Which statement describes a HIPAA social media violation?

• A. Posting a general health tip about nutrition on a personal profile
• B. Sharing de-identified data in a research context
• C. Commenting about a patient’s care in a private chat with colleagues
• D. Any patient information, describing unique cases, photos, confirming someone is a patient

Answer: (D)

HIPAA violations on social media occur when protected health information is shared in a way that identifies a patient or could reasonably identify them. PHI includes names, dates of service, locations, photos, or any detail that makes a patient identifiable, even if only a single, seemingly small piece of information is posted publicly.

The statement that describes a HIPAA social media violation is one that involves sharing any patient information, describing unique cases, including photos, or confirming that someone is a patient. That kind of information on a public or semi-public platform directly exposes the patient and breaches confidentiality, which is not allowed without explicit consent and proper de-identification or authorization.

General health tips posted on a personal profile don’t involve a patient and don’t reveal PHI, so they’re not violations. Sharing de-identified data in research is allowed if all identifiers are removed and the data meet de-identification standards. Mentioning a patient’s care in a private chat with colleagues is risky and could violate confidentiality if PHI is shared improperly or outside the appropriate treatment/operations context, but it’s not the same clear-cut public social media violation as posting identifiable PHI.