Undergraduate Law Review at Florida State University

HIPAA’s Modern Patient Confidentiality Gaps: Constructing a Professional Dignity Framework

—

by

Undergraduate Law Review at FSU
in

Writer: Nina Rayman

Editor: Spurthi Reddy

Associate Editor: James Banks

I. Introduction 

    The emergence of social media platforms has revolutionized how healthcare professionals communicate online by allowing medical staff to share their professional experiences through educational content. The National Institute of Health reports that 71 percent of physicians use social media, while a cross-sectional survey of medical students, nurses, advanced providers and physicians found that 18.5 percent  use social media for professional purposes.1 

    The American Medical Association (AMA) and the American Nurses Association (ANA) have recognized that social media can promote public health education and professional collegiality.2 Yet, both organizations warn that online conduct may undermine patient trust and damage the integrity of the healthcare profession.3 Although healthcare-oriented social media content can provide significant educational and professional benefits, it also creates novel confidentiality concerns. As clinical experiences increasingly become material for online content, patient harm may occur even when no traditionally identifiable information is disclosed. 

    This article argues that the current healthcare privacy framework inadequately addresses social media-related confidentiality concerns, as it remains centered on identifiability and formal disclosure. In the social media context, patient harm may arise even when content complies with existing privacy standards. As the healthcare social media landscape moves beyond the sole disclosure of formal identifiers, these harms increasingly stem from the commodification of patient vulnerability for engagement or personal gain. Accordingly, this article proposes a professional-dignity framework that additionally considers disclosures of semi-anonymized information.  

    II. The Identifiability Framework of Healthcare Privacy 

      The modern American healthcare privacy framework is largely organized around identifiability. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes national standards regulating the use and disclosure of “protected health information” (PHI) by covered entities and business associates.4 Central to its framework is the protection of “individually identifiable health information,” with regulatory guidance and enforcement efforts similarly focused on preventing unauthorized disclosures of identifiable patient data and electronically stored PHI.5 This emphasis serves an important privacy function but narrows the harm recognized. Under HIPAA, privacy violations are generally assessed according to whether information can be linked to a particular patient.6 Consequently, forms of patient exposure that do not reveal formal identifiers may fall outside the framework’s primary regulatory concerns, even when they diminish patient dignity or erode public trust in healthcare institutions.

      Courts have likewise recognized limitations within HIPAA’s enforcement structure. In Byrne v. Avery Center for Obstetrics & Gynecology (2018), the Connecticut Supreme Court acknowledged that HIPAA does not provide a private right of action for individuals seeking relief for privacy-related injuries.7 Nevertheless, the court permitted HIPAA standards to inform state-law negligence claims, reasoning that HIPAA could help establish the applicable standard of care in the absence of a federal private right of action.8 Although Byrne did not involve social media conduct, the ruling illustrates judicial recognition that HIPAA alone may not provide a complete response to every privacy-related harm.9 The ruling therefore supports the argument that existing privacy protections may require supplementary professional and institutional standards capable of addressing dignitary harms that arise even when no formal disclosure of identifiable patient information occurs.

      III. Healthcare Social Media and the Commodification of Patient Vulnerability

        The limitations of HIPAA’s identifiability-based framework become particularly apparent in the context of semi-anonymized patient-related social media content. Recent scholarship has observed that social media platforms encourage users to share “unique or spectacular stories and photos” capable of generating likes and follower growth.10 These incentives create ethical concerns regarding the entertainment aspect of published clinical experiences. Researchers have further warned that social media’s invisible audience and permanence significantly magnify the consequences of healthcare disclosures.11 Confidentiality breaches initially confined to clinical settings can now circulate indefinitely.12 Studies also suggest that accounts associated with confidentiality breaches may receive greater engagement, reinforcing incentives toward sensationalized content.13

        As healthcare social media culture has expanded, incidents involving patient-related content have become increasingly common. In 2025, licensed practical nurse Yazz Scott was terminated and investigated by the Florida Board of Nursing after livestreaming a medication pass on TikTok.14 This incident did not disclose traditional patient identifiers yet, it generated concern because it pushed a localized privacy disclosure toward public scrutiny. HIPAA provides limited guidance in such situations because the primary harm does not stem from the disclosure of identifiable information.

        Several months later, healthcare workers at Sansum Clinic in California were fired after posting pictures of patients’ bodily fluids left on examination tables.15 Similarly, the controversy, while no explicit PHI was exposed, generated substantial criticism as the images exploited an intimate clinical moment for online engagement. The perceived exploitation of patient vulnerability and the erosion of trust in the provider-patient relationship resulted in significant harm. While the patients involved could not readily be identified, the conduct nevertheless appeared inconsistent with the respect and dignity expected within healthcare settings.

        Semi-anonymized content inflicts a two-fold harm: it objectifies an individual patient’s vulnerability while simultaneously committing a systemic harm by eroding public trust in provider-patient confidentiality. Because the resulting harms often arise independently of patient identifiability, existing privacy frameworks provide limited guidance for evaluating such conduct. This gap warrants a framework that addresses patient dignity alongside confidentiality concerns.

        IV. Toward a Professional-Dignity Framework 

          A strengthened patient privacy framework should regulate the conditions under which clinical experiences become public content without fully prohibiting the use of social media by healthcare professionals. Unlike traditional professionalism standards, which primarily evaluate whether healthcare providers conduct themselves appropriately, a professional-dignity framework focuses on whether patient experiences are used in a manner that respects the inherent dignity of the individual involved. The inquiry therefore shifts from the provider’s behavior alone to the impact that content may have on patients and the broader perception of healthcare relationships. 

          The AMA and ANA have recognized this, and hold that providers must maintain rigorous standards of professionalism.16 The AMA has cautioned that physicians “cannot realistically separate” their personas online and therefore must maintain standards of patient privacy and confidentiality when engaging on social media.17 Similarly, the ANA has emphasized that nurses must uphold professionalism online and avoid posting content that could undermine patient dignity or public trust in the profession.18 Yet these institutions ultimately rely on the inherently vague standard of ‘professionalism’, leaving substantial ambiguity regarding what conduct should trigger professional or legal consequences. 

          The AMA approach treats social media rules as a “starting point,” emphasizing that ethical norms must adapt as technology changes while still preserving confidentiality and patient trust.19 This places the decision in the hands of healthcare professionals, requiring them to pause and evaluate the audience reach and permanence of any potentially disclosing post. Hospital policies also show that healthcare systems already regulate beyond HIPAA’s narrow framework. Mayo Clinic requires employees to maintain patient privacy through compliance with photo and video policies and recognizes that unprofessional behavior online may create liability for both the employee and the institution.20 Cleveland Clinic similarly prohibits patient images and personal health information but also prohibits embarrassing or otherwise objectionable content.21 These policies recognize that harms can arise from perceived disrespectful exposure. 

          A professional-dignity framework should therefore distinguish legitimate educational medical communication from exploitative patient-adjacent content. Existing guidance already gestures toward this balance. The ASPN NEURON project, a clinical guideline initiative of the American Society of Pain and Neuroscience,  acknowledges that social media can strengthen patient education and professional collaboration; however, only if clinicians maintain professional boundaries by obtaining written consent for patients involved in audiovisual material and treat online content as permanently public.22 Despite this, professionalism standards alone may no longer be sufficient, especially when monetization incentives are involved.23 

          Under a professional-dignity framework, healthcare institutions, licensing boards and professional organizations could evaluate patient-related social media content according to several factors: whether the content serves a legitimate educational purpose; whether meaningful patient consent was obtained; whether the content risks humiliating, objectifying, or exploiting patient vulnerability; and whether audience engagement, personal branding, or monetization appears to be the primary purpose of the post. Such an approach would provide clearer standards than generalized appeals to professionalism while preserving space for legitimate educational communication. 

          Because digital communication is now embedded within medical practice, healthcare institutions should place greater emphasis on early and continuous education surrounding digital ethics and patient dignity throughout medical and nursing training. This emphasis should begin during professional education and continue through clinical practice. Instead of relying on punishment after a viral incident occurs, healthcare institutions should adopt a preventative professional-education strategy that specifically addresses semi-anonymized exposure, audience permanence, engagement-driven incentives, and the commodification of patient vulnerability. 

          Under this approach, medical education and communication remain protected forms of medical speech while healthcare institutions and licensing boards may treat exploitative semi-anonymized patient content as a professional violation. By focusing on patient dignity rather than solely on identifiability, a professional-dignity framework would better address the confidentiality challenges posed by healthcare professionals’ social media use.

          1. Anthony Giuffrida et al., Social Media Behavior Guidelines for Healthcare Professionals: An American Society of Pain and Neuroscience NEURON Project, 5 J Pain Res. 3588 (2024);
            Cody Dalton et al., Evaluating perceptions of social media professionalism by healthcare workers, 12 Digital Health, 2 (2026). ↩︎
          2. Am. Med. Ass’n, Code of Medical Ethics, at 2.3.3 (2017), https://policysearch.ama-assn.org/policyfinder/detail/E-2.3.2%20?uri=%2FAMADoc%2FEthics.xml-E-2.3.2.xml (on file with the Undergraduate Law Review at FSU); 
            Am. Nurses Ass’n, The Code of Ethics for Nurses with Interpretive Statements, https://www.nursingworld.org/social/ (on file with the Undergraduate Law Review at FSU). ↩︎
          3.  Id. ↩︎
          4.  CDC, Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Sep, 10, 2024), https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaahtml (on file with the Undergraduate Law Review at FSU). ↩︎
          5. 45 C.F.R § 160.103 (2024); U.S Dep’t of Health & Hum. Servs., Summary of the HIPAA Privacy Rule (May 3, 2026),  https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.htmlt (on file with the Undergraduate Law Review at FSU); U.S Dep’t of Health & Hum. Servs., How OCR Enforces The HIPAA Privacy & Security Rules (Nov. 20, 2023), https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-security-rules/index.html (on file with the Undergraduate Law Review at FSU). ↩︎
          6. U.S Dep’t of Health & Hum. Servs, supra note 5. ↩︎
          7. Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 327 Conn. 540, 572–73 (2018). ↩︎
          8. Id. ↩︎
          9. Id. ↩︎
          10. Emily H. Garmon et al., Preserving medical professionalism in the age of social media, 1 J.C. Adva. 1 (2024). ↩︎
          11. Terry Kind, Professional Guidelines for Social Media Use: A Starting Point, 17 AMA J. Ethics 444 (2015). ↩︎
          12. Garmon et al., supra note 10, at 1–2. ↩︎
          13. Id. ↩︎
          14. Steve Adler, TikTok Live Incident Results in Termination and Board of Nursing Investigation, The HIPAA Journal (June 5, 2025),  https://www.hipaajournal.com/tiktok-live-termination-board-of-nursing-investigation/ (on file with the Undergraduate Law Review at FSU). ↩︎
          15. Christopher Buchanan, TikTok video showing Santa Barbara clinic staff mocking patient stirs anger, L.A. Times (Sep. 3, 2025), https://www.latimes.com/california/story/2025-09-03/santa-barbara-healthcare-workers-fired-after-tiktok-post (on file with the Undergraduate Law Review at FSU); Video posted by Sara Walker (@haussdrama), TikTok, Sansum Health Clinic, Santa Barabara Cal. (Sep. 2, 2025),  https://www.tiktok.com/@haussdrama/video/7545549168547253535?_r=1&_t=ZP-96TJ3e7JVR1 (on file with the Undergraduate Law Review at FSU). ↩︎
          16. Am. Med. Ass’n, Code of Medical Ethics Provision 2.3.3 (2017); Am. Nurses Ass’n, The Code of Ethics for Nurses with Interpretive Statements (2021); Kind, supra note 11. ↩︎
          17. Am. Med. Ass’n, supra note 16. ↩︎
          18. Am. Nurses Ass’n, supra note 16. ↩︎
          19. Kind, supra note 11, at 1. ↩︎
          20. Mayo Clinic, Social Media Guidelines for Employees, PR News Online,    https://www.prnewsonline.com/Assets/File/MayoClinic.pdf (on file with the Undergraduate Law Review at FSU). ↩︎
          21. Cleveland Clinic, Social Media Policy (2026),
            https://my.clevelandclinic.org/about/website/social-media (on file with the Undergraduate Law Review at FSU). ↩︎
          22. Anthony Giuffrida et al., supra note 1, at 3590. ↩︎
          23. Monetization concerns arise when online engagement generates financial advantages for content creators, potentially encouraging the publication of content that departs from educational purposes. ↩︎

          Comments

          Leave a comment