Jim Donaldson, M.S., MPA, CHC, CISSP, CIPP/US Director of Compliance, Privacy and Security Officer Baptist Health Care Corporation

Transcription

1 17 th Annual Compliance Institute National Harbor, MD Session 301 Social Networking: Managing the Risks and Realizing the Benefits Jim Donaldson, M.S., MPA, CHC, CISSP, CIPP/US Director of Compliance, Privacy and Security Officer Baptist Health Care Corporation

2 2

3 3

4 Remember when it was simple? Remember when it was simple? 4

5 What s on the Agenda? Social Networking: What is it and why does it matter? What are the risks and benefits of social networking and the underlying technology in the workplace? Establishing sound policy to address compliance and ethics concerns. Social Networking/Media is very broad It is technology driven It will be different next year This discussion will be focused on Social Media and the enabling technology as it relates to the employer/employee relationship 5

6 6

7 Why it Matters 7

8 The Building Blocks behind Social Media/Networking 8

9 Web 2.0 The term Web 2.0 is associated with web applications that facilitate interactive systemic biases, interoperability, usercentered design,[1] and developing the World Wide Web. A Web 2.0 site allows users to interact and collaborate with each other in a social media dialogue as consumers of usergenerated content in a virtual community, in contrast to websites where users (prosumers) are limited to the active viewing of content that they created and controlled. Examples of Web 2.0 include social networking sites, blogs, wikis, video sharing sites, hosted services, web applications, mashups and folksonomies. Source: Social Networking vs. Social Networking Services/Media Social Networking: A social network is a social structure made up of a set of actors (such as individuals or organizations) and the dyadic ties between these actors. Social Networking Service: A social networking service is an online service, platform, or site that focuses on facilitating the building of social networks or social relations among people who, for example, share interests, activities, backgrounds, or real-life connections. 9

10 In Just 8 Years 3 Processors/Quad Core at 1.7GHZ 32GB Memory 128GB Flash Storage 2 cameras (front/rear) Weight 5 ounces 1080p HD Video Recording Sensors: Accelerometer, digital compass, proximity, gyro, barometer Single Core Processor at 1.7GHZ 512MB Memory 60GB Hard Drive Weight 6.6lbs Battery Life 2.5 hours 10

11 Technology Building Blocks: Text messages Instant Messages Location based services Photo/Video/Audio Geo Tagging Podcasts Blogs 11

12 Location Based Services LBS FaceBook - Places GeoTagging GeoTagged file Properties (metadata) 12

13 Really Simple Syndication (RSS) Feeds Web feed formats used to frequently update information such as news, audio, video in a standardized format Documents or content is called a feed Allows users to subscribe to feeds and receive updates as they are pushed out Common RSS Feed Icon Really Simple Syndication (RSS) Feeds - JCAHO 13

14 14

15 Common Policy Considerations Controlling personal device use in the workplace Photos/video/audio (are people recording meetings?) Blocking Social Media access from company devices (Facebook, Linked-in, YouTube, Vimeo etc.) What about your Guest Networks? What s work related and what s not? How do you manage the blur? Can you demand that an employee turn over a personal device if it is relevant to an investigation? Texting between care providers: It s going on Do you have a secure tool? ediscovery of business communications conducted on personal devices 15

16 New Threats to Consider Cloud storage: icloud, Google Drive, SkyDrive Live video streaming: Skype, FaceTime Encrypted: Cellcrypt, Wickr (secure communications with no trace) A Quick Aside: Can your Workforce Members Report Concerns via the Web? 16

17 Helping Your Workforce Make the Right Decisions A Well Developed Social Media Policy 17

18 National Labor Relations Act (Wagner Act)

19 National Labor Relations Act Sec. 7. [ 157.] Employees shall have the right to selforganization, to form, join, or assist labor organizations, to bargain collectively through representatives of their own choosing, and to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection, and shall also have the right to refrain from any or all such activities except to the extent that such right may be affected by an agreement requiring membership in a labor organization as a condition of employment as authorized in section 8(a)(3) [section 158(a)(3) of this title]. Protected Concerted Activity Protected Concerted Activity is a legal term used in labor policy to define employee protection against employer retaliation in the United States. It is a legal principle under the subject of the freedom of association. 19

20 National Small Business Association..to avoid an expensive employee complaint to the NLRB, an investigation and possible enforcement actions, it is advisable to make sure your social media guidance conforms to the dictates of the NLRB..Adopting the social media policy language approved by the NLRB is the safest course. NSBA Traps for the Unwary: Social Media Policies, November 21, By David Burton. NLRB Memorandums on Social Media Cases Memorandum OM (August 2011) Memorandum OM (January 2012) Memorandum OM (May 2012) 20

21 Presentation Handouts Memorandum OM (May 2012) See page 23 of 30 for NLRB model Social Media Policy Baptist Health Care Corporation Social Media Use Policy NLRB Legality Test For workplace rules (Social Media Policy) Does it explicitly restricts section 7 protected activities? Would employees reasonably understand the language as prohibiting Section 7 activities? Was it implemented in response to union activity? Has it been applied to restrict Section 7 rights? 21

22 Examples from NLRB Analysis Examples from NLRB Analysis 22

23 Examples from NLRB Analysis Examples Involving Social Media 23

24 A long term employee took the day off to be with his 25 year old daughter during surgery at the facility in which the father worked. While in the waiting room, the daughter noticed a patient who was a prominent athlete. A conversation followed and the patient agreed to a photo with the daughter. The father posted the picture to Facebook with the caption Good enough for xxxxx, good enough for my family Other employees who were friends with the father on Facebook contacted leadership with concerns the post may have been a HIPAA violation. Protected Speech? HIPAA violation? A long term nurse with an excellent work history takes a picture of two employees in a surgical area and uploads it to Facebook. The picture did not contain any patient identifiers but did show an open hip. The two employees in the photo were tagged with links to their Facebook pages which provided details including naming the physicians they worked for. The photo was uploaded while the surgery was in progress. Protected Speech? HIPAA violation? 24

25 25

26 Comments from Patients Excellent Reference 26

27 Jim Donaldson, M.S., MPA, CISSP,CIPP/US Director of Compliance, Privacy and Security Officer Baptist Health Care Corporation