Nursing Home Fined $182K for Posting Patient Photos Online

A “Success Stories” marketing campaign by a Delaware nursing home that involved posting photos and names of patients to social media sites resulted in an $182,000 federal fine. Regulators say the company violated HIPAA rules through the unauthorized disclosure of patients’ protected health information.

See Also: When Identity Protection Fails: Rethinking Resilience for a Modern Threat Landscape

The U.S. Department of Health and Human Services’ Office for Civil Rights on Tuesday said it had launched an investigation into Cadia Healthcare, which provides rehabilitation, skilled nursing and long-term care in five facilities, after receiving a complaint in September 2021 about the firm impermissibly disclosing PHI on its website.

The grievance alleged Cadia posted the complainant’s photo, name and information about the patient’s medical conditions, treatment and recovery at a Cadia facility.

“OCR’s investigation substantiated the allegation and revealed that a Cadia employee posted a photograph of the complainant as part of a ‘success story’ to Cadia’s social media page without first obtaining a signed authorization from the complainant authorizing the Cadia employee to post the photo and share her success story,” HHS OCR said.

Cadia removed the patient’s “success story” from its social media account upon receiving a notice from OCR about the complaint, HHS OCR said.

But HHS OCR’s further investigation found that as of Feb. 22, 2022, Cadia had similarly disclosed the PHI of 150 people on social media sites through its “success stories” program without first obtaining the patients’ authorization.

Cadia terminated its “success story” program in March 2022, but HHS OCR said the firm failed to provide breach notification to all 150 people affected by the disclosure online.

“The internet and social media are important business development tools. But before disclosing PHI through social media or public-facing websites, covered entities and business associates should ensure that the HIPAA privacy rule permits the disclosure,” said Paula Stannard, HHS OCR director in a statement.

“A valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual’s PHI in a website testimonial or through a social media campaign.”

Besides paying the financial settlement, under the resolution agreement with HHS OCR, Cadia must implement a corrective action plan, which the federal agency will monitor for two years.

The corrective action plan requires Cadia to:

• Review and update written policies and procedures to comply with HIPAA privacy and breach notification rules;
• Provide all members of its workforce – including marketing personnel – with training on Cadia’s HIPAA policies and procedures;
• Provide breach notifications to all individuals, or the person’s personal representative, whose PHI was disclosed by Cadia on any of its facility websites, social media accounts, or through other marketing or promotional materials without a valid authorization.

Cadia in a breach notice currently posted on its website said that because it stopped posting success stories and deleted all the information pertaining to that program in March 2022, it is “unable to definitively determine all individuals who participated in the success story.”

So, “out of an abundance of caution, we are notifying individuals who may have participated and for whom we could not locate a valid consent form,” Cadia said in the notice.

Cadia did not immediately respond to Information Security Media Group’s request for comment on the HIPAA settlement with HHS OCR.

Similar Cases

This isn’t the first time HHS OCR has penalized a HIPAA-regulated organization for impermissible disclosure of a patient’s PHI on social media or websites for marketing purposes.

In 2016, HHS OCR struck a $25,000 settlement and resolution agreement with Complete P.T., Pool & Land Physical Therapy Inc. following an investigation into an August 2012 complaint alleging that CPT was impermissibly disclosing patients’ PHI in “testimonials” on its website without the individuals’ permission (see: Case Shines Spotlight on HIPAA’s Marketing Rules).

Then in 2019, HHS OCR agreed to a $10,000 settlement and corrective action plan with Elite Dental Associates of Dallas in a case centered on a complaint received in 2016 that the dental practice disclosed a patients’ name and other PHI on social media site Yelp in response to several patients’ bad reviews (see: HHS Gives Dental Practice Posting PHI on Yelp a Bad Review).

HHS OCR also settled a second similar but separate case in 2022 with another dental practice – New Vision Dental – which agreed to pay a $23,000 fine and implement a corrective action plan after also responding to negative Yelp reviews with detailed information about patient visits and insurance (see: Dental Practice Hit With HIPAA Fine For Posting PHI on Yelp).

“Generally speaking, you should be approaching social media with the utmost caution,” advised regulatory attorney Nan Halstead, a partner of the law firm Reed Smith who is not involved in the Cadia case.

“Even when there is sort of a ‘success story,’ you cannot provide that in the public sphere without absolute certainty that you have a HIPAA authorization that permits the disclosure of the information in that context and evaluating whether it is or is not marketing,” she said.

“If you are using that information to encourage someone to use your services, it very well could be” considered marketing, she said. “And if so, it needs that additional element of the authorization,” she said.