This podcast is brought to you by healthcareinfosecurity.com, the leading online publication for risk management and security professionals within the healthcare industry. This is Howard Anderson, Executive Editor at Information Security Media Group. Today we're talking about social media policies with Roy Schnell, CEO at the Health Care Compliance Association and the Society of Corporate Compliance and Ethics. Thanks so much for joining us today, Roy.
I'm glad to be involved. You recently conducted a survey of nearly 500 compliance and ethics professionals across all industries regarding social media issues. And that survey, only about a third, reported their organization has policies addressing employee use of social media outside of the workplace. Did that result surprise you and why is such a policy important, especially as it pertains to protecting privacy?
It doesn't surprise me too much at all. I found this whole thing to be pretty fascinating, really. Let's look at this in a different light. Let's look at this like if we were talking about people going and giving speeches at conferences or writing articles or even sending emails.
Nobody wants employees to give away trade secrets when they write, speak, or email. Nobody should be surprised at this philosophy or perspective. And that it should be applicable to social media. People are treating social media as a unique form of communication.
But it's not terribly different. It's communication. It's just another form of communication. And the flaw in a lot of people's thinking or the thing that amazes me is that people think it should be treated differently.
Every company expects every employee not to write or speak publicly about how terrible their company is. The fact that some people believe that they can trash their company on social media is just flawed thinking. Every employee knows of a defense contractor that the information they have cannot be shared in any form. Healthcare employees are extremely well trained about the need for privacy of patient data.
And for the most part are doing an excellent job of translating old policy about articles or speaking or emails. You don't put it there. And most of them are making the leap to social media. Some, because it's a new form of communication and don't connect it as essentially the same as writing an article.
And they're making some comment about a patient that they think is innocuous. And it turns out to create a HIPAA violation and cause great difficulties for them. So what's happening is people are doing a little better job in healthcare organizations of training, making clear policies, these sorts of things. And it's just going to take us a little while to get over the hump here in terms of learning a little bit more about how, despite what many people think, the social media is somehow different than other forms of communication, for all intents or purposes, with regard to privacy in healthcare or intellectual property in the defense industry, it is no different.
Now the survey showed 42% reported their organization had disciplined and employed for their behavior on social media sites. That's up from 24% in a similar survey just three years earlier. So why do you think we're seeing the rise in disciplinary action? One of them is that I think it took some companies a little while to have what I've been, and it's going to be a common theme all throughout this morning, is that companies also took them a while to realize this is no different than a speech or an article.
People are publicly making announcements in this case of written format. And some of it's okay. Some of it is not okay. And so they're starting to rise to the occasion saying, holy cow, this is really no different than writing an article.
We've got to stop it. It's also of course a rise in the use of social media. And it's this continued thinking, the flawed thinking, that you can say anything you want on social media and not have any consequences. It's the increase in the number of young graduates who think that trashing your company or talking about patience is going to work for them.
It boils down to the flawed idea that many people have that you should be able to say anything you want in social media. And again, I'll tell you, these people who do this intentionally thinking that because it's social media and they should have some privacy rights, they need to understand it's no different than speaking or writing. Just because it's a unique form of communications doesn't mean it's okay to do this. This everybody also showed most organizations do not have a formal method in place for monitoring employees' use of social media.
Should social media activity both during work hours and after work be monitored? And what's the best way to do that without violating employees' rights? Well, it's an excellent question. There really is two separate questions here.
One is at work and the other is in their private lives, if you will. I mean, just take it this way, the email versus social media. Obviously, and it depends on the laws in each state and that sort of thing, but there's some certain expectations about the use of email, companies have policies about the amount of time you should be, or if you should be at all spending a personal time on the internet while at work. Those policies are pretty much established, just need to be applied in each of these companies to social media.
And the monitoring of social media shouldn't be a whole lot different than what they've been doing in email or other sorts of communication that we've had in the past. I think the interesting one is monitoring the use of this stuff after hours. And you got a couple of questions there, and each company has to have a policy and a set of expectations of their employees with regard to what they say and do. Obviously, a company that has a lot of intellectual property needs to make it clear just because you're at social media and your own private little space at night doesn't mean you can give up intellectual property.
At least there is just like releasing it to people talking to them. You're likely to get into a fair amount of trouble. So what we've got to try and understand is that we already have rules in place for legal restrictions which regard to what we can do as employees. The real tricky part is this idea of people going on social media at night and own private account and saying or doing inappropriate things, whatever that company defines is inappropriate.
I'm not an attorney, there are at least some laws associated with this, but frankly it doesn't matter to me. Because whether I go look for this trouble or I hear about it later, I could either audit employees, which even if there isn't a law against it, it could be considered an invasion of privacy or too much like Big Brother. My point is I don't think this is a... If somebody goes on social media and does something that someone with common sense would say is inappropriate, I'm going to hear about it very soon.
Someone will see it, they'll tell others because it's so outrageous eventually it will get to me. I would bet you that in 90% of any kind of inappropriate actions in someone's private, in 90% of those cases of people doing something inappropriate, I'm going to hear about it, then I would have caught it had I audited it. I'm very comfortable personally with just dealing with it on an exception basis. When I hear about it, I would address it and obviously if you're a good manager, you're going to check with legal counsel before you act or HR and make sure that what you're doing is in terms of follow-up with regard to the accusation of inappropriate behavior is handled professionally and legally.
Please describe the key elements of a social media policy that governs employee activity at the workplace, especially in a health care setting. What role should compliance officers play in carrying out their policy? Well, compliance officers should develop the policy, and my advice to anybody would be to go get copies of other policies. And, ironically, one of the best ways to get this is on social media.
For example, we have social media for compliance officers in all industries, something called SCC ENA. There's a library of documents you can search. If you don't find what you want, you can type in a question and say to all the people in the group, please send me a copy of your social media policy. And, by the way, these social media sites are open to everyone, not just our members.
And the same thing's true with health care. We have one called HCCA net. Same deal. There's a library.
There's an opportunity to pose questions. People can respond with an email and an attachment of their social media policy. It's really great to get other people's policies because, collectively, everybody tends to think of everything. It's just those who have the most comprehensive policy will have looked at the most other sample ones.
And then it's always important to have legal counsel, an enhancer outside. I would try and find a specialist in this area because it is new, and there are a few of them. Generals might have a difficult time with this, but I would have an enhancer outside attorney and take a look at it. You have to how the policy will help prevent violations.
It will do so because of a couple of things. It will be more clear to those who might break the policy what the expectations are. And it also helps those who are enforcing the policy to know what it is they can and cannot allow. And I think this is a perfect role for compliance officers because that's what the job is all about.
Compliance officers help an organization develop systems and procedures to prevent, find, and fix problems just like this. One other thing you might do is make sure that the social media policy, like any other policy, either the CEO signs off on it or the executive committee or some compliance committee, some group that can just take one last quick look over your shoulder. And then either when you have a problem and somebody says, well, who says I can't do this? Who made this policy?
And you can cite the leadership of the organization as being behind it. Finally, what's the best way to educate staff about the social media policy as well as the risks involved in using social media? Unfortunately, our list gets longer and longer every year. Things people need to know to stay out of trouble with the regulations and such.
But I would make social media part of the annual compliance training. Every organization should have at least an hour or so depending on the number of risk areas and maybe more. And I would make sure that that is taught in the annual compliance training. I would teach it to all new employees during employee orientation.
It's particularly important because this is something new. A lot of things people know not to do because they come from some other company that has already taught them not to do that. Because this is new, nobody's really coming from anywhere that really did this very well. And we're starting from scratch.
So I take a little more time on this than some of the other stuff that they probably already know pretty well. I would also probably put something in the code of conduct that every organization should have that kind of summarizes some of the more important, bigger, higher risk in this case, newer issues that they should be paying attention to. And then something that holding the finest compliance in ethics officers do is find a way to share the infractions that occur throughout the course of the year. There is a woman who works in the ethics department a best buy that lists a number of examples of real infractions and names that have been left out of it to let employees know a couple things.
Here's an example of something that shouldn't be done. And then the other thing is that we're not looking the other way on these things. If you do this and we find it, this is what's going to happen. And it shares what this one was taking these sorts of things.
Well, thanks very much. We've been talking with Roy Snell of the Society of Corporate Compliance and Ethics. This is Howard Anderson. Thanks so very much for listening.
This podcast has been brought to you by healthcareinfosecurity.com. For more interviews, breaking news, research and educational webinars, please visit www.healthcareinfosecurity.com.