UCI Health Social Media Policy

Applicability

The UCI Health policies are organizational policies applicable to all parts of UCI Health that report to CEO of UCI Health.

These policies apply to:

• All faculty, staff, clinicians, students, contractors and volunteers, (“Workforce Members”), at UCI Health
• UCI Health clinical locations

Purpose

These policies provide UCI Health Workforce Members with “best practice” guidelines for participation in UCI Health-approved (institutional) social media sites, as well as UCI Health non-sanctioned (personal) social media sites in which the employee’s UCI Health affiliation is known, identified or where it is reasonably obvious that the employee's affiliation would be readily identifiable, based on context or other factors.

These guidelines are intended to help you use these sites effectively, protect your personal and professional reputation, and follow UCI Health policies. The guidelines apply to all forms of social media and will continue to evolve as new technologies and social media sites emerge.

Protected Health Information (PHI)

The biggest risk of social media use is the exposure of Protected Health Information (PHI).

PHI is any information that could be used to identify an individual. There are 18 identifiers: names, geographical identifiers, dates, phone numbers, fax numbers, email addresses, social security numbers, medical record numbers, health insurance beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers and serial numbers, website URLs, IP addresses, biometric identifiers (fingerprints, retinal prints or voice recordings), full face photographs and any other unique identifying number, characteristic or code.

Posting any patient health information on social media with or without a patient name and or patient photo - even if the patient’s face is not visible - is a violation of UC policy and prohibited by applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA). Posting other restricted information (any confidential or personal information that is protected by law or policy) including proprietary, confidential information is a violation of law and UC policy and is prohibited. Violations of UC policy are subject to corrective and disciplinary actions.

Policy

I. UCI Health recognizes the value of online social media sites as vital resources to positively promote its mission and values, operational goals, marketing and recruitment activities, as well as a forum for the exchange of information by its Workforce Members. These social media sites may include, but are not limited to, online blogs, podcasts, webcasts, webinars, discussion forums, Wikis, RSS or syndication feeds, video sharing and social networks. (Attachment A: Social Media Glossary)

A. UCI Health as an employer shall neither require nor request an employee or employment applicant to disclose a username or password for the purpose of accessing personal social media.

B. UCI Health, as a postsecondary educational institution, its Workforce Members and representatives, shall not require or request a student, prospective student or student group to disclose a username or password for accessing personal social media sites.

C. Retaliation for failure to provide username and password access to personal social media (or to permit viewing the information in the presence of the employee, applicant or student) is not permitted.

II. UCI Health trusts and expects its workforce (including faculty, staff, trainees, students and volunteers) to comply with UCI Health policies and procedures and state and federal privacy laws. When using social media sites, workforce members are expected to be respectful to UCI Health, our Workforce Members, patients, their family members and friends, customers, our partners and affiliates, and others, including our competitors.

III. Workforce Members covered by this policy and guidelines for institutional and personal use of social media will ensure that their actions reflect UCI Health’s core values of Accountability, Respect, Integrity, Innovation, Service and Excellence.

IV. Existing and New Social Media Accounts

A. If you have already created online content using the UCI Health name and have not already registered your site with UCI Health Marketing & Communications, fill out Attachment C: Registration of UCI Health-Sponsored Social Media Accounts. Email your completed application to HAcontact@uci.edu with the subject line: Social Media Account Registration.

B. UCI Health Marketing & Communications will approach the department chair to request the deletion of any social media accounts that have not had regular, pertinent content posted.

Procedure

A. All social media accounts being used to represent any part of UCI Health must be approved by the appropriate dean, chairs and/or administrative officer.

B. All social media accounts being used to represent any part of UCI Health must be registered with UCI Health Marketing & Communications. To do so, fill out Attachment C: Registration of UCI Health-Sponsored Social Media Accounts. Email your completed application to HAcontact@uci.edu with the subject line: Social Media Account Registration.

C. Clearly state your role with the social media account and the goals of the account.

D. Respect others by acting in a professional manner. Avoid any material that is obscene, defamatory, profane, libelous, threatening, harassing, abusive, hateful or embarrassing to another person or entity.

E. Think before you post. Online information “lives” forever and is available for the world to see; carefully consider the information you share. Review all of your communications to make sure that they are current, accurate and factual before posting. Quality matters.

F. UCI Health reserves the right to monitor, suspend or terminate an institutional social media account, at any time, if warranted.

G. Media inquiries for UCI Health: If you are approached by the media regarding any UCI Health social media account, prior to responding to the media, you must contact UCI Health Marketing & Communications to obtain permission to speak. Email HAcontact@uci.edu with your request.

H. Comply with all UCI Health policies, state and federal legal and regulatory restrictions, privacy and confidentiality agreements, and applicable laws concerning copyright, patents, trademarks and proprietary information. The use or disclosure of a patient’s Protected Health Information (PHI) in social media sites could constitute a violation of the Health Insurance Portability and Accountability Act (HIPAA) and UCI Health policy.

I. Patient consent is required for disclosures to social media sites. The Patient Media Authorization form is available through UCI Health Marketing & Communications. Email your request for a consent form to HAcontact@uci.edu. Include the reason you need a consent form in your request. When the consent form is complete, email a copy back to UCI Health Marketing & Communications. UCI Health Marketing & Communications must have a copy of a consent on file before anything is published about a patient.

J. Content owners are responsible for:

1. Updating UCI Health Marketing & Communications when social media managers change, account users are added or social media accounts are deleted. Email HAcontact@uci.edu for changes to UCI Health accounts.

2. Social media accounts should have at least two administrators, each with unique sign-on credentials, for management and cross-coverage purposes.

3. Maintaining compliance with UCI Health policies concerning patient privacy, HIPAA and conflict of interest, UCI Health branding, and related policies;

4. Obtaining signed HIPAA authorization forms before posting or sharing any protected health information (PHI). Content owners are prohibited from posting or sharing any PHI regardless of where it was first posted (i.e. external media sites) without proper written authorization that is on file with UCI Health Marketing & Communications. This is required for the right to distribute or publicize recordings, photos, images, video, text, slideshow presentations or artwork;

5. Keeping the page content updated and relevant on a continual basis;

6. Monitoring postings and comments to social media sites;

7. Deleting postings which do not adhere to UCI Health policies. Content owners are responsible for obtaining a signed HIPAA authorization form from all involved parties for distribution or publication of free and/or paid rights recordings, photos, images, video, text, PowerPoint files, artwork and ads.

K. The department chair must have access and the ability to log in to their account.

1. UCI Health Marketing & Communications must have administrative access and login information to all university “official” business-related social media accounts by way of administrative platforms of the social network.

2. Workforce members who maintain this information must make it available to the department owner and UCI Health Marketing & Communications at the end of employment.

3. All social media accounts must be registered with a shared UCI email address (e.g., HAcontact@uci.edu) and not an individual’s UCI email address.

i) If your department, lab, program or school does not have a shared UCI email address, contact the Office of Information Technology to request one at oit@uci.edu. ii) Personal, non-UCI Health email addresses are not permitted to register social media accounts under any circumstances.

L. Content Suspension: UCI Health reserves the right to request the modification of content or the suspension of accounts from department chairs on UCI Health-sponsored digital and social media sites within University policy and applicable law.

M. Online Support Groups or Online Health Communities - UCI Health is prohibited from creating, managing or moderating online support groups for patients. Patients or organizations creating such support groups on their own are asked to not use “UCI Health” in the name and may not use any UCI logos or branding as their posts do not represent UCI Health.

N. Policy questions may be referred to UCI Health Marketing & Communications at HAcontact@uci.edu or UCI Compliance at hacompliance@uci.edu.

II. Guidelines for the Personal Use of Social Media Accounts. If you participate in personal social media accounts:

A. Respect confidentiality. Refrain from speculation about the future of UCI Health and its practices. Keep topics focused on matters of public record when speaking about UCI. Do not disclose confidential or private non-public information.

1. If you have any questions about what information is considered proprietary, you should contact the Compliance and Privacy Office at hacompliance@uci.edu.

2. Do not post photos, videos or information about Workforce Members, UCI Health patients or those individuals’ family, friends, etc., without their consent.

B. Never post photographs of a patient.

C. The Internet is a public (and permanent) space. In most cases, everything you post online will be seen by a public audience. Deletion is not a reliable way to remove them from the public record. Expect that your posts and comments on other’s posts can and may be viewed by leadership, patients, prospective patients, the government or the media. Assume everyone is reading your words or seeing your photos, no matter how obscure or secure the site to which you are posting may seem. Remember that anyone can take a screenshot of your activities and distribute them beyond your intended audience. Please be aware that you may be invoking a spotlight with your post. Make sure you are expressing views that you’d feel comfortable discussing or defending publicly.

D. You speak for yourself, but your actions reflect those of UCI Health. Unless you have been authorized by UCI Health, you should not speak on behalf of the entity. Do not portray yourself as a spokesperson, even unofficially, on issues relating to the entity.

1. Personal social media accounts may not use UCI Health in the name and may not use the logo or branding of any of these entities. When engaging in such personal activities, you may not use your University title in any way that would imply that you are speaking for the University.

2. Having your workplace listed as UCI Health on your social media platform can give the appearance of affiliation or representation of UCI Health positions and opinions. Social media accounts that are not sponsored and registered with UCI Health Marketing & Communications should carry a variation of the following disclaimer.

i. “The participant is ______ [a faculty member/staff] at UCI Health. However, the views and opinions expressed herein do not necessarily state or reflect those of The Regents of the University of California, UCI Health, or any entities or units thereof;” or

ii. “All comments here are made in my individual capacity and not on behalf of UCI Health, and are not reviewed or approved by UCI Health or the Regents of the University of California.

iii. Identify yourself and your relationship to UCI Health in any comments on UCI Health social media.

E. No endorsements. Do not use the logos or names for UCI Health-affiliated site to endorse a product or service.

1. A University employee may use his or her University title for identification purposes only.

2. Do not link to or promote for-profit entities, in accordance with the University of California Health Care Vendor Relations Policy. Links to information from accredited, government organizations is permissible.

1. All fundraising activities for UCI Health must be conducted by or in partnership with UCI Health Advancement (e.g. Giving Day, Giving Tuesday). Please contact UCI Health Advancement at supporthealth@uci.edu for more information.

G. Live by the law. Do not post content that violates any federal or state laws and regulations. Obtain permission to use or reproduce copyrighted content. Act responsibly and ethically in online communities. Respect copyright, fair use and financial disclosure laws.

H. Only access your personal social media sites during personal (non-work) time.

I. If someone from the media or press contacts you about postings you have made online relating to UCI Health, you must alert your manager and contact UCI Health Marketing & Communications at HAcontact@uci.edu.

III. Domain Names. All domain names associated with official University names are managed and assigned by the Office of Information Technology (OIT). These domains include uci.edu. OIT can be reached at 949-824-2222 or oit@uci.edu.

IV. Corrective and Disciplinary Actions.

A. California laws (AB1844, SB1349) prohibit employers from threatening or taking retaliatory measures against Workforce Members who fail to comply with employer requests or demands that violate the statute.

B. Violations of UCI Health policies, codes of conduct, or state/federal privacy and information security laws may result in progressive discipline (corrective and disciplinary actions) up to and including termination of employment, the risk of personal civil and criminal fines under state/federal laws, and other legal recourse.  

Social Media Definitions

I. Social and Digital Media: For purposes of this policy, digital and social media activities are defined as any form of electronic communication through which the user creates online communications designed to share information, ideas, pictures, videos, personal messages and any other user-generated content. Digital and social media activities include but are not limited to text, audio, video, images, podcasts, webpages and other multi-media content. This policy applies to all forms of digital and social media and will continue to evolve as new digital technologies and social media sites emerge.

II. UCI-Sponsored Accounts: Official blogs and social media accounts operated by UCI schools, departments, centers, labs or other any other group representing the health system, approved by the deans, chairs and/or administration, and coordinated by University Relations or Medical Center Marketing.

III. Personal Site or Non-UCI Sponsored Accounts: Any account not operating under the control of UCI Health, or under the oversight of UCI deans, chairs and/or administration.

References/Resources/Related Documents

• Health Insurance Portability & Accountability Act (HIPAA) 45 CFR § 160, 162, and 164.
• California’s Confidentiality of Medical Information Act (CMIA) (Cal. Civ. Code § 56 et seq.)
• Federal, “Family Educational Rights & Privacy Act of 1974” (FERPA), State of California, “Information Practices Act of 1977” California AB1844, Employer Use of Social Media, effective 1/1/2013. Employer shall not require or request username and password from Workforce Members or prospective hires' personal social media accounts.
• California SB1349, Social Media Privacy: Postsecondary Education effective 1/1/2013.

Attachments

• A: Social Media Glossary
• B: Privacy and Social Media: What YOU need to know
• C: Registration of UCI Health Social Media Account
• D: Health Care Vendor Relations Policy

Attachment A: Social Media Glossary

1. Social Media: Use of web technologies to transform and broadcast media monologues (one-way) into social media dialogues (two-way); includes, but is not limited to, online blogs, podcasts, webcasts, webinars, discussion forums (chat), Wikis, RSS or syndication feeds, Reddit, video sharing (YouTube), and social networks like Facebook, Instagram, Twitter and LinkedIn.

2. Blog: Short for “Web log,” a site that allows an individual or group of individuals to share a running log of events, images and personal insights with online audiences.

3. Forum: An online site, also known as a message board, where people can hold discussions or conversations, posting messages which may or may not contain images.

4. Podcast: A type of audio file available through the Internet, typically produced as a series that listeners subscribe to for playback on portable media players and personal computers.

5. Post: A status update via photo, video or text on a social media site.

6. RSS Feeds or Syndication Feeds: A family of different formats used to publish updated content such as blog entries, news headlines or podcasts and “feed” this information to subscribers via email or by an RSS reader. This enables users to keep up with their favorite websites in an automated manner that is easier than checking them manually (known colloquially as “really simple syndication”).

7. Social Network: A social structure of individuals or organizations called “nodes” that are connected by one or more specific types of interdependency, such as friendship, family, work and common interests.

8. Screenshot: A digital image of a computer monitor, television or other visual output device. Also called a screen capture or screengrab.

9. Selfie: A self-portrait, which may or may not be shared on social media sites, usually taken with a smartphone.

10. Tag: A keyword added to a social media post with the original purpose of categorizing related content. A tag can also refer to the act of tagging someone in a post, which creates a link to their social media profile and associates them with the content.

11. Thread: A strand of messages which represent a conversation or part of a conversation.

12. Timestamp: The date and time that a message is posted to a social network, usually visible below the headline or username.Timestamps may not always be visible, such as those on the back-end of a website.

13. Twitter: A social network and media platform that enables users to publish 280-character messages along with photos, videos, and other content.

14. Tweet: A twitter post. Tweets can contain up to 280 characters of text, as well as photos, videos, and other forms of media. They are public by default and will show up in Twitter timelines and searches unless they are sent from Protected Accounts or as Direct Messages. Tweets can also be embedded in webpages.

15. Video platforms: Websites or software where users can distribute their video clips, including Facebook, YouTube and Instagram.

16. Webcast: Transmits data one way and does not allow interaction between the presenter and the audience.

17. Webinar: Short for “Web-based seminar,” a presentation, lecture, workshop or seminar that is transmitted over the Web and features interactive elements – the ability to give, receive and discuss information.

18. Wiki: Collaborative information and publishing system that is accessible to internal and external audiences. It allows users to create, edit, and link Web pages easily; often used to create collaborative Web sites (Wikis) and to power community websites.  

Attachment B: Privacy and Social Media: What You Need to Know

Online Social Networking

What is social networking?

Text, photos, video or audio transmitted online and made visible to a third party. Examples of social networking activities include, but are not limited to, social and professional networks such as Facebook, Instagram, LinkedIn and Twitter, as well as sites such as YouTube, Wikipedia (Wikis), Instagram, blogs, podcasts, RSS, video-sharing and texting.

What do I need to know?

1. Be respectful. When using social media sites, do not disclose anything that contains confidential patient information or other proprietary information. It is the hope of UCI Health that our workforce members will conduct themselves online in a manner consistent with our values.

2. Be responsible. Posting any patient health information with or without a name and or photos - even if the patient’s face is not visible - is prohibited. Outside of the workplace, Workforce Members have the right to freely express themselves when online. However, it’s important that what you post never breaches the privacy of our patients’ confidentiality. Patient or legal guardian’s written authorization is always obtained before patient stories, pictures or testimonials are posted.

3. Be aware. Think before you post! There are risks. Online information “lives” forever and social media content has now become “searchable” on the major search engines. Your posts can be screengrabbed by others and shared. Prospective employers are looking at postings. Cyber criminals are targeting social network sites with increasing amounts of malware and online scams.

4. Privacy is paramount. Even if a patient shares information about their care on social media, their privacy must still be respected and their consent must still be obtained before their story is shared. If an employee observes a patient recording or taking photographs, ensure that the PHI of other patients in the area is protected.

5. You have rights. Some patients may wish to take photos or video of their experience at UCI Health. Workforce Members have the right to opt out of being photographed or recorded by patients.

6. Respect copyrights. Only share images and material that you have the right to post (i.e., you either own the copyright or have purchased the copyright). If you are unsure about the rights to an image, contact UCI Health Marketing & Communications at 714-456-5188.

Examples of Inappropriate Postings:

• A trainee took pictures of patients and uploaded the photos to Facebook. − A nurse tweeted, “I’m glad that John Doe (a patient) was discharged. He is the neediest patient on the unit…”
• A clinician posted to a patient’s blog and highlighted aspects of the care provided and the patient’s condition.
• An employee created a Facebook group for patients with a medical condition and invited friends and other patients to join the group.
• A visitor live-streaming a doctor’s explanation of an incapacitated patient’s condition.
• Employee with UCI Health affiliation clearly displayed engaged in bullying/harassment of others.

Attachment C: Registration of UCI Health Social Media Account

Prior to opening a social media account, the department is to register their account with UCI Health Marketing & Communications. Mail your completed form to HAcontact@uci.edu.

• Department name:
• Department Chair/Chief:
• Designated Social Media Account Manager #1:
• Designated Social Media Account Manager #2:
• Social Media Platform 1:
  • Username
  • URL
  • About Language
• Social Media Platform 2:
• Username
• URL
• About Language
• Social Media Platform 3:
• Username
• URL
• About Language

I acknowledge having read the below guidelines:

□ UCI Health Policy 523.1, Social Media Guidelines

□ Content owners are responsible for updating UCI Health Marketing & Communications when/if social media manager’s change, account users are added, or social media sites are deleted. UCI Health reserves the right (but is not obligated) to monitor, suspend or terminate an institutional social media site, at any time, if warranted.

□ Any Social Media Sites that have not had regular, pertinent content posted will be subject to deletion by Marketing & Communications. UCI Health reserves the right to suspend the use of, or modify content on, UCI Health - sponsored digital and social media sites within University policy and applicable law.

Department Chair Printed Name:

Signature:

Date: