identification and management of emerging legal risks in...

Identification and Management of

Emerging Legal Risks in Social Media

These materials have been prepared by Poyner Spruill LLP for informational purposes only

and are not legal advice. This information is not intended to create, and receipt of it does not

constitute, a lawyer-client relationship. © 2012 Poyner Spruill LLP. All rights reserved.

Elizabeth Johnson

Partner

Poyner Spruill LLP

(919) 783-2971

ejohnson@poyners.com

@PoynerPrivacy

The Obvious Risks

The Obvious Risks

• Privacy

– Negligent Disclosures

– Inadvertent and Incidental Disclosures

• Security

– Malware

– Social Engineering

– Phishing/Spoofing/Spam/Scams

Negligent Disclosures

• Mercy Walworth Medical Center in Lake Geneva, WI – Nurses fired for

patient photos (case referred to FBI)

– Allegedly photographed patients and posted to Facebook

• Oakwood Hospital in Detroit, MI – Employee fired for Facebook post

regarding “cop killer”

– Local police officer murdered, killer treated at same hospital

– Employee posted disparaging remarks about alleged killer/patient

• Lifequest Nursing Center in Pennsylvania – Registered nurse fired for

Facebook posts regarding co-worker

– Post timestamps occurred while nurse was actively engaged in

dispensing patient medication

“Schedule regular medical exams like everyone else instead of

paying UMC employees overtime to do it when clinics are

usually closed.”

– Employee of Mississippi’s University Medical Clinic

“Glad the Legislature recognizes our dire fiscal situation. Look

forward to hearing their ideas on how to trim expenses.”

– Mississippi Governor Haley Barbour

Inadvertent, Incidental Disclosures

• Dr. Alexandra Thran – disciplined by RI’s licensing board

for Facebook post

– Westerly Hospital reported to board that it “terminated

[Thran’s] clinical privileges at the hospital because she had

used her Facebook account inappropriately to communicate

a few of her clinical experiences in the hospital’s Emergency

Department.”

– Doc did not identify patient names in her posting, board

concluded that “the nature of one person’s injury was such

that the patient was identified by unauthorized third parties.”

It’s An Epidemic…

“Special” Problem for Health Care Profession

Expensive professional and reputational disaster

+ High stakes penalties = Broad definition of PHI

So how much is too much?

– “Coffee Shop Rule”

– But…

– Almost any information about a patient is too much

information

– Violating patient confidentiality = revocation of license,

lawsuits, violation of law (fines – $1.5M maximum

HIPAA penalty)

“Coffee Shop”

Rule

“Cover of The New

York Times” Rule

Social Media Reality

Permanency

of Disclosure

Verbal, so fairly

transient

Print copy, but

unlikely to be

retained permanently

(longer for website…)

Internet, potentially

permanent retention

Searchable? No Limited (microfiche?) Word searchable and semi

available via search engines

Maximum

Initial

Distribution

Starbucks avg.

daily customers

= 500

Daily circulation = 1M Facebook = 750M users,

Twitter = 200M users (est.

50% log in daily)

Potential for

Redistribution

Limited (gossip) Limited (some

readers selectively

pass article along)

Indiscriminate posting

(Facebook/Twitter users avg.

~130 friends/followers)

Magnitude of Disclosure

Security Risks

• Types of Attacks (general v. targeted)

– Malware

• 18% of social network users report malware, up from 13% in 2010 and

8% in 2009 (Webroot annual survey)

• Malware distributed via social network 10x as effective as malware

spread via email (Kaspersky Global Research)

– Social Engineering

– Phishing/spam/spoofing/scams

• Example = “Friend in Distress” scam – 14% of users report receipt in

2011, compared to 2% in 2009 (Webroot annual survey)

– Overall, number of firms reporting an attack via social networking

rose 70% from 2008-2009 (Sophos 2010 Security Threat Report)

– 93% increase in web-based attacks in 2010; 65% of malicious

URLs were shortened URLs (Symantec 2010 Internet Security

Threat Report)

The Obscure Risks

User-Generated Content = Risk

• Besides legal liability for disclosures…

• Publication of private facts / invasion of privacy

• Infliction of emotional distress

• Defamation / libel

• “Cyberbullying”

• Negligence

Job Applicants and Employees

• Hostile workplace

• Discrimination

– “Classic” discrimination (race, age, gender, disability, sexual

preferences, etc.) – EEOC has confirmed position

– Genetic Information Nondiscrimination Act

• Wage and Hour

• National Labor Relations Act

• Stored Communications Act

• Fair Credit Reporting Act

• Impersonation / Misappropriation / Conversion / Trade

Secrets

14

• Employer’s company

Facebook page

• Photo of company

event posted

• Someone (allegedly an

employee) posted

discriminatory

comments about

coworker

• Hostile workplace

charge

National Labor Relations Board

National Labor Relations Board

• About a dozen cases involving social media

• Recent guidance issued summarized four cases that

ended badly for employers:

– Employee asked coworkers on her Facebook page for their

reaction to another employee’s complaints about work quality and

staffing levels

– Employee complained on her Facebook page about supervisor’s

refusal to permit union rep to assist her in developing a response

to a customer complaint filed against her

– Employees’ Facebook posts reveal employer’s failure to withhold

state income taxes; state tax authorities issued payment demand

– Social media policies prohibiting “solicitation,” “disparaging” the

employer,” “offensive” “defamatory” or “unprofessional” content

National Labor Relations Board

• More likely to be protected activity

• Subject matter related to terms and conditions of employment,

exercise of union rights, or other matters traditionally considered

“protected activity”

• Other employees were participating in the conversation

(“concerted activity”)

• Content that is part of a continuing dispute with employer or

ongoing conversation with other employees

• Less likely to be protected activity if negative impact on

productivity, complaints amounted to “name calling,” or

content was inappropriate

• Guidance also discusses over-broad social media policies

Stored Communications Act

• Applies to stored

wire or electronic

communications

held by ISPs

• Prohibits

intentional access

to such

communications

without

authorization

“…this information should not be used for

employment, tenant screening, or any FCRA

related purposes…”

Impersonation / Publicity

• The Lanham Act (false

association/false

endorsement )

• Right to publicity (state

statute)

• Right to privacy (state

common law),

dismissed

Conversion/Misappropriation of Trade Secrets

• Employee leaves with Twitter account

• Employer sues

claiming damages

of $2.50/mo per

follower ($340K)

• Claims followers

and password =

trade secret

• Case survives

motion to dismiss

Other Problems – Self-Promotion

• FTC’s Guide Concerning the Use of Endorsements and

Testimonials in Advertising

Unfair and Deceptive Trade Practice

Other Problems – Federal Securities Law

• SEC Guidance on the Use of Company Web Sites

– Covers websites, blogs, shareholder forums and other social media

– “Since all communications made by, or on behalf of, a company are

subject to the antifraud provisions of the federal securities laws,

companies should consider taking steps to put into place controls

and procedures to monitor statements made by or on behalf of the

company on these types of electronic forums.”

• Fact-specific inquiry required:

– When is information “public” for purposes of Reg FD compliance?

E.g., Can company Facebook posts constitute public disclosures?

– When are posts or tweets considered “republished” for purposes of

the antifraud provisions of the federal securities laws?

– How do the antifraud provisions apply to posts made by

employees? Officers? Third party commentators?

Now What?

Social Media – To Ban or Embrace?

• Biggest mistake = ignoring it

• Two choices remain:

1. Ban it (with appropriate limits)

2. Embrace it (with appropriate limits)

• Is it feasible to ban effectively?

– Tidal wave of adoption typically drowns out efforts to ban entirely

• Exacerbated by rapid adoption of mobile devices

– First Amendment / NLRB

– Customer / patient expectations

– Powerful marketing and communication tool

Identify Your Business Need

• Not popular for communicating with doctors

– Capstrat Survey, February 2011

– 84% would not use social media to communicate with doctors

– Among adults ages 18 – 29 (target audience for social media), only

21% would use it to communicate with doctors

• Some potential for other use

– Capstrat respondents more favorable toward email and online

channels for appointment setting, medical record access, and

nurse consultation

– Intuit Health 2011 survey showed 73% would use an online

solution to get lab results, request appointments, pay medical bills,

and communicate with doctor’s office

You won’t talk to your doctor, but…

• National Research Corp

Survey of 22,000:

• 16% use social media as

source of health care info

• 82.3% trust health info

obtained from social media

at a score of 3 or higher

(on scale of 1 – 5)

• 78.8% gave score of 3 or

higher to likelihood of

social media influencing

their health care decisions

Pew Research Center, September 2010

• 80% of internet users get health info online (59% of all adults)

• 34% of internet users (25% of all adults) have read someone else’s

commentary or experience about a health issues on website, blog, etc.

• 24% of internet users (18% of all adults) have consulted online reviews

of particular drugs or medical treatments

• 18% of internet users (13% of adults) have gone online to find others

who might have health concerns similar to theirs

• 16% of internet users (12% of adults) have consulted online rankings or

reviews of doctors or other providers

• 15% of internet users, or (11% of adults) have consulted online

rankings or reviews of hospitals or other medical facilities

• 62% of internet users also use social media, and 23% of those (11% of

all adults) followed friends’ personal health experiences on the site

• 15% of social media users (7% of all adults) have gotten health info

Identify Your Business Need

• Potential for recruiting clinical trial participants?

– White Paper, June 2011, Blue Chip Patient Recruitment

– 19% were comfortable receiving info through Facebook and 14%

receiving info from Twitter

– 81% of “e-patients” (actively engaged in health-related social

media) were interested in participating in clinical trials, but only

16% had done so

Identify Your Business Need

• On substance, stick to information not communication

• Communication for administrative matters (appointments,

billing, etc.)

• One-size-does-not-fit-all

– Risk for physicians and practitioners may outweigh benefits, but

may not hold true for researchers, support staff, etc.

• Recognize marketing potential and demographics

• Self-selected audiences

• If no business need, may indicate that you should limit

(ban) rather than promote (embrace) social media

Next Steps

• Develop a detailed policy (preferably more than one)

– “Approved Population,” HR, everyone else

– Be comprehensive (see foregoing slides)

– Do not be overly restrictive

– Require/discuss compliance with third party sites’ terms

• Train

• Audit compliance

• Post disclaimers, terms of use and/or privacy notices

• Monitor for reputational impacts (even if not posting

yourself)

– Policy and training for that monitoring also is beneficial

Other governance?

• Formal launch and implementation plan

• Social media agreement for employees

• Committee oversight

• Senior management approval of plan/oversight

• Annual program refresh

Questions?

Elizabeth Johnson

Partner

Poyner Spruill LLP

(919) 783-2971

ejohnson@poyners.com

@PoynerPrivacy

These materials have been prepared by Poyner Spruill LLP

for informational purposes only and are not legal advice.

This information is not intended to create, and receipt of it

does not constitute, a lawyer-client relationship. © 2012

Poyner Spruill LLP. All rights reserved.