Federal and state laws are implicated when a medical office decides to promote its services, whether through establishing a website for the medical office or participating in forums such as Facebook, LinkedIn or Twitter. This article focuses on the do’s and don’ts arising from federal and state laws on advertising and privacy.
1 Do be truthful
When a medical office establishes a website or other online presence, one purpose is usually to promote its services. Advertising and promotion raise potential for scrutiny from the Federal Trade Commission (FTC) and state agencies. Federal and state laws protect consumers from misleading advertising, misrepresentations about goods and services, and unsubstantiated claims. Even laws regarding professional service providers or licensing may include provisions that prohibit advertising or promotion of professional services that may be false, misleading or deceptive. For example, California’s Business and Professions Code, Section 651 prohibits “public communication” including “Internet, or other electronic communication” that is false, misleading or deceptive, including claims “of professional superiority or of performing services in a superior manner, unless that claim is relevant to the service being performed and can be substantiated with objective scientific evidence.” A violation of that law is categorized as a misdemeanor and could lead to disciplinary action including suspension or revocation of a professional license.
Therefore, be wary of how your medical office highlights or promotes its services on a professional website or on social media such as Facebook, Twitter, LinkedIn and other platforms. “What is paramount is being honest and truthful,” cautions Peter T. Berk, a Chicago lawyer at McDonald Hopkins. Berk advises all his clients to ensure “if you are going to post something, make sure it’s truthful.” While the goal of marketing and advertising is to highlight the positives and motivate prospective patients to come to your medical office for healthcare services, you must be careful how you do that and the words you choose. Your materials “can’t be half true or even creatively spin things,” says Berk.
2 Don’t assume testimonials or endorsements are okay
Happy patients talking about how great your medical office is, how competent the providers are, and how wonderful and efficient the staff are can be great publicity for your medical office. But think twice about including those types of references formally on your website or social media platform. First, “medical and ethical issues are paramount because that’s a licensing issue,” explains Berk. Your state’s licensing entities or other state laws addressing the medical profession may address or even prevent use of testimonials to promote a licensed medical professional.
“If you can get past the medical and licensing issues, the FTC wants it to be clear that people who provide endorsements must disclose any interest they have in your medical office,” advises Berk. The FTC has guidelines on the use of testimonials and endorsements. The need to avoid misleading consumers is a primary concern. Not only the FTC but state laws as well often require that, like any advertisement, a testimonial is not misleading or deceptive. For example, the California Business Professions Code referenced above prohibits use of a testimonial “that is likely to mislead or deceive because of a failure to disclose material facts.”
Berk warns that any testimonial must therefore disclose any interest the entity has in the service or product they are endorsing. So for example, if a staff member receives medical treatment from one of the physicians practicing in the medical office, that staff member can’t provide a testimonial on the practice’s website or on the Facebook or other social media platform without disclosing the fact that she or he also works for the medical office. The FTC looks at that as misleading, explains Berk.
3 Don’t mislead
If you do use testimonials, you also want to make sure they aren’t misleading about services and potential results. Be sure to note that because a particular patient had this result doesn’t mean others will too. If you fail to say that in connection with the testimonial, it can create misrepresentations that the FTC and state agencies will be concerned about, says Berk.
If your medical office has an interactive website and allows patients to post comments, note that a patient’s post doesn’t just raise issues regarding testimonials but it raises some HIPAA (Health Insurance Portability and Accountability Act) concerns as well. For example, if a patient says in a comment on your website or in any social media or online platform that a physician in your medical office did a great job on an ACL (anterior cruciate ligament) repair, or that the nurses at your medical office are exceptional, no one from the medical office can respond in any way—whether it be even just to say thank you or, if the comment is negative, to defend your office against or refute that comment, warns Berk. Doing so could be a HIPAA violation, he says. That’s because the comment confirms that the individual received services from the medical office and depending on the circumstances, could give away protected health information, he explains. This principle could be equally applicable to retweeting a positive Tweet about the medical office.
4 Do add disclaimers
When your medical office establishes a website, be sure to set some boundaries and limits for individuals using that website. To do that, you should have a terms-of-use policy available on the website which includes disclaimers about the purpose of the site and what users can and can’t do on the site or expect from the site. For example, according to healthcare Internet technology (IT) lawyer Lisa W. Clark, of Duane Morris LLP in Philadelphia, such disclaimers should include notice to users of the following:
–Information on the site or social media platform presented by the medical office doesn’t create a physician patient relationship or constitute medical advice for a specific patient;
–Information provided does not replace the need for face-to-face consultation with a physician;
–The medical office is not promoting or endorsing any product or service mentioned on the site and doesn’t address the quality of any product or service; and
–The medical office has no control over third party links to the medical office website.
Clark warns that a third party could link to your office’s website or make representations about the practice. You don’t want to be misleading visitors, so emphasize that the medical office has no control over third parties that link to the site, she says.
Consider adding a banner at the bottom or top of your website, advises Clark, to make certain essential disclaimers immediately prominent for all visitors to your site. “If your website includes a patient portal in which the patient may communicate with you or the medical office with respect to treatment, billing or other matters, you should also consider whether specific terms of use are necessary,” she adds.
5 Don’t confuse HIPAA with general privacy issues
Don’t think that just because you have a HIPAA Notice of Privacy Practices included on your medical office’s website all privacy issues have been addressed. The medical office must have a policy that addresses HIPAA but it must also have a General Privacy Policy for the website that addresses privacy concerns other than HIPAA concerning the use of data on the website, such as whether the site uses cookies, what types of information may be collected from users of the site, and what will or will not be done with that information, warns Clark. “The FTC likes to see that a website, whether it is sponsored by a healthcare provider or not, lets the customer know all the ways in which data will be protected,” says Clark.
6 Do be careful about using information collected from patients
With any website there is the potential to collect information about visitors to the site. “Be aware of what information you are collecting and how you are using it,” says Berk. He indicates that state attorneys general are expressing concern about privacy practices of medical related websites. For example, Berk notes that the Illinois attorney general has inquired of medical-related entities about the information they collect via their websites and what they do with it.
If you collect information or track the activity of visitors to your site and then use the information gained to target individuals with specific messages, that activity could create problems. For example, if your medical office uses information gained through cookies to generate pop-up messages targeted to only certain patients meeting specific criteria, “that could be improper use of protected health information that could prompt the government’s interest,” warns Clark.
Note too that HIPAA requires patient authorization for certain marketing activities. If a medical office website contains information encouraging patients to buy a product or use a service or the medical office uses information gained from patients to promote a product to them, that could be marketing that could require a HIPAA authorization, says Clark. The Department of Health and Human Services (HHS) provides examples of conduct considered marketing under HIPAA, requiring patient authorization. Those examples include a provider selling a drug manufacturer a list of patients so the manufacturer can send those patients coupons for specific medication. Such use of a patient list would constitute marketing under HIPAA and require the patient’s authorization. If a third party pays a medical office to communicate to its patients about certain products, HIPAA likely would require patient authorization for that communication, adds Clark. The pop-up communications mentioned above would also likely constitute marketing under HIPAA. There are exceptions to the definition of marketing, such as general healthcare information provided to all patients, but any time remuneration is involved those exceptions may be inapplicable. Given the complexities, a medical office should always consult an experienced HIPAA lawyer before engaging in potential marketing activities.
7 Don’t forget to get business associate agreements
Your medical office may consider getting help setting up or managing its website or handling a social media presence. It could be from a web designer, marketing consulting or advertising agency. Regardless of the entity, remember to get business associate agreements with those outside entities if they will be having any access to protected health information, warns Clark.
8 Do consider kickback and self-referral issues
As with many aspects of managing a medical office, you must also remember kickback and self-referral laws when dealing with a medical office website or online platform. If a medical office website references other providers with whom the practice has a relationship or if it mentions products or utilizes any service or resource that is provided without cost or at discounted cost to the practice, Clark warns that the medical office needs to be concerned about potential liability for kickback and self-referral violations. For example, if your medical office’s website includes ads for another provider’s services, or uses an appointment reminder system that is provided by a drug manufacturer, she advises that your medical office should consult a lawyer experienced with kickback and self-referral issues to evaluate if there are any improper inducements, payment for referrals or other issues relating to kickback and self-referral laws.
9 Don’t assume it’s okay to do something you see other offices doing
Don’t assume that something you see another medical office doing online –either on their website or on a social media platform such as Facebook or LinkedIn– is okay for your medical office to do too, warns Clark. “Every case is different,” she explains. Just because another practice is providing something on its website or undertaking some type of marketing or promotional activity, doesn’t mean it is safe and won’t cause potential legal problems for your medical office. Laws vary from state to state and application of those laws depends on the facts and circumstances. The underlying facts and circumstances may not be the same for your medical office. Always seek professional legal advice to ensure your medical office’s online practices are compliant with the law.
