Patient privacy on social media: HIPAA and 42 CFR Part 2 basics for rehabs

Social media and patient privacy pull in opposite directions: platforms reward personal stories and replies, while treatment centers must protect who their patients are. A few clear habits let a center post every day without crossing the line.

The two sets of rules

• HIPAA protects patients' health information held by covered entities and their business associates, and it requires written authorization before using a patient's information in marketing. See HHS guidance on marketing under HIPAA.
• 42 CFR Part 2 adds stronger confidentiality protections for substance use disorder treatment records at federally assisted programs. See the regulation at eCFR, 42 CFR Part 2.

In practice, both point to the same rule on social media: never reveal, confirm or imply that a specific person is or was a patient without proper written authorization.

Common mistakes

1. Replying to a comment as if the person is a patient. "So glad you're doing well since you left us!" confirms treatment. Reply generally, or move the conversation to a private channel with your admissions team.
2. Photos with people in the background. A client walking past in a group photo, or a name on a whiteboard, is a disclosure. Shoot empty rooms, or only people with signed releases.
3. Testimonials without written authorization. Get a signed release before using anyone's story, voice or face, and never feature people currently in treatment.
4. Staff posting from work. Train staff not to post photos or details from inside the facility on personal accounts.
5. Sharing patient details with your marketing agency. Your agency should never need them. If it can access any protected information, it needs a Business Associate Agreement.

Habits that keep you safe

• Use a written release for every person on camera, staff included, collected before filming.
• Feature alumni and family only once they're no longer in your care, and only with consent.
• Keep a simple register of who has signed, with the scope and date.
• Let your admissions team handle every DM and comment. Set an auto-reply that points people to your admissions line and to the 988 Suicide & Crisis Lifeline.
• If someone withdraws consent, remove everything featuring them quickly and confirm it in writing.
• Keep patient information out of email, chat tools and forms your marketing team uses.

What a compliant agency looks like

A good treatment marketing partner signs a BAA, builds its process so it never needs patient information, collects releases before filming, and pulls any post when in doubt. That's the approach behind FirstCall Social's compliance process.

This article is general information, not legal advice. Talk to a healthcare attorney about your center.