Social Media Confidentiality, Disclosures, & Record Keeping

The Therapist
November/December 2019
Kristin Roscoe, JD (CAMFT Staff Attorney)
Updated November, 2022 by Bradley J. Muldrow, JD (CAMFT Staff Attorney)

Take a moment to look around you. For many of you, either your cell phone or computer is close at hand. You might even be reading this article on CAMFT’s website. In today’s connected world it should come as no surprise that many of your patients will have “Googled” you before setting their first appointment. Moreover, that new patient who just completed intake may have viewed not only your professional online profile, but also any publicly-available social media pages you may have.ⁱ

Even if you do not partake, a majority of Americans today use Facebook^.ii With the widespread adoption of social media applications, from blogs to Instagram and LinkedIn to podcasts, CAMFT’s legal department is increasingly fielding calls about legal and ethical concerns related to social media communication and advertising. While a therapist might have both a personal and professional online presence the potential exists for ethical boundaries to become crossed. This article will address many of the legal and ethical considerations associated with practicing in the digital age.

Informed Consent/Disclosures
The CAMFT Code of Ethics states that marriage and family therapists should provide their patients with adequate information to permit patients to make meaningful decisions about their therapy^.iii What this means for therapists with a social media presence is that it may be appropriate to incorporate some of the common ethical issues that arise as a result of an active online presence in the informed consent process.

If you use social media – whether socially or professionally – one tool therapists can use to supplement their current informed consent materials is a social media policy.^iv Similar to your current informed consent paperwork, a social media policy reinforces appropriate professional boundaries with patients before any issues arise. A social media policy can provide patients with an understanding as to how the therapist will conduct themselves on the Internet by addressing how the therapist will interact with current and former patients. By addressing potentially difficult ethical issues in a social media policy you have a solid foundation to refer to if professional boundaries are crossed.

A social media policy may address issues such as:

• Whether the therapist responds to “friend requests” from either current or former patients;
• The confidentiality and security of information transmitted via social media; and
• Whether patients should discuss clinical issues via the therapist’s social media platform (either publicly or privately).

Dual Relationships
The CAMFT Code of Ethics provides that therapists are to avoid dual relationships with patients that are reasonably likely to impair professional judgment or lead to exploitation^.v While dual relationships may be readily apparent in your day-to-day life, they may be more nuanced when that second relationship is online.

Today, many therapists use social media to advertise their businesses. Such advertisements may take the form of professional blogs, Instagram account, etc. To avoid crossing boundaries with patients, therapists are encouraged to discuss issues of confidentiality with their patients. Further, just as a therapist should not respond to a negative Yelp review, a therapist should not engage their clients publicly via a professional account.^vi

While the dual relationship formed by accepting a friend request on personal social media account may not initially be clearly unethical, over time that online relationship may evolve to the point of becoming an unethical dual relationship. For example, it is not uncommon for therapists to receive social media “friend” or “follow” requests from patients. By accepting a “friend” request or interacting with current or former patients via social media a therapist opens the door to the therapist’s private life that previously did not exist. If the therapist and patient begin exchanging “likes” on photographs or postings those interactions can begin the slippery slope toward the development of an unethical dual relationship by potentially engaging in a close personal relationship with the patient through social media interactions.^vii Further, by accepting a “friend” request on personal social media channels, not only does the patient have access to your life, but you gain information regarding their patient’s personal life that they may not previously have been privy to. If this information differs from that which has been shared in session, how will you respond and how will it impact your treatment of the patient?

As with all social media platforms, the purpose is typically for the development of relationships, including those professional relationships. For this reason, applications such as LinkedIn can also open the door to potential unethical relationships. For example, a current patient sends you an invitation to connect on LinkedIn, which you accept. Two months later she asks you to be a reference for a job she is applying for since she saw that you are also connected via LinkedIn with a recruiter at this new company. By accepting that professional connection, have you held yourself out as being in a professional relationship with the patient? How should you best respond (if at all) to such a request? It is important that therapists consider whether accepting a friend request from patients, (former or current) creates an unethical dual relationship. A conservative approach to social media interactions with current and former clients can help a therapist avoid ethical conundrums at a later date.

Confidentiality
The CAMFT Code of Ethics generally provides that with limited exceptions, therapists do not disclose patient confidences and advise patients of significant exceptions to confidentiality (e.g., child, elder and dependent adult abuse reporting).^viii Further, therapists will take care when disseminating, transmitting, or receiving patient information via the Internet.^ix

The informed consent process for any therapist who has an online presence should include a discussion with the patient regarding limits to confidentiality when using the Internet to transmit information. For example, a current patient posts a public response to your most recent Instagram post related to anxiety. In their response, your patient expresses that they are having a difficult workday and request specific advice from you to help them navigate a difficult situation that has heightened their anxiety. Although the patient is initiating the conversation online, the therapist should take care not to breach the patient’s confidentiality by posting a direct response.

It is important to convey to your patient that as their therapist you will not breach their confidentiality. However, your patient may be in the habit of “checking-in” to certain locations and may do so at your office as a matter of habit without considering the ramifications. In such a case where a patient may be inadvertently disclosing their own treatment information to friends, family, and others that they are seeing psychotherapy treatment, it may be appropriate to have a conversation with the patient to confirm they understand the potential ramifications of such action. Additionally, as discussed above, for those therapists who use social media as a means of advertising, it may be appropriate to discuss with patients the limitations to confidentiality if they interact with their therapist publicly online such as by publicly responding to an Instagram post.

Regardless of whether your practice is a HIPAA-covered entity, it is important to remember that social media platforms such as Instagram are generally not secure forums in which to discuss patients’ needs.x Social media accounts can and do get hacked or accessed by third parties, so even private messages exchanged with a patient might be unlawfully accessed. By reminding your patients of these limits to confidentiality as part of your informed consent process, you are setting appropriate boundaries so your patients know how best to reach you if the need arises outside of session.

Today, some therapists may want to include summaries of their clinical work in Instagram posts or as stories for podcasts to make their work more relatable to potential patients. This issue might arise if a patient has a breakthrough regarding something they have been working on for weeks. After the patient’s session, the therapist types up a summary of what the patient was struggling with and how the patient achieved the recent breakthrough. In this summary, the therapist omits the patient’s name, but includes details regarding the patient’s marital status and unique area of employment. The therapist posts this summary to their private Instagram page where it starts garnering feedback from their followers.

It is important to remember that therapists generally do not use their professional relationship with patients to further their own interests.^xi Even if you have set your social media account as “private,” any unauthorized sharing of your patient’s confidential information is a breach of the patient’s privacy. Further, by including details unique to a patient, any third-party who views an “anonymized” social media post may be able to identify your patient with very little effort. As a result, not only could you face a BBS complaint regarding the unauthorized breach of your patient’s confidentiality, a potential HIPAA violation if you are a covered entity, but your patient may also have grounds to file a lawsuit for various privacy-related torts.

Even if the therapist requested authorization from the patient before posting the summary to social media, the therapist should consider whether they are exerting undue influence over the patient. Before approaching a patient to make their story “public,” a therapist should consider whether the patient may be susceptible to influence by the therapist (e.g., whether the patient is one who can say “no” if they want to).^xii

Clinical Concerns
According to a 2018 survey, 28% of licensed mental health professionals and 10% of graduate students search online for information related to their therapy patients.^xiii Imagine your new patient complains of being misunderstood in her social media posts. After session, you decide to “Google” the patient, ultimately finding her Instagram feed and scrolling through it. This may appear to be insignificant, however, therapists walk an ethical grey line when they conduct online research of a patient without the patient’s knowledge.

Being open with your patient upfront as part of the informed consent process allows you to explain the circumstances under which you may use the Internet to search for personal information without the patient’s consent (such as if they are in crisis and you are attempting to locate them). By setting boundaries, the therapist can avoid situations where they come to learn relevant, but previously unshared information regarding patients. Instead of scrolling through the patient’s social media feed without first advising a patient of your intention, a therapist can consider whether it is appropriate to incorporate the patient’s social media postings into treatment with the patient’s consent.

Clinical Considerations before Engaging a Patient via Social Media:

1. Is communication via social media appropriate for this individual?
2. Would it be in the patient’s best interest to have a telehealth or in-person session instead?
3. Are there ethical concerns with asynchronous communication for this patient?
4. Will your patient understand the meaning behind the words you use if your language is open to interpretation? 
5. What do the treatment plan and goals look like for a patient with whom you are communicating on social media?

Add Disclaimers to Your Social Media
Context and nuance can be easily misunderstood in online communications, particularly if an individual is in need. For this reason, disclaimers relevant to the content being shared as well as the therapist’s boundaries should be incorporated into each social media account and adhered to. The presence of a disclaimer for the public to reference is an important tool to pre-emptively address boundary and ethical issues that might arise as you build your online presence. For example, your professional Twitter feed often includes inspirational messages relating to your trauma practice. One day you receive a response to a tweet from someone seeking guidance related to their specific trauma experience.

No therapist-patient relationship is formed by merely posting thought-provoking messages or images on your social media pages. For this reason, you do not have an obligation to provide advice to non-patients who contact you looking for specific advice. In fact, responding to a non-patient and providing a professional assessment may open the door to malpractice liability. In the case of Mero v. Sadoff, the court held that an individual who sustains injuries as a result of a physician’s examination may bring a malpractice claim even where there is no physician-patient relationship.xiv For therapists, this means that if you were to provide a non-patient with your professional assessment and the resulting harm is reasonably foreseeable, then the non-patient may bring a malpractice claim against you for the harm caused by your assessment.

To avoid potential liability, if you are contacted by a non-patient you should decline to provide professional advice via the Internet. Even if it is a straightforward question, if you respond to the non-patient, you are setting yourself up for potential liability. The easiest way to address a potential contact before it happens is by including clear disclaimers on your social media such as:

• My posts are not a replacement for therapy. 
• The information contained in my posts is general information for educational purposes only.
• The information on this feed is not, nor is it intended to be, therapy or psychological advice. 
• Nothing I post should be considered professional advice.
• I am not able to answer questions regarding your specific situation.
• If you are a current or former patient, please remember that your comments or likes may jeopardize your confidentiality.
• The information provided does not constitute the formation of a therapist-patient relationship.
• Please consult your physician or mental health provider regarding advice or support for your health and wellbeing. If you are in crisis, please call your local 24-hour hotline or 911.

Take the opportunity provided by the various social media platforms to immediately inform potential visitors to the site of what they can expect by visiting your page. Each platform is unique, however on Twitter you have the option of “pinning” a Tweet to the top of your feed. On Instagram, you can consider pinning a disclaimer story as a highlight story underneath your biographical information that complies with applicable advertising requirements. Just as you would address these boundaries in an informed consent with a patient, by putting social media visitors on notice, you are setting yourself up for success in addressing future ethical concerns.

Recordkeeping
Picture a patient’s record. Did you picture a direct message exchanged with a patient on Instagram? If you use social media or other methods of social media to communicate with your patient those communications may be part of the patient record.

As an illustration, during intake with your new patient, you discussed your social media policy and the patient agreed to comply with it. One evening as you are getting ready for bed you hear your iPad ping. You see that you have received a new direct message on your Twitter account from your new patient. The patient ran into her ex-boyfriend while grocery shopping this evening and her suicidal ideations have returned. The patient refused your phone call, so over the next twenty minutes, you correspond back and forth via direct message until you believe your patient is stable and unlikely to harm herself. Two months later you receive a subpoena for “all medical records and communications pertaining to the patient.”

Even with a social media policy in place your patients still might cross boundaries and communicate with you via social media. Depending on the nature of the communication received, those electronic communications may be considered a part of the patient’s treatment record – particularly if you receive a subpoena for records. Whether or not these communications should be included depends on several factors.

First, if you receive a subpoena seeking “all communications” or the patient’s “medical record” there are several questions to consider as to whether social media communications should be included in what you produce including:

1. Did your response to the patient contain clinical advice that you otherwise would have provided while in session?
2. Were the events giving rise to the communication relevant to your future treatment of the patient?
3. Was the communication relevant to your relationship with the patient even if not clinically relevant?

Second, if any of these questions apply to your communications with the patient you should then turn to the specific wording of the subpoena for further guidance. As with any subpoena, look to what is specifically requested. Although the exact wording of the subpoena will differ from attorney to attorney, the records requested often touch upon three broad categories:

1.  All medical records relating to the patient; 
2.  All records relating to the patient, whether electronic or oral; or 
3.  All communications to, from, or regarding the patient.

If this type of wording appears in the subpoena you receive then it will be important to consider whether social media communications may be appropriate to include in your production of records.

Conclusion
Social media and other modes of electronic communication offer therapists an unprecedented opportunity to market their practice and connect to colleagues and future patients. If they use social media, whether professionally or socially, therapists should consider whether adding a social media policy to their informed consent is appropriate for their practice. Additionally, social media posts should be accompanied by appropriate disclaimers to advise the public of the boundaries the therapist is setting and abiding by. Finally, therapists should consider whether social media and electronic communications are part of the patient’s record when responding to document requests and subpoenas. For more information about social media interactions, visit the CAMFT website at www.camft.org and/or call CAMFT’s legal department for a consultation at (858) 292-2638.

---

ⁱA 2016 survey by Kolmes & Taube of 332 therapy patients found that 69.9% of the surveyed patients found personal information about their therapist online. Of that 69.9% of patients, 86.6% reported intentionally seeking out the personal information. Over half of these patients used social media for their searches. Kolmes, K. & Taube. D. O. (2016).
ⁱⁱAaron Smith and Monica Anderson, Social Media Use in 2018, Pew Research Center (Mar. 1, 2018), https://www.pewinternet.org/2018/03/01/social-media-use-in-2018/; Josh Constantine, Instagram hits 1 billion monthly users, up from 800M in September, TECHCRUNCH (June 20, 2018), https://techcrunch.com/2018/06/20/instagram-1-billion-users/.
ⁱⁱⁱSee CAMFT Code of Ethics Rule 3.1.
^ivFor an example of a comprehensive social media policy, see Kolmes (2010) “Social Media Policy,” http://www.drkkolmes.com/docs/socmed.pdf.
^vSee CAMFT Code of Ethics Section 4 et seq.
^viFor more information on how to appropriately respond to negative reviews, please see Alain Montgomery’s article, You, Yelp and Social Media (The Therapist, Sept/Oct. 2015), https://www.camft.org/Resources/Legal-Articles/Chronological-Article-List/you-yelp-and-social-media.
^viiSee CAMFT Code of Ethics Section 4 et seq.
^viiiSee CAMFT Code of Ethics Rules 2.1 and 3.6.
^ixSee CAMFT Code of Ethics Rules 2.1 and 2.3.
^xFor an in-depth reading on the topic of whether your practice is a HIPAA-covered entity, see Dave Jensen’s article, Are You a Covered Entity (The Therapist, July / Aug. 2010), https://www.camft.org/Resources/Legal-Articles/Chronological-Article-List/are-you-a-covered-entity.
^xiSee CAMFT Code of Ethics Rule 4.7.
^xiiSee CAMFT Code of Ethics Rule 8.4.
^xiiiPirelli, Hartigan, Zapf (2018).
^xivMero v. Sadoff (1995) 31 Cal. App. 4th 1466.