Social Media and Client Confidentiality: An Update

A return to social media and client confidentiality…

On January 27,  2017, I wrote a blog entry titled Social media and client confidentiality: Are you violating your ethics code?

The post was the first in a series of entries on ethical online professional behavior, which was written in response to my observation that professionals in the behavioral health field were taking to social media groups to talk about things happening at work with their clients or supervisees and people they worked with as well as to ask about treatment advice.

Alas, nothing much has changed in the four years since I wrote the post except that I occasionally stop following groups that allow users to freely post client case queries to give myself a respite from the discomfort I feel each time I see a new one.

A few weeks ago, someone posted a request in a social media group for materials to implement an unproven treatment for dangerous behavior a client was engaging in. The behavior was described in detail.

I published Asking for and giving treatment recommendations online: Don’t do it on February 3, 2017, and will be providing additional commentary on this particular situation in my next post, but I use the above example, because I was able to track down where the person who posed the query worked. If I was a local practitioner in that area, I would have easily been able to figure out who the client was based on the unique nature of the behavior and setting described in the post. Thus, the person posting provided enough information that they risked their client’s right to privacy by not taking enough care to maintain confidentiality.

My stance on the issue of social media and client confidentiality has not changed since 2017 and for the most part, the information I provided in the original blog entry remains up-to-date save for one section. The Behavior Analyst Certification Board published a new ethics code in late 2020. The new document supports both the assertions I made in the 2017 post and mirrors, in some respects, the requirements of other professions. The purpose of this entry is to lay out the sections that professionals from all fields can use to paint the full picture of our joint professional responsibility to protect client confidentiality online.

The Behavior Analyst Certification Board Professional and Ethical Compliance Code (2014) is the ethical code that has been in effect since January 1, 2016, and remained in effect until December 31, 2021. On January 1, 2022, The Behavior Analyst Certification Board Ethics Code for Behavior Analysts replaced this document.

The Professional and Ethical Compliance Code had an element addressing this.

2.06 (e) Behavior analysts must not share or create situations likely to result in the sharing of any identifying information (written, photographic, or video) about current clients and supervisees within social media contexts. BACB (2014).

I think it makes it very clear that violating client confidentiality online is unacceptable and yet, as I previously mentioned, it continued.

If 2.06(e) was unclear, perhaps

a) there is some confusion as to what identifying information is;

b) there is some confusion as to what privacy rights are and the harm that can be caused when they are violated;

c) there is some confusion as to the meaning of confidentiality;

d) the general community responds at such a high rate to bids for information regarding assessment and treatment advice regardless of the amount of identifying information provided it is now normalized as acceptable professional behavior;

e) all four of the previously mentioned reasons are co-occurring in social media communities.

In the rest of this post, I will address possibilities a-d using the newly published Behavior Analyst Certification Board Ethics Code for Behavior Analysts (2020) and other resources and will provide a set of questions one can use to help you decide whether or not to post online about something that happened at work. Behavior analysts need to continuously evaluate our ethical obligations with respect to social media and confidentiality.

What is identifying information?

According to the US Department of Labor Personal Identifying Information (PII) is:

Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. Further, PII is defined as information: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors). Additionally, information permitting the physical or online contacting of a specific individual is the same as personally identifiable information. This information can be maintained in either paper, electronic or other media.

I italicized the first sentence to emphasize it. It states that identifying information it is any information that permits the identity of an individual to be reasonably inferred. Note the later part of the statement. By direct or indirect means. Online I have never seen a profession post a client’s telephone number or similar. It is often by indirect means that folks often make the mistake of disclosing client information. For example, say I am a local parent of a teen with special needs in a community and I am active in parent support groups, but I am also a provider and I belong to a group with professionals in the community. In that group, a professional posts a questions about a client. Based in my membership in both groups, I may have enough information to infer who it is that professional was talking about.

Does this sound far-fetched? It shouldn’t. I AM a parent who belongs to local online parent groups because I have a child with learning disabilities. I am also a professional who belongs to professional groups where other professionals in my area frequent. I am proud to say I have yet to be in the above situation (yet) but it could easily happen. (This statement was posted with the informed consent of my child and they are aware they can ask me to remove it at any time- 1/8/2021).

What are Privacy Rights and what is the harm that can be caused when they are violated?

According to Miriam-Webster privacy is the freedom from unauthorized intrusion. They define intrusion as the act of wrongfully entering upon, seizing, or taking possession of the property of another.

When you have shared information that someone considers private without their consent, you have allowed a person or persons to take possession of something that isn’t theirs. This may include (but is not limited to)  information, pictures, a child’s struggles, a family crisis, and yes, even a treatment success story. Violating a person’s privacy can result in a loss of trust in the provider and other related providers, diminished confidence in the professional’s ability to perform their professional duties, and more.

Note, my stance is that even if you have parent consent, children should be given the right to decide whether they want their pictures, their story, and their moments shared, and their wishes should be headed, and that consent should be posted along with what every you share (see my above example). The same goes for individuals living in assisted living, hospice, or nursing facilities.

What is the meaning of confidentiality?

For this we will turn to the brochure “A Nurse’s Guide to the Use of Social Media” published by National Council of State Boards of Nursing, Inc. (2018). It is an excellent resource. I think everyone who works in the mental health, behavioral health, education, and medical fields should be required to read it.

In the brochure they define confidentiality as “safeguarding patient information.”

The following is from the brochure:

“Confidential information should be shared only with the patient’s informed consent, when legally required or where failure to disclose the information could result in significant harm. Beyond these very limited exceptions, a nurse is obligated to safeguard confidential information.”

It is the goal of professionals in our fields to protect client privacy by minimizing risk of breaching confidentiality, or in other words, we protect our clients’ rights to privacy by safeguarding their information, information about their family members, and so on.

Social media, confidentiality, and privacy – what does this have to do with that new code you were talking about?

I urge all behavior analysts to immediately use The Behavior Analyst Certification Board Ethics Code for Behavior Analysts (2020) to help guide their behavior going forward from today on and not wait until this document goes into effect on January 1, 2022. In addition, I urge behavioral psychologists and other mental health and behavioral health to read this code in the same way I encourage behavior analysts to read your ethics codes. The more we pull from all the codes, the better practitioners we can be. I have included the main areas for you to reference in the new code that relate to sharing client information, pictures, cases, etc. online below the main text of this blog entry. The Behavior Analyst Certification Board has done a remarkable job laying a groundwork for when it comes to asking one’s self “Do I post or share this?”

Everyone does it is not an excuse: Deciding whether or not to post – An ethical exercise

To help you answer the question of whether or not you should post something, I have provided you a list of questions based on the resources I shared today. There are others you can ask, this is not an exhaustive list (if you have others you think I should add, let me know!)  Before you share online, use the list to help you decide if you should.

If you are using this article as part of supervision, I suggest you pose cases and use the following questions to explore what the best course of action should be when deciding to post on social media. Have the Ethics Code for Behavior Analysts (2020) handy to reference.

The List

1. Have I taken the steps necessary to protect my clients’, stakeholders’, supervisees’, and/or trainees’ information and minimized risk of inadvertent or accidental sharing?
2. Have I obtained informed consent to share this information, picture, story, case, or other?
3. Am I acting in the best interest of my client (or stakeholders, supervisees, trainees) or am I acting in my own best interest?
4. Have I received informed consent to consult on a case with other providers within a public, private, open, closed, or secret group online?
5. Have I shared with my clients the potential risks involved in sharing pictures, video, or their story or other information?
6. Do I have a plan in place in the event what I shared is used for purposes other than intended and for which I have informed consent?

Still not sure if you should post? Then I have a few more questions for you, but before I share them, I want you to practice something every time you decide to turn to social media to share something that happened at work.

• • Write what you are going to post on a piece of paper or type it in a separate document. Make sure you write out the full story. Ask the whole question.
  • Read it.
  • Then ask yourself Question Number 7- 9 (after you have asked questions 1-6)

7. How would I feel if someone wanted to post this about me, my child, my parent, or my partner?
8. How would I feel if I found out someone was publicly posting about my needs, my difficulties learning something, or the mistakes I made when I was in training in a group that my colleagues, co-workers, or even I may belong to?
9. How would I feel if I found out a therapist or doctor shared enough details about my last session that thousands of people now have a window into my private life, including people I know and who guessed it was me?

You should have a better idea if you should post now. Of course, there are often no absolute right and wrong answers. If you are not sure whether you should post something online about things happening at work, even after you have asked all the questions I have posed, email me. I am happy to talk you through it.

-Warmly

Adrienne

A huge thank you to the BACB for putting in the time to publish the updated Ethics Code for Behavior Analysts.

References

Behavior Analyst Certification Board (2014). BACB professional and ethical compliance code for behavior analysts. Retrieved from http://bacb.com/wp-content/uploads/2016/03/160321-compliance-code-english.pdf

Behavior Analyst Certification Board (2020). Ethics code for behavior analysts. Littleton, CO: Author

Merriam-Webster. (n.d.). Merriam-Webster.com dictionary. Retrieved January 7, 2020, from https://www.merriam-webster.com/

National Council of State Boards of Nursing (2011). A nurse’s guide to the use of social media. Retrieved from https://www.ncsbn.org/NCSBN_SocialMedia.pdf

U.S. Department of Labor. (n.d.).  Guidance on the protection of personal identifiable information. https://www.dol.gov/general/ppii/

---

The following are selected excerpts from the Core Principles of the Behavior Analyst Certification Board (2020) Ethics Code for Behavior Analysts that relate to this blog entry

1. Benefit Others. Behavior analysts work to maximize benefits and do no harm by:
   • Protecting the welfare and rights of clients above all others
   • Protecting the welfare and rights of other individuals with whom they interact with in a professional capacity
2. Treat Others with Compassion, Dignity, and Respect. Behavior analysts behave toward others with compassion, dignity, and respect by:
   • Respecting others’ privacy and confidentiality
   • Respecting and actively promoting clients’ self-determination to the best of their abilities, particularly when providing services to vulnerable populations

The following are the selected Ethics Standards that applied to posting about clients or their families on social media. I left the full statement in where I felt the text was particularly powerful.

2.03 Protecting Confidential Information

Behavior analysts take appropriate steps to protect the confidentiality of clients, stakeholders, supervisees, trainees, and research participants; prevent the accidental or inadvertent sharing of confidential information, and comply with applicable confidentiality requirements (e.g. laws, regulations, organization policies). The scope of confidentiality includes service delivery (e.e. live, teleservices, recorded sessions); documentation and data; and verbal, written, or electronic communication.

2.04 Disclosing Confidential Information

3.01 Responsibility to Clients

Behavior analysts act in the best interest of clients, taking appropriate steps to support client’s rights, maximize benefits, and do no harm. They are also knowledgeable about and comply with applicable laws and regulations related to mandated reporting requirements.

3.06 Consulting with Other Providers

Behavior analysts arrange for appropriate consultation with and referrals to other providers in the best interest of their clients, with appropriate informed consent, and in compliance with applicable requirements (e.g. laws, regulations, contracts, organization, and funder policies).

3.10 Limitations of Confidentiality

5.01 Protecting the Rights of Clients, Stakeholders, Supervisees, and Trainees

Behavior analysts take appropriate steps to protect the rights of their clients, stakeholders, supervisees, trainees in all public statements. Behavior analysts prioritize the rights of their clients in all public statements.

5.02 Confidentiality in Public Statements

5.10 Social Media Channels and Websites

5.11 Using Digital Content in Public Statements