Policy Social Media Acceptable Use Policy Date approved by - ISG Version Issue Date Review Date Executive Lead 11/6/2013 1.0 11/6/2013 11/6/2015 Mike Robson Executive Director Finance Procedure/Policy IM0033_v1 Number Procedure/Policy type Date Equality impact assessment completed: 16.05.2013 Outcome: Low Information Asset Owner Chief Information Security & Governance Officer Author James Carroll Chief Information Security & Governance Officer Information Security & Governance Policy Title: Social Media Acceptable Use Policy Page 1 of 13
1 Version Control DOCUMENT INFORMATION AND AMENDMENT RECORD Document Number: IM0033_v1 Document Title: Executive Lead: Social Media Acceptable Use Policy Executive Director of Finance Date Amendment Details Responsibility Amendment No Policy Title: Social Media Acceptable Use Policy Page 2 of 13
2 Review This document will be reviewed twenty four months from its issue date. Policy Title: Social Media Acceptable Use Policy Page 3 of 13
3 Table Of Contents 1 Version Control... 2 2 Review... 3 3 Table Of Contents... 4 4 Equality, Diversity and Human Rights Statement... 5 5 Introduction... 5 6 Intended Audience... 6 7 Related Policies... 6 8 Legislation... 6 9 Scope... 6 10 Purpose of this document... 7 11 Definitions... 7 12 Responsibilities... 7 13 Organisational Use of Social Media... 8 14 Personal Use of Social Media... 9 15 Personal Use Of Social Media During Working Hours... 9 16 Monitoring... 10 17 Review... 10 18 Policy Monitoring... 10 19 Guidance... 10 20 Social Networking Do s and Don ts... 11 21 Further Information... 12 22 Professional Guidance... 12 23 Appendix A - Staff Signature Sheet... 13 Policy Title: Social Media Acceptable Use Policy Page 4 of 13
4 Equality, Diversity and Human Rights Statement The Trust is committed to promoting human rights and providing equality of opportunity, not only in our employment practices but also in the way we provide services. The Trust also values and respects the diversity of our employees and the communities we serve. In applying this policy, the Trust will have due regard for the need to: Promote human rights Eliminate unlawful discrimination Promote equality of opportunity Provide for good relations between people of diverse groups Consider providing more favourable treatment for people with disabilities 5 Introduction The widespread availability and use of social networking sites brings opportunities for the Trust to understand, engage and communicate more effectively with our audiences in new ways. It is important that we are able to use these technologies and services effectively, however it is also important to ensure that we maintain our legal responsibilities and our reputation. This policy and guidance document will identify the process by which employees may establish and use social media applications on behalf of the Trust and will also provide guidance as to acceptable and unacceptable behaviour when using personal sites. South Tyneside NHS Foundation Trust acknowledges the right of all staff to freedom of expression and recognises that all staff are entitled to use social media in a personal capacity. This policy is not designed to stop staff from conducting legitimate activities via social media but provides up to date guidance to avoid potential problems arising for both individual staff members and the Trust. Staff who post comments or information online regarding the Trust, or the NHS, are personally responsible for their actions and the online content they have created. As such, if the content is damaging to the reputation of the Trust or wider NHS, the individual will be liable. Staff should follow the same behavioural standards online as they would in their everyday roles and abide by their legal and ethical duties to protect patient/service user confidentiality. Throughout this document, sentences that contain the verb MUST indicate that the requirement is mandatory. Sentences that contain the verb SHOULD indicate that the requirement may be adapted for local need. Further advice and guidance in relation to the policy is available from the Trust Chief Information Security & Governance Officer James Carroll. Policy Title: Social Media Acceptable Use Policy Page 5 of 13
6 Intended Audience All South Tyneside NHS Foundation Trust staff including temporary workers, locums and staff seconded or contracted from other organisations. 7 Related Policies The following is a list of policies related to this policy. These policies SHOULD be read together with this policy 8 Legislation 9 Scope Information Governance Policy, IM&T Security policy, Confidentiality Policy, Confidentiality code of Conduct Data Protection and Information Handling Policy. Internet Access Acceptable Use Policy Disciplinary Policy Equality & Diversity policy Bullying and Harassment Policy Use of Social Media in the UK is covered by the following legislation: Common Law Duty of Confidentialilty Data Protection Act 1998 Malicious Communications Act 1988 Communications Act 2003 Defamation Act 2013 This Policy applies to all South Tyneside NHS Foundation Trust staff (including temporary workers, locums and staff seconded or contracted from other organisations). It covers the use of social networking applications used for Trust related purposes and personal use. The guidance is provided to assist staff in ensuring that they act appropriately when using such sites. Any breach of or refusal to comply with the policy elements may be a disciplinary offence which may lead to disciplinary action in accordance with the organisations Disciplinary Policy. Policy Title: Social Media Acceptable Use Policy Page 6 of 13
10 Purpose of this document The Purpose of this policy document is to establish rules and guidance for employees on the acceptable use of social media and outline expected behaviour and to: 11 Definitions protect information from accidental disclosure through oversight ensure that the Trust is not exposed to legal and governance risks ensure that the reputation of the Trust is not adversely affected provide guidance to staff in the appropriate and acceptable use of Social Media. Social media is the term commonly used for websites which allow people to interact with each other in some way, by sharing information, opinions, knowledge and interests. As the name implies, social media involves the building of online communities or networks, encouraging participation and engagement. Social networking is the use of interactive web based sites or social media sites, allowing individuals on-line interactions that mimic the interactions between people with similar interests that occur in life. Websites (such as Facebook, bebo and MySpace) are perhaps the most well known examples of social media, but the term covers other web-based services. Examples include Blogs (a contraction of the term web log), audio and video podcasts, wikis (such as Wikipedia), message boards, social bookmarking websites (such as del.icio.us), photo, document and video content sharing websites (such as flickr and YouTube), or micro-blogging services (such as twitter or jaiku). Blogging or Tweeting is using public websites to write an on-line diary (known as a blog) or sharing thoughts and opinions on various subjects. Blogs and Tweets are usually maintained by an individual with regular entries of commentary, descriptions of events and may include other material such as video. 12 Responsibilities All staff MUST ensure that they are aware of their duties and responsibilities in relation to the policy and guidance. Staff MUST report any suspected infringement of this policy as soon as they become aware of the circumstances via the Trust incident reporting processes. Managers are responsible for implementing the policy within their business areas, and for adherence to the policy by their staff. It is the responsibility of each employee, including temporary and contract staff, to adhere to this policy. Any breach of or refusal to comply with this policy is a disciplinary offence which may lead to disciplinary action in accordance with The Trust Disciplinary Policy. Policy Title: Social Media Acceptable Use Policy Page 7 of 13
13 Organisational Use of Social Media Any proposal to use social networking sites (whether hosted by the Trust or a third party) as part of a Trust service MUST be approved by the Information Strategy Group. Submissions must be made in writing to the Group, explaining the purpose, business case and rationale for setting up the site. Approved Social Networking sites must be operated in accordance with the following : Approved sites MUST be created using an @stft.nhs.uk account. The area / team creating the site MUST identify a named site administrator and inform the IT Service Desk of who this individual is. The site administrator will be responsible for all content on the site. Approved sites MUST display the Trust Logo. Contributions made by employees MUST be professional and uphold the reputation of the Trust. Content of the site MUST NOT reveal confidential information about our patients, staff, or the Trust. If you do, you breach the individuals right to privacy as defined by Article 8 of the Human Rights Act 1998, requirements under the Data Protection Act 1998, the NHS confidentiality Code of Practice, your employment contract and your Professional Code of Practice Staff MUST NOT engage in activities on the Internet which might bring the Trust into disrepute or damage its reputation. Trust approved sites MUST NOT be used for party political purposes or to promote specific causes. Trust sites MUST NOT be used for the promotion of personal financial interests, commercial campaigns or personal campaigns. Sites MUST NOT be used in any way to attack or abuse colleagues. Staff MUST NOT display or post defamatory, derogatory or offensive comments about colleagues, patients, their work or the Trust. Trust confidential business information MUST NOT be posted to such sites. Staff MUST NOT post / add content to sites any confidential information about patients/service users or relatives of service users. Staff MUST NOT post images of patients / service users to Trust social media sites without explicit written consent. Content of any kind published via social media channels MUST NOT contradict, undermine or be in conflict with any clinical practice, methods or care approaches advocated by the Trust If a staff member is contacted by the media about posts they have made on a social networking site that has been established for business purposes they MUST inform their line manager who will liaise with the Trust communications team to provide a response. Policy Title: Social Media Acceptable Use Policy Page 8 of 13
14 Personal Use of Social Media The types of media described above provide a number of benefits in which Trust staff may wish to participate in their personal life. However, when someone clearly identifies their association with the Trust and/or discusses their work, they are expected to behave appropriately, and in ways that are consistent with the Trust s values and policies, their individual responsibility as a Trust employee, and with the relevant professional codes of conduct for healthcare professionals. All staff should be aware that the Public Interest Disclosure Act 1998 gives legal protection to employees who wish to whistleblow any concerns. The Act makes it clear that the process of whistleblowing or speaking up normally involves raising the issue internally first. Using social media to whistleblow without already having followed the Trust Raising Concerns at Work Policy (Whistleblowing Policy) would not be appropriate. If you identify yourself as an employees of the Trust by displaying your Trust or NHS.net e-mail address, by joining an NHS or Trust related network or group or by making reference to the Trust as your employer, you are expected to behave appropriately and in line with the Trust s wider values and policies. You MUST take account of all relevant legislation covering personal confidentiality such as the Common Law Duty Of Confidentiality and the Data Protection Act 1998. Every member of staff carries individual responsibility as an NHS employee and in line with professional codes of conduct and when using social media you; MUST not reveal confidential information about patients / service users. If you do, you breach your employment contract and may commit an offence under the Data Protection Act 1998.. MUST not engage in activities or post comments which might bring the Trust or NHS into disrepute. MUST not post defamatory, derogatory or offensive comments about colleagues, patients/service users or the Trust MUST not post images of patients/service users on personal sites. SHOULD not accept friend requests from current or former patients/service users. Instead politely refuse and explain that it would be inappropriate. 15 Personal Use Of Social Media During Working Hours Access to personal social media sites from Trust owned computers is not permitted in line with the requirements of the Trust Internet Access Acceptable use policy. Access to the Internet is monitored by the Trust and excessive or inappropriate use may lead to disciplinary action in line with the Trust Disciplinary Policy. Where staff access social media sites during working hours on their own personal devices, this access SHOULD be restricted to authorised break times. Where the Trust identifies excessive use that impacts on an employees performance of their duties, the employee may be subject to disciplinary action in line with the Trust Disciplinary Policy. Policy Title: Social Media Acceptable Use Policy Page 9 of 13
16 Monitoring The use of social media sites will be monitored for compliance with this policy by members of staff within the Communication Team, supervised by the Communication Lead, or by members of the Information Governance team. Monitoring may be via routine processes or as a result of specific requests for investigation into a particular matter. Where staff believe that content uploaded to a Trust site is inappropriate they MUST inform the IT Service Desk as soon as possible. The IT Service Desk will contact the site administrator to review/remove content. The Trust will not routinely monitor personal sites created by employees, however staff should be aware that if the Trust identifies personal sites that contain inappropriate material relating to the Trust or Trust confidential information, disciplinary / legal action may be taken against the individual(s) responsible. Staff MUST remember that making inappropriate or offensive comments about co-workers on their personal sites can be classed as bullying and harassment and that the Trust can be held vicariously liable for their actions. The employee may then be subject to disciplinary action in line with the Trust Harassment and Bullying Policy and Disciplinary Policy. 17 Review The Information Security Working Group is responsible for ensuring this policy is maintained, reviewed and agreed as specified as and when changes in legislation, guidance or other Trust policies, have an impact on information governance 18 Policy Monitoring There will be an annual audit to ensure that the processes identified within this policy are being adhered to. This will be led by the external Auditors as part of the annual DPA audit and results fed back to the Trust Audit Committee. 19 Guidance This section is provided as best practice guidance. It is not part of the Trust policy requirements though it is recommended that staff follow it. The following section is provided as guidance in relation to the use of Social Networking / Social Media sites. Social networking sites, like Facebook, provide a useful way for people to keep in touch with friends and colleagues. However, through the open or semi-open nature of such sites, it is also possible for third parties to collate vast amounts of information. All staff should be mindful of the personal information they disclose on social networking sites, especially with regards to identify theft. Making information such as your date-of-birth, your place of work, and other personal information publicly available can be high risk in terms of identity theft. Policy Title: Social Media Acceptable Use Policy Page 10 of 13
Social networking sites allow photographs, videos and comments to be shared with thousands of other users. However, staff should not post images of themselves depicting them at work or in work related situations. Staff members who already have a personal blog or social networking site which indicates in any way that they work at the Trust should discuss any potential conflicts of interest with their line manager and/or seek advice from the Chief Information Security & Governance Officer. When posting messages online, users need to be mindful that the right to freedom of expression attaches only to lawful conduct. Information shared through social networking sites, even on private sites, may still be subject to copyright, Data Protection, Freedom of Information and other legislation. All members of staff should be aware that, even if they believe that they are using these sites with enhanced privacy settings applied, this does not exempt them from the guidelines that are outlined in this policy or from their legal obligations. Be aware that what you put on-line can have wider implications. For example, posting pictures of yourself drinking could influence other peoples view of you. 20 Social Networking Do s and Don ts Do have a clear understanding of what you are using your on-line presence for. Do learn the rules of each type of site before engaging. Do use approved sites to promote the work of the Trust and enhance opportunities for our clients to communicate with us. Do use social networking sites to keep in contact with friends and colleagues. Do remember who you are talking to E.g. on Facebook you are sharing information with Friends on Twitter you are sharing information with Everybody. Do verify friend requests and not just accept everyone. Do check your privacy settings and know what you are allowing other to access about you. The default settings on sites such as twitter and Facebook allow various types of content to be shared beyond your network of friends. Do remember that everybody is different, what may be funny to you may be offensive to someone else. Do use strong passwords to access your accounts. An example of a strong password is: Pr0tect1on. (don t use this example as your password). Don t access personal social networking site during employed hours for nonbusiness purposes. Don t make disparaging comments about the Trust organisation, its clients or fellow employees. If you wouldn t say it to the persons face don t say it on social media. Policy Title: Social Media Acceptable Use Policy Page 11 of 13
Don t make remarks that may embarrass the Trust. In particular do not air your grievances where countless others might be able to read them. Don t under any circumstances, identify patients in your care, or post information that could lead to the identification of patients in your care. Don t post any sexually explicit, racially offensive, or other unlawfully discriminatory remarks. Don t share too much information about yourself. The more you post, the more others will know about you and the easier it is to steal your identity. Don t use passwords that you use for social media to access banking or shopping sites keep them different. 21 Further Information Further information on the application and implementation of this policy within the organisation is available from the Chief Information Security & Governance Officer 22 Professional Guidance Various professional guidance relating to the use of social media has been developed by regulatory bodies. These can be accessed by following the links below: British Medical Association http://www.medschools.ac.uk/sitecollectiondocuments/social_media_guidance_ may2011.pdf Royal College Of Nursing - http://www.rcn.org.uk/development/practice/clinical_governance/information_foc us/rcn_publications Nursing and Midwifery Council - http://www.rcn.org.uk/ data/assets/pdf_file/0008/272195/003557.pdf General Medical Council - http://www.gmc-uk.org/guidance/10900.asp Cabinet Office - https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/62 361/Social_Media_Guidance.pdf NHS Employers - http://www.nhsemployers.org/aboutus/publications/documents/hr-socialmedia-nhs.pdf NHS Connecting For Health - http://www.connectingforhealth.nhs.uk/systemsandservices/infogov/links/socnet working.pdf http://www.connectingforhealth.nhs.uk/systemsandservices/infogov/links/bloggin g.pdf Policy Title: Social Media Acceptable Use Policy Page 12 of 13
23 Appendix A - Staff Signature Sheet Social Media Acceptable Use Policy This sheet should be used to record the names of staff members who have read and understood the above policy document. Name (please print) Job Title Date Signature Policy Title: Social Media Acceptable Use Policy Page 13 of 13