Athletic Training Students' Knowledge of Ethical and Legal Practice with Technology and Social Media
Technology, social media, and access to health care continue to grow simultaneously. There is limited research on the knowledge of athletic training students regarding the ethical and legal practice of protected health information using technology and social media. To explore social media use of athletic training students and to determine their knowledge of patient privacy regulations within social media and technology. Online survey instrument and knowledge assessment. A total of 652 athletic training students. A knowledge assessment of 12 items based on the governance and use of patient privacy compliance in health care within the context of athletic training students' clinical experiences. An instrument of 26 questions, including 14 demographic and 12 knowledge items, was developed and content validated using a Delphi panel of experts in athletic training, health care information technology, and risk management lawyers. Descriptive statistics and independent t tests were calculated. Athletic training students stated they had received previous education (n = 587 of 637, 92.2%) regarding Health Insurance Portability and Accountability Act (HIPAA) regulations, and had an average of 6.81 ± 2.75 active social media accounts. Only 24.2% (n = 154 of 636) of respondents stated their professional athletic training program had a social media policy that was strictly enforced. We identified a lack of knowledge of best practice by athletic training students, with an average knowledge assessment score of 4.92 ± 1.7 out of 13 (37.8%). Total knowledge scores were significantly different (P = .008) if the respondent had previous HIPAA education. The respondents scored poorly on the knowledge assessment despite previous education related to HIPAA regulations. Athletic training educators should seek out strategies to adapt professional or preprofessional curricula to incorporate health care informatics and ethics to adapt to the current culture of technology and social media.Context:
Objective:
Design and Setting:
Patients or Other Participants:
Intervention(s):
Main Outcome Measure(s):
Results:
Conclusions:
KEY POINTS
-
Athletic training students performed poorly on a knowledge assessment concerning health care informatics.
-
Athletic training educators should incorporate health care informatics in the curriculum, as well as seek out ways to properly incorporate information technology and digital devices into clinical practice with their athletic training students.
-
The legal and ethical practice of athletic training students needs improvement to protect the patients, their preceptors, the athletic training program, and themselves.
INTRODUCTION
Confidentiality is of utmost importance when providing patient-centered health care. The confidentiality and privacy of health care records is regulated by the Health Insurance Portability and Accountability Act (HIPAA) of 1996.1 The act requires that health care providers secure and monitor the distribution of protected health information, which includes Social Security number, date of birth, and photographs.2 Athletic training clinics in secondary schools, colleges, and university settings have additional regulations regarding the health care records and protected health information of patients.3 The Family Educational Rights and Privacy Act (FERPA) protects the educational records of the student. When a health care provider, such as an athletic trainer, is employed through the school district or student health clinic rather than through the athletic department, FERPA regulations are also enforced on the medical records of the patient.3 The intersection of these 2 acts, with additional state regulations, has created competing interests regarding who is responsible and what information can be released.3
The incorporation of technology and health care informatics in the scope of medical services throughout the United States has warranted additional regulations for the electronic transmission of protected health information. In 2009, the Health Information Technology for Economic and Clinical Health (HITECH) Act was passed as an amendment to HIPAA to encourage the adoption of electronic health records in clinics while improving the privacy and security of the electronic protected health information of patients through digital and technological communication.4,5 Despite the regulations and sanctions placed on health care professionals and other covered entities, the government has provided resources and funding opportunities to enhance patient privacy while limiting the burden placed on the clinic.
As electronic communication and record keeping has become a required method, statutes governing the protection of this information have adapted. In 2013, covered entities were required to comply with the HITECH Act standards.4 This act specifically addresses concerns for breaches of patient care on optical discs, internal and external hard drives, DVDs, USB drives, smartphones, and all storage networks including electronic platforms.6 Some of the requirements within this act were included to promote the adoption and use of health information technology. With the addition of this act, there was an emphasis placed on creating safeguards for electronic methods of communication for these records.4 The HITECH Act is essential for the continuation of quality health care service and protection.7 The transition to electronic health records is required for health care professionals and clinics; thus, athletic training students should be immersed within electronic medical record keeping to develop a complete understanding of the HITECH Act for compliance with federal regulations.4 Despite the required compliance and incentives from the federal government to comply with HITECH and transition to electronic health records, athletic training as a profession has been slow to transition and adopt the changes.8 The lack of adoption of contemporary medical documentation, such as electronic health records, may have an impact on the current knowledge of the HITECH Act and its relationship to everyday practice as a clinician, a preceptor, and an athletic training student during clinical education experiences.9 Additionally, Blumenthal10 states that “the next generation of clinicians, weaned on the Internet, Twitter, Facebook, the iPad, and the iPhone, will insist that the United States find its way to an interoperable, private, secure, and modern electronic health information system.”(p2431) This means that future athletic training students will continue to advocate for the confidentiality of the patient, yet from a new angle that is defined by technology.
As technology platforms have increased in the digital age, we have seen an exponential increase in the availability and use of social media. Social media have countless applications in which one may seek to share one's life, thoughts, and social interactions with friends, colleagues, and the public. Although the personal communication on social media increases connectivity of the world, it may introduce risks and dangers to users that are not apparent in traditional interpersonal communication. As of January 2016, there were 2.3 billion active social media users.11 This accounts for 1 in 3 of the world's population using social media, a rise of 10% from 2015.11 In addition, Internet users typically have an average of 5.56 active personal social media sites.12 Along with the rise of social media use comes the ambiguous territory of sharing work information through these venues. There is a concern in the health care community that professionals may not understand ethical and legal social media postings regarding work-related photographs and incidents. What can begin as a simple post sharing a unique injury or asking for help with a problem related to an injury or illness can turn into potential litigation if the health care professional is in violation of privacy acts.
Young professionals need education and guidance regarding how to navigate the intersections of these constructs. It cannot be assumed that students within these generations will be able to post and share information within the regulations of these acts without proper instruction and explanation. The purpose of our study was to explore athletic training students' use of social media and their understanding of patient privacy regulations in social media. Currently, there is a lack of research to understand the knowledge of ethical and legal behaviors of social media in professional athletic training students, as well as the knowledge of regulations that are in place for protected health information. This study aims to identify areas where professional athletic training students demonstrate competence, while also identifying gaps within their preparatory socialization to the profession.
METHODS
Research Design
We used a cross-sectional study design, collecting data through a Web-based survey (Qualtrics, Inc, Provo, UT). After electronically signing the informed consent, participants entered the survey, which included demographic information about participants, their social media profiles and use, and the professional athletic training program in which they were enrolled. The participants engaged in a 12-item knowledge assessment including 6 knowledge retrieval items on governing regulations (HIPAA and HITECH), 2 items focused on potential breaches when using technology, and 4 knowledge use items with specific examples of potential HIPAA violations in sample social media posts. This study was approved by the Indiana State University Institutional Review Board.
Delphi Panel
To design the instrument for this research, we surveyed a panel of experts in several disciplines by means of the Delphi technique. The Delphi technique is a method of structuring the collective judgments of a group of experts, conducted through a series of sequential questionnaires, each containing summarized information from earlier responses.13 A total of 8 content experts (3 certified athletic trainers, 2 health care compliance solution experts, and 3 lawyers with a specialty interest in risk management and health care) served on the panel. We used 3 rounds of questionnaires to gather the opinions of experts and ultimately reach consensus. Each questionnaire was generated from the results of the previous questionnaire. The initial questionnaire asked the expert panel to list items that they perceived as potential HIPAA breaches in social media. The second round was generated from the results of the first and asked the expert panel to comment on the entire survey for length, accuracy, and omissions. The third questionnaire allowed the expert panel to check accuracy of the content and answer choices. The Delphi technique concluded with a consensus confirmation report that asked the expert panel to agree with the final form of the instrument.
Pilot Study
After content consensus from the Delphi panel, the research team used a pilot study. This method was used to increase success for the final research study. For the pilot study, the professional athletic training students (n = 51) at the university of the research team were used as a convenience sample. The convenience sample respondents (age = 21 ± 1 years; 30 female, 21 male) took the survey and knowledge assessment. These data were not used for the final analysis, and all students at the university were excluded from participation in the final research study. The outcomes of the pilot study determined feasibility and content analysis for the variables of the knowledge assessment.
Procedure
After approval from the institutional review board, recruitment e-mails were sent to all professional (bachelor's and master's) athletic training program directors listed on the Commission on Accreditation of Athletic Training Education Web site (n = 365). All returned e-mails were sent to the department chair and/or clinical education coordinator at the institution. Additionally, we used e-mail recruitment from the National Athletic Trainers' Association database to 5000 noncertified student members.
Participants
A total of 775 individuals began the instrument for the study. After filtering out responses who denoted that they were professional program directors and/or certified athletic trainers, 673 responses were eligible for inclusion. The research team also filtered the data to remove any responses missing demographic information. As a result, responses from 652 athletic training students (age = 21.96 ± 8.47 years) were used for statistical analysis. Some of the respondents did not answer all of the questions, creating partial data, which were used for analyses. Specifically, 543 of the 652 respondents (83.2%) completed the knowledge assessment in its entirety, creating a separate number of respondents for this section of the instrument.
Statistical Analysis
Data were collected and entered into custom spreadsheet software (Excel 2013; Microsoft Corp, Redmond, WA). Data were coded for the knowledge assessment. Correct answers were given a score of 1 and incorrect or omitted answers were given a score of −1, thus allowing negative scoring for this section. All data were analyzed using commercially available statistical analysis software (SPSS Statistics for Windows, version 23.0; IBM Inc, Armonk, NY). The α level was set at .05 a priori.
RESULTS
Athletic training students were predominately female (n = 456 of 647, 70.5%) and self-reported attending clinical experiences in their professional program approximately 16.91 ± 27.45 hours per week. In addition, the respondents were typically from bachelor's programs (n = 567 of 631, 89.8%) and stated they had received previous education (n = 587 of 637, 92.2%) regarding HIPAA regulations. When examining the athletic training students' use of social media in their personal and professional lives, the respondents had a total average of 6.81 ± 2.75 active social media accounts. Participant demographics are presented in Table 1.
A large majority of respondents (69.8%, n = 455 of 652) reported having 6 or more active social media accounts. Facebook (93.4%, n = 609 of 652), Snapchat (85.3%, n = 556 of 652), and Instagram (80.4%, n = 524 of 652) were among the most common accounts. Table 2 further explains all active social media accounts of athletic training student respondents. Most respondents self-reported that they did not have any full-face photographs of themselves providing care to patients (93.4%, n = 527 of 564). Despite this finding, 37 respondents (6.6%) did state they had at least one photograph of themselves providing patient care on an active social media site. In terms of reporting practices, only 1.6% (n = 10 of 630) of respondents stated that they had previously reported a possible HIPAA violation, and 0.2% (n = 1 of 628) of respondents stated they had been reported for a HIPAA violation (Table 3). Participants reported varying acknowledgement of a social media policy at their professional athletic training program, with 24.2% (n = 154 of 636) stating their program had a social media policy that was strictly enforced, whereas contrastingly 32.2% (n = 205 of 636) of respondents stated they were unsure if their program had a social media policy.
A small proportion (n = 87 of 629, 13.8%) of respondents stated that they were concerned that someone associated with the professional athletic training program at their institution had unethically shared patient health information from a clinical site (Table 3). Additionally, athletic training student respondents predominantly stated they were unsure (61.8%, n = 389 of 629) if their clinical site had established a virtual privacy network as a safeguard for medical documentation and patient confidentiality.
Five hundred forty-three athletic training student respondents completed the full knowledge assessment. The final knowledge assessment score could range from −7 (lowest score) to 13 (highest score). Respondents averaged a score of 4.92 ± 1.7 (37.8%) on the knowledge assessment. The majority of students accurately identified the HIPAA violations in sample Facebook (question 9, 58.7%) and Instagram (question 12, 73.2%) posts, yet incorrectly identified the HIPAA violations in sample Twitter (question 10, 35.4%) and Snapchat (question 11, 45.3%) posts. Respondents identified that a potential HIPAA violation can occur if an unencrypted laptop with protected health information is stolen (question 7, 66.0%). Table 4 references the frequencies of correct answers from the 12 items on the knowledge assessment. When examining the total knowledge scores of athletic training student respondents, a significant difference (t541 = 2.653, P = .008; 95% confidence interval = 0.188, 1.257; Cohen d = 0.388) was identified if the respondent had previous education on HIPAA. Respondents with previous HIPAA education scored 4.98 ± 1.69 on the knowledge assessment, whereas respondents without previous education on HIPAA scored 4.26 ± 2.0.
DISCUSSION
Social Media
Social media behaviors have been discussed in medicine for the last several years, with the clear intention to promote e-professionalism within the medical and health care community.14 E-professionalism is “the attitudes and behaviors that reflect traditional professionalism paradigms but are manifested through digital media.”15(p166) It appears in previous literature that students lack good judgment about what should, or should not, be posted online.14,16,17 Moreover, some students do not understand how these actions might influence employment and possible termination in the future.18 There have been several news stories regarding the exposure and dismissal of health care professionals for posting improper information and pictures online, including full-face photographs of a patient having a chest tube inserted, a nurse terminated after an insensitive social media post that easily identified the patient, and posting of protected health information in a medical record.19
Although individuals with previous education on HIPAA scored significantly higher, these respondents still scored below 40%, indicating that training in regards to HIPAA, specifically as it relates to social media, either is not specifically occurring or is failing. Training should focus on placing the responsibility on the employee/student about the issues and risks associated with using social media. This includes development of a professional persona within social networking sites.20 In addition to HIPAA compliance, there are also a myriad of other legal implications for posting personal health information online or engaging in patient education using social media platforms. Potential conflicts of interest arise when the health care provider seeks social media friendships with the patient.21
Professionalism
Students have differing views of e-professionalism, including what should and should not be posted online.15,22 Among the components of social media is the idea of self-presentation, where individuals control how others might perceive them. In the context of professional preparation in athletic training, this might include things like “treating the star athlete” or “seeing the coolest injury” portrayed in social media to influence how classmates see one another, a sense of accomplishment from family members, or increasing public awareness of their profession. However, posting material of this nature can and likely does include violation(s) of patient health information and the principles of legal and ethical practice. In addition to pictures, text posts on blogs and social media platforms and comments on pictures may be perceived as unethical and potentially lead to a breach of HIPAA.23,24 Previous research25 has noted the impact of deidentifying the patient in the posts to limit the breach of confidentiality, yet students should be aware of the ethical implications of writing about a patient in a negative context even after the patient has been deidentified.
Our findings suggest that the concern in the medical community of health care providers and students not understanding ethical and legal social media postings persists within athletic training preparation, whereby students are engaged in behaviors that violate HIPAA, as well as not knowing what is or is not a violation of these acts. Student respondents scored below 40% on a knowledge assessment, demonstrating a lack of understanding of the content and an inability to identify potential HIPAA violations on a variety of social media platforms. When asked about their posting behaviors, most respondents indicated that they were HIPAA compliant, yet a small group also indicated they posted pictures of themselves providing care to patients. There is a clear disconnect within our respondent population surrounding best practices for protecting patient health information in an online and electronic environment. A similar issue exists within medical education students who partake in medical mission trips. Previous research26,27 identified that medical students have a high use of social media sites and stated that they believed themselves to understand the regulations in place for social media posting. Unfortunately, medical students who participated in medical mission trips posted full-face photographs of themselves providing patient care to minors without consent or assent.26,27 Athletic training is not exempt from the same issue of full-face photographs, in which clinicians and students may take and post pictures of patients receiving treatment or medical consultation in athletic training clinics and at special events such as marathon races and display them on social media sites. Although the patient may provide consent, it is important to remember that minors, who typically are under 18 years of age (dependent upon state law), cannot provide consent for a photograph to be posted.28 Such a photograph, then, would require the patient to assent to the photograph to be posted and consent from the parent/legal guardian for posting on social media platforms. Although this may seem like a tedious undertaking to post a photograph or write about a patient's case, implications from violations of HIPAA include fines of up to $25 000 per occurence.2 In addition, the ethical reputation of the health care provider is called into question.29,30 Although we understand that athletic trainers and athletic training students may have patient encounters in plain sight (eg, football games), it is important for both parties to be cognizant of the ramifications of conducting physical exams in a public forum. It is certainly possible that someone who is not a covered entity (a parent or fan) could take a photo, but the athletic trainer should not retweet or perpetuate distribution of the material.
Legal Issues in Personal Health Information
For an athletic trainer, the hiring practice of the employing company has implications about the medical records obtained from patients and whether they are protected under FERPA, HIPAA, or a combination of both. Covered entities and business associates are both held liable under the HITECH Act.4 Thus, it is important to teach professional athletic training students to understand the hiring process and to inquire with human resource management to ensure compliance under either act. In addition, the sharing of protected health information is protected only among covered entities.4
Media and journalists are not subject to HIPAA. In litigation regarding breach of confidentiality involving National Football League (NFL) player Jason Pierre-Paul's 2015 hand injury, a sports broadcaster tweeted a picture of Pierre-Paul's medical records without his consent.31 Related to the event, but in a separate case, 2 health care professionals were fired after the individuals “inappropriately accessed the patient's health record.”31 This is of concern in athletic training, as other athletic trainers or athletic training students who do not have a direct responsibility for the care of the patient should not access patient medical records. Recent advances in the HITECH Act have limited the breach of confidentiality by creating safeguards to ensure electronic health records are accessed by appropriate individuals.4
In addition to the access of medical records, HIPAA breaches can occur when safeguards are not taken to prevent the spread of electronic protected health information, such as in the case of a stolen laptop. On the knowledge assessment, 66% of athletic training student respondents correctly answered the item regarding a potential HIPAA violation occurring because of a stolen laptop that contains medical records. A similar mechanism of technology portability concerns addressed in the knowledge assessment item has recently occurred in 2 separate occasions with the Cancer Care company and the athletic trainer for the Washington Redskins.32,33 Although the athletic trainer's laptop was password protected, it lacked encryption.32 In addition, the athletic trainer was traveling with paper records and a flash drive that was not protected, both of which are potential violations of the HIPAA and HITECH acts.32 The devices that were stolen from a locked car contained the medical records for participants from the NFL combined from 2004 through 2016.32 The NFL contacted the Office of Civil Rights on behalf of the participants whose medical records might have been stolen and accessed.32 In the Cancer Care case, the company did not secure electronic protected health information after a laptop and unencrypted flash drive were stolen from an employee's car.33 This case resulted in a $750 000 settlement for the approximately 55 000 current and former patients that were impacted.33 The Office of Civil Rights also discovered that Cancer Care did not have a policy in place for the transportation of electronic protected health information in and out of facilities on technology and media devices.33 It is imperative that professional athletic training programs properly educate and prepare athletic training students for proper use of technology, including flash drives and laptops, for transitioning to practice as a health care professional.
Risk Mitigation
Policy development is another way to curb poor social media behaviors.34 Previous literature35 stated that “posting of unprofessional content and breaches of patient confidentiality, especially by students, are not uncommon and have prompted calls for social media guidelines.”(p777) In our study, we identified that only 24% of programs had a social media policy that was strictly enforced, whereas over 30% of participants indicated they were really unsure whether a policy existed or not. In 2010, medical schools were studied and only about 10% of programs had a publicly available handbook that included a social media policy.36 Given the drastic rise in social media among college students, with 99% of students using Facebook,37 it would seem likely that more programs, regardless of discipline, would be creating and enforcing policy that promotes e-professionalism. It is possible that students in these programs may not recall having a policy on social media behaviors, but not knowing what the policy is or the repercussions for their actions would influence their decision making about what they might post.
The addition of a policy regarding social media also creates a chain of command on how to handle situations if they arise. A recent case study38 stated that a senior nursing student inappropriately shared a case from her clinical experience. The authors38 stated that “educators have an inherent obligation to ensure nursing students are educated in their ethical and legal responsibilities to protect and maintain the privacy of individuals within their care. Nursing students participate in a variety of clinical learning experiences as part of the educational process and provide medical or health services qualifying them as a covered entity subject to compliance to the Privacy Rule.”(p45) In this case study, the student was temporarily removed from the program, wrote a letter of apology to the clinical agency in which she was completing her clinical education, and presented a seminar on HIPAA requirements to newly admitted students.38
Preparing the Future Athletic Trainer
Professional athletic training programs are now enrolling students from Generation Z (born between 1995 and 2010).39 As educators transition from teaching students of Generation Y (the “Millennials”40 born between 1980 and 1994) to Generation Z, it is necessary that communication styles and preferences be better understood. As a whole, Generation Z is socially perceptive and looks at the Internet as a means of authority.39 The Generation Z learner is empowered to have a voice through platforms like Twitter and Facebook.39 These social media platforms connect students globally, at their convenience, and allows them to be self-sufficient in finding the answers to their questions. The increased voice in social media can lead to areas of confusion in separation of their personal and professional lives. While these students seek out social media platforms for daily life, they also continue to share this with the public, including strangers. Social media profiles reveal several characteristics of an individual, including the individual's name, age, location, and likeness. While social media bring countless possibilities to change and impact life, they also bring the inherent risk of misrepresentation.20 The literature39 has identified that we as a society believe that Generation Z are digital natives and cautions the generalizability of this to future students. In order to prepare the future athletic training student for ethical and legal practice in this field, as professionals, athletic training educators need to prepare the student for the professional use of social media, including, but not limited to, the knowledge of potential HIPAA violations on these platforms. As educators, we should seek to recognize that the omission of this information from the educational preparation of athletic training students is inherently dangerous given the needs of Generation Z learners. Future athletic training students and health care professionals as a whole will have an expectation for proficiency and competence in patient privacy compliance in avenues such as social media and electronic transmission.
Specifically, in athletic training we would recommend training beyond the basics of HIPAA to better explore the implications of a social media presence as a health care provider.17 We believe that creating policy and enforcement are necessary, but also that future athletic trainers should be trained to develop their own policy. Because of our role in providing health care to minors, it will also be important to stress the importance of acquiring child assent and parental consent if engaging patients in social media posts. All of these components can be explored in a traditional health care administration course, but in general, we should have more focus on engaging in health care policy that mitigates risk for ourselves, as providers, and our patients.
Limitations and Future Considerations
A limitation of this study is that we are unaware of the response rates from the e-mail recruitment and professional athletic training program director recruitment. In addition, the findings of this study are novel regarding the lack of knowledge regarding regulations in social media. Based on these results, future research should seek to focus on the effectiveness of HIPAA educational interventions in both didactic and clinical education. Additionally, the continued competence after professional preparation of athletic trainers regarding HIPAA should be researched.
CONCLUSION
Participants from different professional athletic training programs using various active social media accounts, and with previous education regarding HIPAA, scored poorly on the knowledge assessment regarding ethical communication in health care as it pertains to social media and potential HIPAA breaches using technology. These findings suggest that athletic training should seek out instructional strategies and adapt professional and preprofessional curricula to correspond with the current culture of technology and social media use while considering the characteristics of the Generation Z student. The changes in instructional strategies and curriculum design should highlight the purpose of patient privacy, protection of medical records, and risk mitigation of liability and negligence of the athletic training student, the preceptor, and the athletic training program to ensure ethical and legal practice.
Contributor Notes
Mr Winkelmann is currently a PhD student in the Department of Applied Medicine and Rehabilitation at Indiana State University.