HIPAA for Healthcare Creators: Beyond the Patient's Name

Giang Le: Welcome back to Beyond the Screen. I'm Giang Le, founder of Studio Germina. Today I sit down with Adam for a conversation about HIPAA for healthcare creators, and the part of the rule that has nothing to do with ever saying a patient's name.

Adam: Thanks for having me on again, Giang, I've been looking forward to this one. Almost every clinician I know thinks they're covered as long as they leave the name out of the story. So let's open right there. If it isn't about the name, what is HIPAA's Privacy Rule actually tracking?

Giang Le: It's tracking protected health information, which is any information about someone's health, their care, or the payment for that care, that identifies them or could reasonably be used to identify them. That last clause is where almost everyone gets surprised.

Adam: Reasonably be used to identify them. Walk me through what actually counts, because I'm guessing it's more than a name and a face.

Giang Le: Much more. HIPAA lists eighteen identifiers, and dates are one of them. The date of a visit, a surgery, a birth. Locations smaller than a state. Ages over eighty nine. Photos, voices, device serial numbers, and then a catch all for any other unique identifying characteristic. So a rare diagnosis, plus a city, plus last Tuesday, identifies someone to everyone who already knows them, even with the name stripped out.

Adam: Does it matter where you're saying it? A tweet versus a DM versus something on a live stream?

Giang Le: Not at all. The law covers information you learned as a clinician, in any form, through any channel. A story at a party, a reply to a comment, a DM, all the same rule. And one more thing people miss, even where HIPAA technically doesn't apply, your state's privacy laws, your licensing board, and your employer's policy usually land in the same place. So treat all of this as the floor, everywhere you post.

Adam: Given all that, what's actually safe? It sounds like you're one slip away from a problem every time you open your mouth.

Giang Le: It's really not that tight once you see the shape of it. General medical education is entirely safe, what a condition is, how a treatment works, what a guideline changed, no patient involved at all. Your own clinical opinions, described in general terms, are safe. And genuinely invented composite cases are safe too.

Adam: That distinction matters a lot, the invented case versus the real case with the details filed off.

Giang Le: It's the biggest gray area clinicians misjudge. If you build the hypothetical from scratch, imagine a patient in their forties who, that's fine. If you took last week's patient and swapped the name, that isn't a hypothetical, that's the same identifiable story with one identifier removed out of eighteen.

Adam: And your own health is fair game, obviously.

Giang Le: Completely, you can say anything you want about yourself. And with a real patient story, if you have written authorization, specific to that exact use, signed before you film, you can tell it. Verbal consent on camera doesn't count as an authorization.

Adam: Let's flip to the list that actually trips people up. What's the one you see most often?

Giang Le: Confirming that someone is a patient. This one catches practices constantly. A bad review comes in, and the reply says we're sorry your visit went that way. That sentence just confirmed, publicly, that this person was seen in your office. The correct reply never confirms care at all, something like, we take feedback seriously, please contact our office directly.

Adam: So the fix is almost mechanical. You never acknowledge the relationship exists.

Giang Le: Exactly, and that same logic covers the before and after photo, which is the single most common violation I see in med spa content. A face is an identifier. So is a distinctive tattoo or a scar in a small community. Without written authorization, that photo is a breach even if you never say a word.

Adam: What about something subtler, like a DM where someone sends you symptoms and asks for advice?

Giang Le: That one deserves its own answer, it's actually one of the traps, let's go there.

Adam: Fair, walk me through the DM scenario specifically.

Giang Le: A follower sends you their history in a DM and asks what you think. The second they hit send, every detail they volunteered is information you now hold about a person who may become your patient. You don't forward it, you don't screenshot it, you don't quote any of it back in your answer. You give a general answer and invite them to book.

Adam: What about live video, it seems like the format where something slips out by accident?

Giang Le: It is, because it's unscripted. My advice is boring but it works, decide before you go live that no real cases will be discussed, and say that out loud at the top of the stream. The other traps are more operational, your front desk, your medical assistant, your videographer, a hallway where a whiteboard or a name tag happens to be in frame. A practice without a written social media policy will eventually have a staff post that breaches it. And if you're employed, your contract may restrict what you can post about work beyond HIPAA entirely, so that agreement is worth reading closely.

Adam: There's a lot of operational detail packed into that, team policies, agreement language, review steps.

Giang Le: There is, we've actually written separate guides on the team policy piece, the med spa specific rules, and the employer agreement language, because each one deserves its own walkthrough. I'll put the links in the description.

Adam: So what's actually at stake if one of these goes wrong? Walk me through the real consequence, not the theoretical one.

Giang Le: A HIPAA complaint goes to the Office for Civil Rights, which can investigate and fine the covered entity. Separately, employers routinely terminate clinicians over social media breaches. Licensing boards discipline for unprofessional conduct on their own authority, independent of HIPAA. And a patient can sue under state law. Honestly, the part that follows a physician creator longest is reputational, because the breach is public by definition, it doesn't fade quietly the way an internal compliance issue would.

Adam: Given all that, is there a quick gut check someone can run before they hit publish?

Giang Le: Yes, and I'd run it every single time. Is a real patient involved, even in the background. Could the patient or their family recognize them from the details, the images, or the timing. Is every case I'm describing genuinely hypothetical and labeled as one. Is the frame clean, no screens, no charts, no name tags. Does my reply confirm someone is a patient. And would my privacy officer and my board be comfortable watching this. If any answer gives you pause, the post waits. One more thing worth flagging, if there's a sponsorship involved, that's a separate disclosure law entirely, and those details are in the blog, click over and check them out.

Adam: This is clearly a lot to hold in your head before every single post. Where does a real system actually come from?

Giang Le: That's the real point. The clinicians with the biggest, most durable audiences almost never use a real patient, because they don't need to, they teach general medicine well enough that it's not required. What they do have is a system behind them, a review step before anything publishes, a reply script for comments and reviews, a DM policy, authorization forms ready for the rare patient story, and a written policy for anyone on staff who posts.

Adam: And that system is exactly what Studio Germina builds into the work.

Giang Le: It is. You are the medical expert, we are the marketing and business experts, and keeping your publishing compliant is part of that job alongside everything else, the positioning, the deals, the pricing, making sure the hours you already spend answering questions online actually get paid for, on terms that fit your ethics and your brand. If you're a physician or healthcare creator who'd rather stay focused on the medicine than untangle authorization forms and reply scripts, book a consultation at studio germina dot com, and we'll handle the business side with you. We'll drop that link below, along with the guides we mentioned today.

Adam: That's a clean way to leave it. HIPAA isn't a reason to post less, it's a reason to build the system once instead of guessing every time you hit record. Giang, thank you for walking through all of this so plainly, it's the kind of thing every clinician online needs sitting in their back pocket. To everyone listening, thanks for spending this time with us on Beyond the Screen, we'll see you next episode.