The increased use of portable electronic devices in the workplace and the popularity of social media pose unique challenges for health care employers, particularly when the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) conflict with the NLRB’s position on policies that could infringe upon an employee’s right to engage in concerted activity under the NLRA.
HIPAA governs the use and disclosure of protected health information (“PHI”) by health care providers. HIPAA violations may occur when health care employees post images of patients or patients’ records or vitals on social media. Oftentimes, the disclosure is inadvertent. For example, sharing a photo of co-workers in the workplace without realizing that a patient’s file was captured in the photo could result in the unauthorized disclosure of PHI. HIPAA violations may also occur when an employee shares a positive patient experience on social media, with or without an image, as a nursing student recently did to support a three year old who was fighting cancer.
The NLRA applies to all employers, both union and non-union. Section 7 of the NLRA protects “concerted activity,” which includes an employee’s ability to form, join, or assist a union; choose representatives to bargain with the company on their behalf; and act together with other employees for mutual benefit and protection. In some circumstances, recording activities in the workplace may be protected, concerted activity.
Recently, the NLRB in Whole Foods Market, Inc., 363 NLRB No. 87 (Dec. 24, 2015), held that the company’s no-recording policy unlawfully restrained employees’ Section 7 rights. In doing so, the NLRB held that “[p]hotography and audio or video recording in the workplace, as well as the posting of photographs and recordings on social media, are protected by Section 7 if employees are acting in concert for their mutual aid and protection and no overriding employer interest is present.” Thus, an employer may not lawfully adopt a work rule prohibiting employees from workplace recording if the employees are acting in concert for mutual aid and protection and the employer cannot demonstrate an overriding business interest. The Board specifically stated that the employer may not prohibit employees from recording the following: protected picketing, unsafe equipment or workplace conditions, discussions with others about terms and conditions of employment, the inconsistent application of employer rules, and recordings that preserve evidence for later use in administrative or judicial forums in employment-related actions.
The Board, however, acknowledged that employers may be able to establish an overriding business interest to justify restrictions on workplace recordings. The NLRB explained, “[W]e do not hold that an employer is prohibited from maintaining any rules regarding recording in the workplace. We hold only that those rules must be narrowly drawn, so that employees will reasonably understand that Section 7 activity is not being restricted.”
Health care employers should be able to demonstrate such an overriding business interest to support policies restricting workplace recordings and social media use given their obligations to protect patient privacy and comply with HIPAA.
In fact, the NLRB previously upheld a recording restriction implemented to protect patient privacy in Flagstaff Medical Center, 357 NLRB No. 65 (Aug., 26, 2011), a decision which was upheld by the U.S. Court of Appeals for the District of Columbia. In that case, the NLRB ruled that a hospital’s policy prohibiting the recording of images of patients, hospital equipment, property, or facilities was lawful because “the privacy interests of hospital patients are weighty,” and the hospital had a “significant interest in preventing the wrongful disclosure of individually identifiable health information.” The Board in Whole Foods acknowledged the Flagstaff ruling and distinguished its rule from the one in Whole Foods, noting that the business interests at issue in Flagstaff were more pervasive and compelling. Thus, the implementation of narrowly tailored no-recording policies in the health care setting should pass the NLRB’s scrutiny.
The Board should find that health care employers’ interest in protecting patient privacy and complying with federal law justifies appropriately tailored restrictions on workplace recordings. Therefore, to prevent the disclosure of PHI and to protect patient privacy, health care employers should implement policies restricting employees from recording and sharing patients’ images, conversations, or information on social media. Such policies should restrict employees from recording (video, still images, or audio) in patient rooms or settings, and sharing patient images or information on social media. Restricting recordings in non-patient settings (e.g., break rooms, cafeterias, and administrative offices) should be limited to those that will not infringe upon employees’ Section 7 rights.
Takeaways
- Review and revise no-recording and social media policies to ensure that they are narrowly tailored to protect patient privacy and the disclosure of PHI. Be sure that the policies clearly explain that any restrictions on workplace recordings are due to patient privacy and HIPAA obligations and are not intended to infringe upon employees’ Section 7 rights.
- Consider revising existing policies on HIPAA compliance to address the use and restrictions of social media.
- Regularly train employees on recording and social media policies and on HIPAA compliance to ensure that every employee has a working knowledge of the foundational privacy and security regulations issued under HIPAA, and understands how such privacy can be compromised by workplace recording and social media use.
- Consult with counsel before disciplining an employee for making a workplace recording or posting patient information on social media.
A version of this article originally appeared in the Take 5 newsletter “Five Key Issues Impacting Health Care Employers.”
Blog Editors
Authors
Member of the Firm
