1

Social Networking: Managing the Risks and Realizing the Benefits

11th Annual Compliance & Ethics Institute

Las Vegas, NV

Jim Donaldson, M.S., MPA, CHC, CISSP, CIPP/US

Director of Compliance, Privacy and Security Officer

Baptist Health Care Corporation

850-469-7773

Remember when it was simple?

2

Remember when it was simple?

Remember when it was simple?

3

What’s on the Agenda?

• Social Networking: What is it and why does it matter?

• What are the risks and benefits of social networking in the workplace?

• Establishing policy to address compliance and ethics concerns.

The Building Blocks behind

Social Media/Networking

4

Web 2.0The term Web 2.0 is associated with web applications that facilitate interactive systemic biases, interoperability, user-centered design,[1] and developing the World Wide Web. A Web 2.0 site allows users to interact and collaborate with

each other in a social media dialogue as consumers of user-generated content in a virtual community, in contrast to

websites where users (prosumers) are limited to the active viewing of content that they created and controlled.

Examples of Web 2.0 include social networking sites, blogs, wikis, video sharing sites, hosted services, web applications,

mashups and folksonomies.

Source: http://en.wikipedia.org/wiki/Web_2.0

Social Networking vs. Social Networking Services/Media

• Social Networking: A social network is a social structure made up of a set of actors (such as individuals or organizations) and the dyadic ties between these actors.

• Social Networking Service: A social networking service is an online service, platform, or site that focuses on facilitating the building of social networks or social relations among people who, for example, share interests, activities, backgrounds, or real-life connections.

Dual Processors at 1.5GHZ

32GB Memory

64GB Flash Storage

2 cameras (front/rear)

Weight – 5 ounces

1080p HD Video Recording

Sensors: Accelerometer, digital compass, proximity, gyro, barometer

Single Core Processor at 1.7GHZ

512MB Memory

60GB Hard Drive

Weight – 6.6lbs

Battery Life – 2.5 hours

In Just7 Years

5

Why it Matters

Why it Matters

6

Technology Building Blocks:Electronic Mail – email or e-mail

• Method of exchanging digital messages and attachments over computer networks and/or the Internet.

• Currently, the most common method of business communications

• Extensive data movement capacity compared to other digital communication methods (GB/TB)

• Based on Store and Forward model. Utilizes mail servers.

• First used in days of ARPANET (1973)

• Simple Mail Transfer Protocol (SMTP) and Post Office Protocol (POP)

Text Messaging – Short Messaging Service (SMS)

• Most widely used, Original texting technology Limited to 160 characters. - Remember Pagers? First SMS text message was sent over a wireless telephone network in 1992. (Just 20 Years ago)

• Significant vulnerabilities including weak or no encryption, store and forward technology, not encrypted at rest.

• Somewhat resilient – 911, Katrina – In many cases, texts went through while cellular traffic became unavailable.

• Highly susceptible to organized intercept and disruption efforts. Recent Example: EGYPT

• Syrian Conflict – Pictures and videos of atrocities

Text Messaging – Multimedia Messaging Service (MMS)

• Expands on SMS and allows for multimedia content to and from mobile devices.

• As with SMS, MMS ties to web-based e-mail gateways and other e-mail services are common.

• Content adaption is a challenge because of differing capabilities of end user devices. This is flattening quickly and becoming less of an issue.

7

Text Messaging – BlackBerry PIN Messing Service

• Similar to SMS and MMS but proprietary to Research in Motion Devices (RIM) BlackBerrys.

• Each RIM device has an 8 digit hexadecimal number that uniquely identifies the device. This is the PIN

• Advantage – highly secure way to communicate between RIM devices. All communications are encrypted from transmission to receipt and on the device.

• Disadvantage – proprietary to RIM and as of February, 2011, not compatible with iPhones, Droids, etc.

Instant Messaging - IM

• Similar to MMS/SMS and e-mail

• Immediate real-time communications between two or more people.

• Useful for alerts and status updates

• May not use store and forward. If recipient isn’t logged into chat, message may be lost

Location Based Services - LBS

• Information or entertainment service based on geographical information, latitude, longitude, (altitude, speed)

• Most SmartPhones have GPS and other positioning capabilities – can acquire an accurate location simply from being turned on

• When connected to a social network, can be used by one person or many people

• Features in Facebook and other sites allow for automatic or manual ‘checking in’ notifications and tracking

• If not managed, friends can ‘out’ each other by checking them in. Emergency Department example.

8

Podcast

• Broad term-usually associated with non-streamed media, Audio and Video

• RSS Feeds can notify user of new content

• Allows users to pull media for local viewing/listening or save the content for future use

• Valuable training and education tool

Blog

• Blend of the words ‘web’ and ‘log’

• Website where a person or group of people maintain a regular commentary on a topic

• Visitors can leave messages and comments adding to the discussion

• Likely to have photos, video, etc. and links to other sites and information.

• Microblogging is a form of blogging differing from traditional blogging because the content is smaller in content and file size.

9

Location Based Services – LBS FaceBook - Places

Location Based Services – LBS – Google Latitude

GeoTagging

• Process of adding geographical metadata to various media such as photographs, videos, websites, SMS messages

• Similar to Location Based Services

• First used with photographs

• Can provide location evidence to an accuracy of inches.

10

GeoTagging

GeoTagged

file

Properties

(metadata)

Really Simple Syndication (RSS) Feeds

• Web feed formats used to frequently update information such as news, audio, video in a standardized format

• Documents or content is called a ‘feed’

• Allows users to subscribe to feeds and receive updates as they are pushed out

Common RSSFeed Icon

Really Simple Syndication (RSS) Feeds - JCAHO

11

Really Simple Syndication (RSS) Feeds - OIG

Social Networking/Media• It’s COMPLICATED

• It’s fun

• It’s cheap and efficient

• It’s fast

• It’s not easy to control

• It’s here to stay

• It is and will continue to shape history

• It will be heavily integrated into all industries including healthcare over time

Developing Policy

12

National Labor Relations Act

(Wagner Act)1935

NLRB Memorandums on

Social Media Cases

• Memorandum OM 11-74 (August 2011)

• Memorandum OM 12-31 (January 2012)

• Memorandum OM 12-59 (May 2012)

Protected Concerted Activity

• Protected Concerted Activity is a legal term used in labor policy to define employee protection against employer retaliation in the United States. It is a legal principle under the subject of the freedom of association.

13

National Labor Relations Act

• Sec. 7. [§ 157.] Employees shall have the right to self-organization, to form, join, or assist labor organizations, to bargain collectively through representatives of their own choosing, and to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection, and shall also have the right to refrain from any or all such activities except to the extent that such right may be affected by an agreement requiring membership in a labor organization as a condition of employment as authorized in section 8(a)(3) [section 158(a)(3) of this title].

NLRB Legality TestFor workplace rules (Social Media Policy)

• Does it explicitly restricts section 7 protected activities?

• Would employees reasonably understand the language as prohibiting Section 7 activities?

• Was it implemented in response to union activity?

• Has it been applied to restrict Section 7 rights?

Examples from NLRB Analysis

14

Examples from NLRB Analysis

Examples from NLRB Analysis

15

16

Jim Donaldson, M.S., MPA, CISSP,CIPP/US

Director of Compliance, Privacy and Security Officer

Baptist Health Care Corporation

850-469-7773