Lisa Taylor (lisa.taylor@uchealth.com) is Vice President & Chief Compliance Officer, and Daniel S. Elmlinger (daniel.elmlinger@uchealth.com) is Compliance Operations Analyst at UC Health in Cincinnati, OH.
Privacy programs need to take the pulse on what is going on in their organizations, but some programs may struggle to keep up with their organizations’ initiatives. Put simply, there is a limited number of people in privacy programs (sometimes only one person or a fraction of a full-time equivalent) but a multitude of information and ideas being exchanged across the organization. Sometimes privacy may get pulled into an idea or issue too late, or sometimes not until after a decision has been made, and then weeks, months, or maybe even years of work and procedures must be undone in order to safeguard patients’ privacy. Every privacy professional dreads this moment, but every privacy professional can likely remember at least one incident like this. Short of approval to hire as many members onto your team as you would like, the next best solution is to proactively partner with teams in your organization. This partnership will help encourage a culture of compliance in your organization, one team at a time. One of the best teams to work with in your organization is the marketing & communications team.
This article will provide tips and suggestions to leverage your organization’s marketing and communications (marketing) department to help develop a more proactive privacy program. This leverage comes from:
-
More efficient social media monitoring for possible HIPAA issues;
-
Risk-specific training and development with your workforce;
-
Better communication about your privacy program and what it does;
-
Compliance with the Breach Notification Rule in case the worst happens at your organization; and most importantly,
-
Stronger safeguards for some of your organization’s high-profile patients.
First things first
Before implementing these tips and suggestions, privacy programs should examine the relationships they have with their marketing teams.
Privacy leaders:
-
Do you know your organization’s marketing leader(s)?
-
Do you meet with your marketing leader(s) regularly?
-
What is the context in which you meet with your marketing leader(s)?
-
What do you discuss with your marketing leader(s)?
Privacy operations staff:
-
Do you have contacts on the marketing team to help you with day-to-day issues?
-
Does the social media team within marketing know what to do if they see a HIPAA issue online?
-
Does the social media team know what they can say on social media when a person identifies themself as a patient on a public page?
-
Do the copywriters, photographers, and videographers know when they need to ask you to review content before publication?
If the answer to any of the above questions is “No,” or anything indicating a potential for a stronger relationship between your two teams, start working on the relationship.
Leader-to-leader relationship development
As the privacy leader for your organization, you should evaluate if you have an effective relationship with your marketing leader(s). If you do not have one, then establish one. Initiate the relationship by asking for some brief one-on-one time, and frame it as seeking to better understand what their team does, what your team does, and how the two of you can work together for the betterment of the organization. This can be a cup-of-coffee discussion, lunch, or a formal meeting—whatever you and marketing prefer. Once you have level-set with the leader, agree on recurring meetings between the two of you to check in and see if there is anything privacy can help marketing with, or vice versa.
Marketing often has a pulse on the rest of the organization and upcoming strategic initiatives, which, when appropriate, can be shared with privacy. Conversely, privacy can offer personalized training to marketing, such as when an activity is or is not considered marketing under HIPAA, when an authorization is needed, or whom to contact on the team for a specific issue. This relationship between leaders will facilitate the staff-to-staff relationship development discussed next.
