Medical Ethics

A paper on which this interview is based was first presented on 13 September 2018 at the Practice of the Future, hosted by the University of the Witwatersrand, Johannesburg. This interview was conducted by Health Bridge and first published on 25 September 2018 by Health Bridge.

To get you the best advice on medical ethics on social media, we talk to Avani Singh, a practising attorney and Director and Co-founder of ALT Advisory, a legal consultancy based in Johannesburg that specialises in the intersection of law and technology in the public interest. In this interview, she talks about the benefits and risks of social media to your practice and the ethics around using your patients’ personal information online.

Firstly, give us some context for the use of the internet and social media in healthcare.

I should start off by saying that I am a tech evangelist. Technology is a powerful tool to access information, share knowledge and uncover solutions to major challenges. This information can then be made available to a wider audience than has ever been possible. But as we know, with this great power comes great responsibility.

In recent years, we’ve seen numerous examples of direct and accidental risks that the use of technology has posed to fundamental rights – such as the right to privacy – and the legal and reputational harms that can result.

The reality is that through the use of technology, we are generating more data, more quickly, than ever before. This can be widely shared with literally a click of a button. Once that data is online, we lose much of our control over it. Shares, retweets and screenshots mean that even deleted information can be recovered or remain publicly available.

That being said, even with the risks involved there is still a myriad of benefits to your practice and the general public by using social media.

Tell us how social media is being used in the medical profession.

Social media, web and mobile technologies are being used in a number of different ways, and in particular to support patient-centred care. Through platforms like Facebook, LinkedIn, YouTube, blogs and discussion forums, it is possible to access, create and share articles, videos, studies and more.

From a patient perspective, social media is being used to access self-management tools, record data, research their symptoms and connect with other patients and support groups.

In turn, the healthcare industry is using social media and technology in general too, for example, gather data about diseases for research purposes, recruit patients into clinical studies and generate visibility of their products and services. This data can then be integrated with other technologies to ensure that it is securely stored and can be easily analysed when needed. Practitioners can also make use of social media to share profiles about the work that they are engaged in and provide patients (and prospective patients) with healthcare tips and advice.

In both the patient and industry examples, the benefits of using technology are numerous. But in all of these engagements, the patient’s reasonable expectation of privacy must be treated as paramount.

Can you expand on what you mean by that?

A reasonable expectation of privacy is the essential test under privacy law. A breach might arise, for instance, if a medical practitioner makes a patient’s image public on social media platforms with identifiers or specific characteristics that reveal the patient’s identity, such as the individual’s face, another part of the body or objects in the image marked with the logo of a specific organisation. This would also depend to some extent on the context in which it is published.

And although individual pieces of information alone might not breach patient confidentiality, the sum of published information could be sufficient to identify a patient or their relatives. As a matter of good practice, one should take into consideration not only what you’ve put in the public domain about a patient, but also what other information might be reasonably accessible about the person that can complete the picture to link to a specific person’s identity.

With all of this in mind, how should medical professionals and practices approach the use of social media?

As mentioned previously, the risks involved shouldn’t in itself be a deterrent for using social media but rather an opportunity to safely engage on these platforms by finding ways to guarantee privacy. One should also bear in mind that social networks may, in fact, be the only way in which some people are able to access health information and that in itself can be used to shape your policy around how and why to use social media. For instance, a person living in a remote area without easy access to medical services, or someone who is concerned about a perceived stigma attached to a particular illness, might choose to first search for information online before deciding whether to seek medical assistance in person.

The first step in using social media is putting appropriate safeguards and mechanisms in place from the outset to ensure that privacy is protected from the first point of contact. This is a common practice for healthcare practitioners in their in-person engagements with patients, because privacy is the basis of every patient-physician interaction – and should be treated as similarly sacrosanct, both online and offline. Protecting and safeguarding personal health data is not only an ethical imperative but a legal requirement as well. Privacy is a multi-faceted concept and includes physical privacy, informational privacy over personal data, decisional privacy over personal choices, and associational privacy over personal relationships.

In short, when practices or practitioners engage on social platforms the same rules that apply offline apply online – so the law stays the same, even as the platform changes. This is especially important for doctors who have an ethical obligation to their patients and to the profession as a whole. It might seem trite for many people, but doctors should not, for instance, post photographs during surgery or complain about patients and colleagues online in a manner that risks harming the profession and the individuals involved, as we’ve seen happen previously.

The challenge is to strike the right balance between making optimal use of technology to share information and reach your existing and prospective patients while putting in place the necessary safeguards to ensure that you don’t breach the ethical threshold of what you’re putting in the public domain.

Can you give us a practical example of how a doctor or practice would strike that balance?

Let’s use a Facebook example. Assume your practice has published a Facebook page to make it easier for patients to find you when they’re searching for healthcare services in their area or in your area of specialisation. Your page would likely include information about your practice and serve as a way for patients to contact you to make appointments. You could also use the page to publish health information from credible sources. This is mutually beneficial: the patient has the necessary information to obtain the desired medical assistance, and the practitioner is able to grow the practice by reaching new patients.

However, as the creator of the Facebook page, it is important to bear in mind certain case law that we have in South Africa on the responsibilities that might arise.  In the case of Dutch Reformed Church Vergesig Johannesburg Congregation and Another v Rayan Sooknunan t/a Glory Divine World Ministries [2012] ZAGPJHC 97, the court noted that the creator of a Facebook page is capable of regulating access to that page. The court likened the position to someone who has made available a notice board in a public passage, who then has an obligation to take down any notices that are shown to be unlawful in content or impact. It is therefore advisable to be vigilant over content that might be posted by third parties on public platforms that you have created and oversee.

Let’s talk about patient consent. Is it a remedy to avoid a lot of potential risks?

Yes and no. Consent can go a long way in allowing you to publish information – provided that it is freely given, specific, informed and offers an unambiguous indication of the patient’s wishes.

As a general rule, consent that has been obtained in a situation where a person has no real choice, feels compelled to consent or faces negative consequences if they don’t, is arguably not valid. And if consent is bundled up as a non-negotiable part of terms and conditions, it might be presumed not to have been freely given.

The HPCSA’s Guidelines For Good Practice In The Health Care Professions also offer guidance regarding consent. Booklet 4 deals specifically with the ethical considerations when seeking a patient’s informed consent; and Booklet 5 deals with confidentiality and the protection and provision of information. Some of the guidance provided includes that to determine whether patients have given informed consent to any proposed investigation or treatment, healthcare practitioners must check how well the patients have understood the details and implications of what is proposed, and not simply rely on the form in which their consent has been expressed or recorded – especially where the initial consent was obtained by a third party. Furthermore, it is advised that while consent may be given either orally or in writing, practitioners should be careful about relying on a patient’s apparent compliance as a form of consent. Consent should also be reviewed from time to time; particularly as new, potentially relevant information becomes available.

So for consent to be informed, it is necessary to tell the patient about the elements that are crucial to making a choice. If, for example, you want your patient to consent to the use of their personal data and medical history as a case study in a blog post or YouTube video, or as part of promotional advertising material published on your social media page, you should ensure that the patient is appropriately informed of the type of data that will be used, the purpose for which it is sought, the right to withdraw consent without detriment, and whether they will be permitted to review the publication beforehand.

In closing, what guidance would you offer practitioners and practices with a social media presence?

In the first instance, make sure that appropriate policies and training is in place for all members of staff who will be accessing data or using social media accounts. Secondly, maintain appropriate security measures to ensure that data is safely and securely stored. And at the same time, review your privacy settings on all the platforms you choose to engage on.

Importantly, remember to use the opportunity to review the consent clause with your patients. And if you are in any doubt about whether to post something or not, apply the same ethical standards of behaviour online as you would elsewhere.

There is no doubt that social media and other internet technologies have meant that patients are becoming more informed and engaged, and perhaps even more empowered, about their care. And as part of that evolution, the healthcare profession has to both leverage the opportunities online to do good, while preserving patient privacy and confidentiality in all contexts. If you strike the right balance, your ability to reach more patients and share knowledge is a powerful way to build your practice and make a positive impact on the health of many more patients.