Cybersecurity Tip of the Week – They Can Share It, That Doesn’t Mean We Can

UT Health Sciences is a HIPAA-covered entity, which means we must always be careful about what we say, write, post or share about people and their health information. A recent study of healthcare organizations found a surprisingly common problem: employees responding to public reviews sometimes confirmed that someone was a patient, discussed a visit or repeated health information the individual had already posted publicly.

Here's the important distinction: a person can choose to share their own health information publicly. That does not automatically give us permission to confirm it or discuss it. Even something as innocent as, "We're glad you had a good experience during your visit," could confirm that an identifiable person received care.

And this lesson goes far beyond online reviews. Think about emails, social media, conversations in public areas, presentations, photographs, texts and other communications. Before saying or writing something about another person's health information, ask yourself whether you are authorized to share it and whether the person receiving it needs to know.

When it comes to PHI, don't assume that information is yours to share simply because someone else shared it first. Protecting people's privacy is everyone's responsibility.