authorization to disclose PHI must contain all of these elements in order to be deemed valid. 2. Marketing In general, authorizations are required under HIPAA if the disclosure of PHI is for marketing, which is defined as “communication about a product or service 100. Id. 101. 45 C.F.R. § 164.508 (2017). 102. 45 C.F.R. § 164.508(c)(3) (2017). 103. 45 C.F.R. § 164.508(c)(1)(i) (2017). 104. 45 C.F.R. § 164.508(c)(1)(ii) (2017). 105. 45 C.F.R. § 164.508(c)(1)(iii) (2017). 106. 45 C.F.R. § 164.508(c)(1)(iv) (2017). 107. 45 C.F.R. § 164.508(c)(1)(v) (2017). 108. 45 C.F.R. § 164.508(c)(1)(vi) (2017). 109. 45 C.F.R. § 164.508(c)(2) (2017). 110. 45 C.F.R. § 164.508(c)(4) (2017). 340 INDIANA HEALTH LAW REVIEW [Vol. 16:325 that encourages recipients of the communication to purchase or use the product or service.”111 Commonly known examples of marketing include television, radio, printed, and Internet advertisements. There are several types of communications excluded from the marketing rule and, therefore, do not require authorization for disclosing PHI.112 One of these carve-outs is communications in which the covered entity does not receive financial remuneration for making the communication and, generally, are regarding: the treatment of the individual; a description of a “health-related product or service provided by or included in the covered entity’s plan of benefits;” or case management, care coordination, or information provided on alternative treatments.113 Financial remuneration means “direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual.”114 B. Additional Guidelines 1. State Statutes and Case Law Interpreting HIPAA For blatant HIPAA violations where patient information is shared without authorization, state statutes may provide further protections. For example, an Indiana nursing assistant was charged with felony voyeurism after she posted a photograph of a nursing home patient’s buttocks to Snapchat without the patient’s knowledge or consent.115 The incident came to light after it was reported to the nursing home by one of the defendant’s co-workers who received the photo via Snapchat.116 When questioned about taking the photograph, the nursing assistant stated she did it “because she thought it would be funny.”117 After the nursing home conducted an in-house investigation, the police became involved.118 Under the terms of the plea agreement, the nursing assistant had the charge reduced to a misdemeanor, served one day in jail, was placed on probation for 363 days, had to complete forty hours of community service, and paid a fine.119 In a later interview, the nursing assistant acknowledged that she made a mistake, but also appeared to be dismissive over what transpired, stating “[t]hey just blew everything out of proportion…Everybody takes pictures of the residents all the time. I’m not the only one.”120 A ProPublica investigation involving this case and 111. 45 C.F.R. §§ 164.501, 164.508(a)(3) (2017). 112. 45 C.F.R. § 164.501 (2017). 113. Id. 114. Id. 115. Affidavit for Probable Cause at 3, Indiana v. Waller, No. 72D01-1506-F6-137; Plea Agreement, Indiana v. Waller, No. 72D01-1506-F6-137. 116. Affidavit for Probable Cause, supra note 115, at 3; Plea Agreement, supra note 115. 117. Affidavit for Probable Cause, supra note 115, at 3. 118. Affidavit for Probable Cause, supra note 115, at 2. 119. Plea Agreement, supra note 115. 120. Charles Ornstein, Nursing Home Workers Share Explicit Photos of Residents on 2019] #NOFILTER 341 other similar HIPAA violations in nursing homes, found that, as of the date of its investigation, OCR had not penalized any of the nursing homes for these violations.121 However, upon being alerted to these violations, OCR’s Deputy Director for Health Information Privacy expressed outrage, stating “[i]f we don’t have pending investigations on any of these cases…they would be candidates for further inquiry.”122 This case is demonstrative that state statutes, include those which impose criminal penalties, can provide recourse for patients who have had their privacy violated. Further, Indiana has adopted statutes that are substantially similar to portions of HIPAA, including core elements for valid authorizations to disclose health information.123 In order to release a patient’s health record with patient consent, the written consent form must include: the patient’s name and address; the name of the entity requested to release the record; the identity of the recipient; a description of why and what it was being released; the signature of the patient or the patient’s legal representative; the date the written consent was signed; a statement acknowledging the patient’s right to revoke consent “at any time, except to the extent that action has been taken in reliance on the consent”; and a statement regarding when the consent will expire.124 These requirements under Indiana law have been held to be supplemental to HIPAA.125 Unfortunately, Indiana cases do not provide much aid in interpretation; for example, in cases regarding authorization for disclosure, one must meet the required elements.126 For breach of privacy cases in Indiana, little is added to the statute other than interpreting whether the elements for written consent were met.127 One of the few clarifications is that the phrase “to whom it may concern” does not satisfy the requirement that the written consent includes “specific identification of the person authorized to make the disclosure.”128 Additionally, generalized language used to describe merely the recipients of the health information does also not count as a description of the purpose for the disclosure.129 While these additions illuminate whether certain statements will satisfy requirements for written consent, there is still a paucity of guidance for authorized disclosures. Snapchat, PROPUBLICA (Dec. 21, 2015, 8:00 AM), https://www.propublica.org/article/nursing- home-workers-share-explicit-photos-of-residents-on-snapchat [https://perma.cc/RKY6-72JM]. 121. Id. 122. Nursing Home Snapchat Photo Sharing Scandal Uncovered, HIPAA J. (Dec. 22, 2015), https://www.hipaajournal.com/nursing-home-snapchat-photo-sharing-scandal-uncovered-8229/ [https://perma.cc/GFV8-CJQL]. 123. IND. CODE § 16-39-1-4 (2017). 124. Id. 125. Jeffrey v. Okolocha (In re E.J.), 972 N.E.2d 941 (Ind. Ct. App. 2012). 126. Id. at 945. 127. Id. at 945-48; Meridian Health Servs. Corp. v. Bell, 61 N.E.3d 348 (Ind. Ct. App. 2016). 128. Okolocha, 972 N.E.2d at 947. 129. Id. 342 INDIANA HEALTH LAW REVIEW [Vol. 16:325 2. Administrative Guidelines for Social Media Professional and administrative bodies also recognized a growing need for revised health standards as social media grew in popularity. This resulted in many different bodies disseminating suggested guidelines. A common theme among these policies is an emphasis on abstaining from posting patient information.130 This cautious approach can likely be attributed to safeguarding against HIPAA breaches.131 The information set out by HHS does not provide definitive measures that providers can implement in order to avoid breaches, but instead intends for the regulations to act as guidance for entities when they craft their own policies.132 Lacking clear guidance, providers then act in a tightly controlled manner in order to remain in compliance with HIPAA and avoid its costly penalties. HIPAA violations are broken down into four categories, in order of severity, with civil penalties ranging from a $100 to $50,000 fine per violation.133 The maximum fine an entity can be assessed per category is $1,500,000.134 In addition, HIPAA violations can incur three tiers of criminal penalties with prison sentences up to ten years.135 a. American Medical Association guidelines In 2010, the AMA published its own social media policy, “Professionalism in the Use of Social Media,” which attempted to assist physicians in their use of social media.136 This policy contains six provisions, the majority of which are generalized guidelines encouraging professionalism.137 First, the AMA guidelines stress the importance of understanding applicable patient privacy and confidentiality standards, including abstaining from posting PHI on the Internet.138 Second, physicians are urged to utilize available privacy settings for social media accounts, be aware of the potential permanency of any content posted, and be vigilant in ensuring their posts are accurate and appropriate.139 130. Nicolas P. Terry, Fear of Facebook: Private Ordering of Social Media Risks Incurred by Healthcare Providers, 90 NEB. L. REV. 703, 714 (2012). 131. Ratliff, supra note 74, at 654. 132. Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462-01, 82,562 (2000) (to be codified at 45 C.F.R. pts. 10 & 164) (“We do not prescribe the particular measures that covered entities must take to meet this standard, because the nature of the required policies and procedures will vary with the size of the covered entity and the type of activities that the covered entity undertakes.”). 133. What Are the Penalties for HIPAA Violations?, supra note 97. 134. Id. 135. Id. 136. Terry, supra note 130, at 713. 137. Id. 138. Professionalism in the Use of Social Media, AMA, https://www.ama-assn.org/delivering- care/professionalism-use-social-media [https://perma.cc/J66T-673Y]. 139. Id. 2019] #NOFILTER 343 Third, any patient interactions on the Internet must conform to professional ethics guidelines which ordinarily exist within the patient-physician relationship.140 Fourth, physicians who use social media professionally are encouraged to maintain a professional account separate from their personal account.141 Fifth, if a physician becomes aware of unprofessional content posted by a colleague, he or she has an affirmative duty to address the matter with the colleague or, if necessary, to “report the matter to appropriate authorities.”142 Finally, it advises of potential negative impacts resulting from social media posts, including tarnishing of reputations and “undermin[ing] public trust in the medical profession.”143 b. Federation of State Medical Boards guidelines Similarly, the FSMB articulates the idea that “growing concerns about physician use of social media underscore the need for social media policies.”144 As of 2011, over two-thirds of physicians have created social media accounts for their professional practices, reflecting the widespread appeal of such services.145 What is worrisome is that according to a 2010 survey, ninety-two percent of responding medical boards reported online professionalism violations occurred in their jurisdictions.146 The bulk of the reported violations from the study included inappropriate online communication with patients (69%), “use of the Internet for inappropriate practice, e.g., Internet prescribing without an established clinical relationship” (63%), and misrepresenting credentials on the Internet (60%).”147 These numbers are indicative that the scope of the problem clearly cannot be overstated. FSMB guidelines emphasize the importance of maintaining appropriate physician-patient relationships.148 These guidelines advises physicians that the use of social media ought to be done while adhering to the ethical standards of candor, privacy, and integrity.149 Physicians are mandated to protect their patients’ privacy and confidentiality, any breach of which could incur HIPAA violations.150 FSMB’s stance is that no verbal patient identifiers should be stated 140. Id. 141. Id. 142. Id. 143. Id. 144. FEDERATION OF STATE MEDICAL BOARDS, MODEL GUIDELINES FOR THE APPROPRIATE USE OF SOCIAL MEDIA AND SOCIAL NETWORKING IN MEDICAL PRACTICE 2 (2012). 145. Id. 146. Id. 147. S. Ryan Greyson et al., Physician Violations of Online Professionalism and Disciplinary Actions: A National Survey of State Medical Boards, 307 JAMA 1141, 1141(2012). 148. FEDERATION OF STATE MEDICAL BOARDS, supra note 144, at 4. 149. Id. at 6. 150. Id. at 7. 344 INDIANA HEALTH LAW REVIEW [Vol. 16:325 and no pictures of patients should be taken.151 Although the guidelines delve into implementing those ethical standards, the FSMB is silent regarding situations where a physician receives patient authorization to post the patient’s image on social media.152 FSMB is attuned to the plight of the medical profession in that it cautions all social media posts be checked for clarity and veracity due to their far-reaching and perpetual influence once submitted.153 It takes a stand for the medical profession’s image by ensuring that privacy breaches and bad behavior will be subject to disciplinary action from the appropriate state’s medical board.154 This policy is more expansive than what HIPAA alone could safeguard against. By taking a wider stance on physicians’ online activities, the FSMB is attempting to protect the high ethical standards that have taken so long to develop.155 c. Other generalized guidelines Smaller entities have also begun crafting their own social media policies which largely reflect the guidance provided by the AMA and FSMB. The Indiana University School of Medicine, for example, has created social networking guidelines for its students.156 While the guidelines call for professionalism and ethics while using social networking platforms, it is noticeably lacking in specific, practical guidance to help explain what that looks like and, instead, offers only vague, generalized statements.157 Its guidelines serve more as a warning to medical students that there will be internal disciplinary consequences for social media posts “that are either unprofessional or violate patient privacy.”158 It goes on to say that those same posts “can be used in court or other disciplinary proceedings (i.e. state medical licensing boards).”159 Regarding confidentiality, the guidelines also briefly mention HIPAA and institute a blanket ban on photographing patients without written consent.160 There is no mention of de-identifying photos made in the guidelines, likely out of an abundance of caution.161 The Massachusetts Medical Society has also published social media guidelines.162 Unlike many other guidelines, the Massachusetts guidelines state 151. Id. 152. Id. 153. Id. at 8. 154. Id. at 9. 155. Fenwick, supra note 79, at 1331. 156. IND. U. SCH. MED., SOCIAL MEDIA (2018), https://medicine.iu.edu/wp-content/uploads/ 2018/06/31-Social-Media.x42491.pdf [https://perma.cc/5YRP-ZYEK]. 157. Id. 158. Id. at 2. 159. Id. 160. Id. at 4. 161. Id. 162. HAYON, ET AL., supra note 8, at 2. 2019] #NOFILTER 345 that “[c]arefully planned and professionally executed participation in social media by physicians is professionally appropriate,” and can offer numerous benefits when executed correctly.163 It also suggests that physicians disclose any applicable conflicts of interest for their posts by disclosing financial relationships that may exist when discussing particular products or services.164 The remainder of the Massachusetts guidelines is largely duplicative of the policies set forth in the AMA’s guidelines, including the sections regarding confidentiality, utilization of privacy settings, reporting inappropriate content, the impact of social media posts, and maintaining “appropriate boundaries of the patient-physician relationship.”165 Massachusetts expands on the recommendation of keeping separate professional and private accounts by spelling out how physicians should only connect with patients on their professional account and not on personal accounts.166 Like many other recommendations, the Massachusetts guidelines emphasize the importance of de-identifying patient information in order to preserve patient privacy, but they stop short of defining how to do so.167 d. American Society of Plastic Surgery guidelines In light of the generalized guidelines that had been promulgated, the American Society of Plastic Surgeons (“ASPS”) crafted a set of guidelines that seek to address the problem of inappropriate use of social media in a more direct manner.168 Like the other guidelines, these are based on the “four principles of medical ethics [which] include: 1) respect for autonomy of the patient; 2) beneficence or promoting what is best for the patient; 3) nonmaleficence, also known as ‘do no harm’ and 4) justice.”169 What proved challenging in crafting this ethical framework was striking a balance between retaining traditional notions of expected behavior and embracing what it takes to remain relevant in the ever-changing landscape of an evolving society.170 The preamble to the ASPS Code of Ethics includes a warning stating that members could face disciplinary consequences, up to expulsion, for breaking any of its principles.171 No physician may reveal patient information without obtaining the proper consent from the patient first.172 In a move demonstrating receptiveness to the current social media climate, the ASPS does allow physicians to advertise on social media using photographs, so long as it is done in an ethical manner and 163. Id. at 12. 164. Id. 165. Id.; Professionalism in the Use of Social Media, supra note 138. 166. HAYON, ET AL., supra note 8, at 12. 167. Id. at 2. 168. AM. SOC’Y PLASTIC SURGEONS, CODE OF ETHICS OF THE AMERICAN SOCIETY OF PLASTIC SURGEONS 1 (2017). 169. Paul, supra note 81. 170. Id. 171. AM. SOC’Y PLASTIC SURGEONS, supra note 168, at 1. 172. Id. at 2. 346 INDIANA HEALTH LAW REVIEW [Vol. 16:325 cannot be construed as false advertising.173 This conditional acceptance of the practice, rather than outright prohibition, is indicative of a recognition of social media’s intrinsic value. The Code of Ethics provides a fairly detailed explanation of what the ASPS considers false advertising.174 In additional to general prohibitions on propagating false or misleading information, these guidelines include other prohibitions such as testimonials or endorsements pertaining to the quality of care if it does not represent the typical results, giving an opinion regarding the superiority of services if that opinion cannot easily be verified publicly, or appealing “primarily to a layperson’s fears, anxieties, or emotional vulnerabilities.”175 In October 2017, some ASPS members proposed the adoption of additional guidelines in response to the more notorious social media behaviors of some of its members.176 First and foremost, the proposed guidelines stress the importance of obtaining patient consent before making a post.177 Every post should be properly de-identified and the patient should reserve the right to revoke the content at any time.178 The patient also should reserve the right to refuse participation in a physician’s post, and that decision should have no bearing on the level of care administered.179 The physician should always warn the patient that even if a post is deleted from the physician’s social media, there is no way to ensure completely that it is gone forever.180 Plastic surgeons ought to understand and follow the professionalism standards in the ASPS Code of Ethics.181 Lastly, the ASPS suggests its members hire a dedicated social media manager so that patients need not endure any additional time under the knife and physicians do not encounter any needless distractions.182 IV. GIVEN WHAT WE KNOW, IS THIS OVER- OR UNDER- REGULATED? A. The (In)adequacies of Federal Laws and Other Guidelines as a Means of Guidance Despite HIPAA’s express language regarding when disclosure is or is not appropriate and how to obtain valid authorization for disclosure, the law fails to explain exactly what an authorized disclosure should look like. Specifically, Indiana statutes and case law discuss the necessary six statutory elements of written consent for getting authorization to disclose health information. Indiana 173. Id. at 5. 174. Id. at 2-5. 175. Id. at 4. 176. Dorfman et al., supra note 76, at 834. 177. Id. 178. Id. 179. Id. 180. Id. 181. Id. 182. Id. 2019] #NOFILTER 347 cases have provided some clarity by addressing whether the elements were met, such as specifying that the phrase “to whom it may concern” does not satisfy the requirement that the written consent includes “specific identification of the person authorized to make the disclosure,” and stating that generalized language used to describe merely the recipients of the health information does not also count as a description of the purpose for the disclosure.183 However, neither Indiana’s statutes, nor the applicable case law, address what the disclosure of health information should look like once written consent is obtained. Moreover, while social media guidelines by administrative authorities stress the need for social media posts to adhere to legal and ethical standards, these vague generalizations provide little understanding as to what an appropriate post of a patient ought to look like in appearance. To provide better guidance over the issue, more governing entities would do well to adopt clearer guidelines similar to ASPS’s proposed guidelines. B. Fear of HIPAA Violations Has Led to Some Prohibitions of Physician Postings in Clinical Settings It is not uncommon for large health care organizations to have blanket prohibitions against physicians posting about patients on social media.184 The rationale behind this position is to minimize the risk of “violating federal privacy laws by breaching patient confidentiality.”185 Although health care organizations have begun adopting social media policies, there continues to be apprehension towards incorporating its use within clinical settings.186 Unsurprisingly, this may explain why many of the physicians who utilize social media in daily practice tend to belong to small practices or are independent physicians, which do not have the same level of administrative red tape. Further, social media policies adopted by medical schools and employers must navigate potential legal and constitutional challenge arguments.187 For example, after being disciplined in violation of Louisiana State University’s Code of Conduct, one student raised constitutional challenges to provisions of the code, claiming they were overly broad and vague.188 There, the Fifth Circuit Court of Appeals noted that while the Code of Conduct in question was broadly aimed at “speech or conduct that creates an intimidating, hostile, or offensive environment,” this limitation on speech was permissible because the prohibition was limited to “expression [that is] persistent, extreme or outrageous and 183. Jeffrey v. Okolocha (In re E.J.), 972 N.E.2d 941, 947 (Ind. Ct. App. 2012). 184. Kimberly Danebrock, Does Your Medical Office Need a Social Media Policy?, HEALTHCARE IT NEWS (June 1, 2015), http://www.healthcareitnews.com/blog/does-your-medical- office-need-social-media-policy [https://perma.cc/D4G4-JK9L]. 185. Id. 186. Id. 187. Terry, supra note 130, at 720. 188. Esfeller v. O'Keefe, 391 F. App’x 337, 340-41 (5th Cir. 2010). 348 INDIANA HEALTH LAW REVIEW [Vol. 16:325 ‘reasonably likely’ to cause harassment or intimidation.”189 Other challenges to social media policies have claimed they run afoul of the National Labor Relations Act.190 However, it is likely that health care employers can show “an overriding business interest to support policies restricting workplace recordings and social media use given their obligations to protect patient privacy and comply with HIPAA.”191 In Flagstaff Medical Center, Inc., for example, the National Labor Relations Board (“the Board”) upheld a “hospital’s policy prohibiting the recording of images of patients, hospital equipment, property, or facilities.”192 The Board acknowledged that “the privacy interests of hospital patients are weighty” and that the hospital had a “significant interest in preventing the wrongful disclosure of individually identifiable health information.”193 Given that patient privacy issues are implicated even when a physician seeks to post about a patient using one of HIPAA’s safe harbors, it is likely that social media policies crafted by health care organizations will withstand any challenges. C. The Good, the Bad, and the Ugly—Examples of Social Media in Practice Exemplary uses of social media in medicine easily lend themselves as the embodiments of the positive benefits this technology can bring. There are many Snaps uploaded by physicians depicting surgeries where they are explaining each step of the procedure.194 Not only does this expand the knowledge and understanding of the viewing audience, but the process of actively explaining each step can work as a mechanism for avoiding careless errors. It is also common for physicians to use specimens removed during surgery to further explain conditions or topics related to or encountered during the procedure.195 Patients have reported that the medical education they receive by watching the 189. Id. 190. Terry, supra note 130, at 722-24. 191. Denise Dadika, Protecting Patient Privacy in Light of the NLRB’s Scrutiny of No- Recording and Social Media Policies, HEALTH EMP. & LAB. (Dec. 28, 2016), https://www.healthemploymentandlabor.com/2016/12/28/protecting-patient-privacy-in-light-of-the- nlrbs-scrutiny-of-no-recording-and-social-media-policies/ [https://perma.cc/3QXT-XNPR]. 192. Id.; see also Flagstaff Medical Center, Inc., 357 N.L.R.B. No. 65 (Aug. 26, 2011). 193. Flagstaff Medical Center, Inc., 357 N.L.R.B. No. 65, 663 (Aug. 26, 2011). 194. See Chris Miller (@drcrmillertime), INSTAGRAM (June 3, 2017), https://www. instagram.com/p/BU4lSj0gcpw/?taken-by=drcrmillertime [https://perma.cc/27NP-ZEF3] (explaining the subvastus approach to a total knee replacement while pointing out the muscle via manipulation). 195. See Cat Begovic (@beautybydrcat), INSTAGRAM (Sept. 30, 2017), https://www. instagram.com/p/BZrM46XgKmr/?hl=en&taken-by=beautybydrcat [https://perma.cc/YM65- 4VUX] (showing scar tissue removed during capsulectomy and explaining capsular contraction); Matthew Schulman (@nycplasticsurg), INSTAGRAM (Dec. 1, 2016), https://www.instagram. com/p/BNfXM6jDD0b/?hl=en&taken-by=nycplasticsurg [https://perma.cc/SGJ6-X4MG] (showing fold in removed breast implant and explaining how the fold developed and the risks associated). 2019] #NOFILTER 349 content posted by physicians made them more knowledgeable going into their procedures and even helped relieve anxiety.196 Regardless of the benefits, the instantaneous nature of Snapchat leaves open the risk of misinformation or inadvertent disclosure of PHI. For example, in at least one instance, Dr. Schulman posted a photo to Snapchat of his nurse working on patient charts in her office.197 Although no patient information was clearly visible, the possibility of photo enhancing software being used to gather that information is not precluded. Other physicians have observed that the absence of peer review for social media posts has enabled some physicians to advocate for certain techniques, practices, or products “as if they were the gold standard” even though the subjects are still up for debate.198 Even when physicians obtain authorization to post imagery of patients on social media, the audience is usually unaware of the individual authorization and therefore it is difficult for the average observer to determine whether the post is a HIPAA violation or not.199 Further complicating the matter, some physicians implement social media policies regarding their disclosure authorizations which allow patients to choose their desired level of privacy, including whether they speak on camera, allow tattoos or their face to be shown, and so on.200 The lack of physician guidance for creating appropriate social media posts has led to problematic content. Creation of content not only involves uploading a particular image, but also amplifying it using filters, hashtags, captions, and other features. So far, no physician guidelines explain how to use these in a professional manner, which has led to some posts pushing the boundaries of professionalism. Latching onto a popular Snapchat filter shortly after its debut in the summer of 2017, Dr. Miami uploaded to Instagram one of his Snapchat posts showing a patient in the middle of a “tummy tuck” in which a cartoon dancing hotdog was superimposed over the open abdominal cavity.201 Adding to its questionable nature, the hashtag “#litasshotdog” was included with the Instagram caption.202 Ironically, in an interview with Dr. Miami, when asked about this incident, he revealed that the patient in the post found the use of this filter hilarious, adding that he has “never had a patient complain about any filter or bitmoji over the last three years.”203 Another example of questionable social media practices involves a repeated method used by Tarick Smiley, M.D. On numerous occasions, Dr. Smiley has posted videos to his Snapchat showing the results of completed buttock 196. Motherboard, supra note 58. 197. Screenshot of Snap by Dr. Schulman dated Sept. 26, 2017 (on file with author). 198. Rod Rohrich, So, Do You Want to Be Facebook Friends? How Social Media Have Changed Plastic Surgery and Medicine Forever, 139 PLASTIC & RECONSTRUCTIVE SURGERY 1021, 1023 (2017). 199. Id. 200. Screenshot of Snap by Dr. Schulman dated Oct. 3, 2017 (on file with author). 201. Screenshot of Instagram post by Dr. Salzhauer dated July 13, 2017 (on file with author). 202. Id. 203. Keppler, supra note 61. 350 INDIANA HEALTH LAW REVIEW [Vol. 16:325 augmentations while the patients were still under anesthesia on the operating table with his surgical team dancing in the background to the song “Bubble Butt.”204 He followed up at least two of the videos with a photograph of the patient before they were taken out of the operating room and emphasized the new projection of the buttocks by placing a downhill skiing emoji parallel to a line tracing the contour.205 The array of social media practices that vary not only between physicians, but also between different posts by the same physician, illustrates a need for clearer professional guidance. V. SUGGESTIONS TO IMPROVE PHYSICIAN PRACTICES A. Adding a Mandatory Ethics Examination for Physicians The AMA has a Code of Medical Ethics which offers guidance to physicians regarding ethical questions related to the physician-patient relationship.206 While this Code of Medical Ethics is helpful in defining professional standards for physician interactions with patients, not much is said regarding topics outside of clinical practice.207 In contrast, the ABA’s Model Rules of Professional Conduct are a similar set of ethical guidelines, but covers a more comprehensive set of issues confronted by professionals within the legal field.208 For each respective profession, these ethical codes provide the general basis of understanding for appropriate professional behaviors. In general, the vast majority of states require aspiring lawyers to take the MPRE, which examines the understanding of “established standards related to the professional conduct of lawyers” and is based off the ABA’s aforementioned model rules.209 The MPRE is an examination that is required to practice law in addition to the bar exam. Interestingly, although physician board examinations may include a small percentage of questions related to ethics,210 physicians do not have to take and pass an entirely separate examination solely dedicated to ethics 204. Video capture of Snap by Dr. Smiley dated Oct. 12, 2017 (on file with author); video capture of Snap by Dr. Smiley dated Oct. 21, 2017 (on file with author); video capture of Snap by Dr. Smiley dated Jan. 9, 2018 (on file with author); video capture of Snap by Dr. Smiley dated Feb. 6, 2018 (on file with author). 205. Screenshot of Snap by Dr. Smiley dated Oct. 12, 2017 (on file with author); screenshot of Snap by Dr. Smiley dated Feb. 6, 2018 (on file with author). 206. Frequently Asked Questions on Ethics, AMA, https://www.ama-assn.org/delivering- care/frequently-asked-questions-ethics [https://perma.cc/NH44-U4N8]. 207. Id. 208. Model Rules of Professional Conduct, A.B.A., https://www.americanbar.org/groups/ professional_responsibility/publications/model_rules_of_professional_conduct.html [https://perma.cc/SZJ4-AYKR]. 209. Multistate Professional Responsibility Examination, NAT’L CONF. B. EXAM’RS, http://www.ncbex.org/exams/mpre/ [https://perma.cc/X4YP-NBX7]. 210. Step 2CK: Content Outline and Specifications, U.S. MED. LICENSING EXAMINATION, http://www.usmle.org/step-2-ck/#contentoutlines [https://perma.cc/5R2D-BUMC]. 2019] #NOFILTER 351 the way that lawyers do. Adding an ethics requirement for physicians, which parallels the scope and quantity of the professional ethics examination imposed on lawyers, will likely result in a reduction of ethical breaches committed by physicians. B. The Need for More Specific Guidance As noted above, neither laws nor guidelines have provided practical explanations to help physicians craft appropriate social media posts depicting their patients once authorization for disclosure is obtained. Despite continuous emphasis on creating content through a legal and ethical lens, questionable posts by medical professionals continue to make their way onto social media, exemplifying the need for more specific guidance. At the heart of the issue possibly lies the answer as to why eyebrow-raising posts keep happening: how do you keep physicians from posting unprofessional content when it never occurs to them that the content may be viewed as unprofessional in the first place? Another contributing factor may be the multiple, and sometimes competing, ways professionalism is defined, especially in light of interdisciplinary areas.211 These concerns are compounded considering the potential issues associated with a patient request to remove content; there is no way to ensure it was removed completely, because other users may have made copies of the post before it is removed.212 A possible solution to the problem is to simply draft updated administrative guidance that explicitly addresses this area. Given the AMA already has a Code of Ethics, it seems logical to build upon those. In order to craft a more expansive and informed set of rules while presenting a more united front in the medical community, the AMA should get input from other leading medical bodies such as the FSMB. Clarifications that would have a positive impact are those that provide explanations regarding when and how to de-identify patient information in social media posts and what that information includes. Further, specific recommendations should be made to illustrate what an appropriate post looks like. This would include examples of appropriate captions, word choice, use of photo editing tools such as filters, and so on. If guidelines alone are not enough to deter inappropriate behavior, it is still possible that more active approaches to disseminate information about professional use of social media will yield improved outcomes. One possibility is the implementation of educational requirements for physicians regarding the appropriate usage of social media based on the updated guidelines. C. The Imposition of a Heightened Duty to Modify Online Behaviors One last possibility to make physicians more aware of what kind of content they are posting is to impose a heightened duty on physicians when people reasonably rely on information posted to social media by the physician. As 211. Fenwick, supra note 79, at 1332. 212. Dorfman et al., supra note 76, at 827. 352 INDIANA HEALTH LAW REVIEW [Vol. 16:325 mentioned earlier, the average person lacks the requisite expertise to discern the reliability or veracity of the medical information he or she comes across on the Internet, making it imperative that medical professionals abstain from disseminating false or misleading information. It is not uncommon for patients to use the Internet to obtain health information. One study found that ninety-five percent of prospective aesthetic surgery patients sought health information online prior to any consultations with a physician.213 Undoubtedly, the information obtained by patients influences their decision-making. If the information used in making those decisions is false or misleading, this could potentially lead to detrimental results. The aforementioned existing guidelines for physicians already discourage or prohibit unethical online behaviors. However, considering some physicians still engage in problematic online activities, the deterrence power of these guidelines appears inadequate. It is possible that an imposition of a heightened duty could encourage prudent and cautious social media practices. If enacted, this duty would allow a patient who relied on false or misleading medical advice on the Internet and incurred damages as a result to bring a claim against the physician who posted that content on the applicable social media platform. What is not clear is if this duty would have any effect on some of the attention-grabbing tactics physicians on Snapchat currently employ. Even if those tactics are still used, this imposed duty would encourage such posts to have intellectually honest content. VI. CONCLUSION Social media has changed the way in which people communicate and share information. Some physicians note that the use of platforms like Snapchat can be valuably informative tools when used properly. Physicians can use platforms lawfully if HIPAA authorizations are obtained from patients. However, it seems the real issues arise when trying to assure that physicians are making posts in an ethical and professional manner. Current laws and guidelines provide little assistance; those that do tend to be vague and do not help physicians understand satisfactorily what constitutes a proper post, including phrasing of captions, application of filters, and use of hashtags. Given the gap in medical ethics testing, it would seem some of these issues could be best addressed by adopting medical professional ethics testing, similar to the MPRE, based on professional guidelines made by the AMA. The situation could further be remedied by updating the relevant guidelines. If education is not the heart of the issue, making physicians think twice before posting content could also alleviate the problem. Social media has proven to be an effective and useful tool, with little signs of going away anytime soon. Given its vast potential to effectuate positive growth within the medical field, it would be unfortunate if this valuable resource went unused due to the unprofessional conduct of a relatively small number of physicians. Just as medicine has embraced other emerging technologies, social media ought to be incorporated into daily practice, guided by clear standards. 213. Dorfman et al., supra note 76, at 833.