1

Three aspects of Social Media Use for Public Sector Employees

Linda Hamel

General Counsel

ITD

Presentation to Western Regional Homeland Security Advisory Council

Thursday, September 21, 2012

2

Introduction

• General Counsel, ITD

• The contents of this presentation are the opinion of the presenter and do not represent the opinion of the Patrick Administration

• ITD is the Commonwealth’s central provider of information technology services to the executive department—Mass.gov, MAGNet network, MassMail central email, social media assistance, capital funding for large IT projects, colocation and hosting, MITC and Springfield Data Centers

3

What is social media?

• Blogs

• Social networks (Facebook)

• Microblogs (Twitter)

• Flikr

• Youtube

• RSS feeds

• Wikis (Wikipedia)

• Podcasts

• Discussion forums….

4

Three Aspects of Social Media Use

• On the job for the job

• On the job for personal purposes

• Outside of work

5

Legal Highlights

• A few cases highlighting status of social media use by employees under the law

6

A digression: two policies every employer should have

• Acceptable Use policy with “no privacy” clause– See mass.gov/itd; search for “acceptable use”

• Social media participation policy; see ITD social media legal toolkit

7

General Rules

• Follow your employer’s acceptable use and social media participation policies when using employers information technology resources (ITRs) to engage in social media

• Employer’s ITR’s include – Employer’s network– Employer’s email system– Employer issued devices—

Blackberry, cellphone, smartphone, laptop, etc.

– Employer’s social media site or identity

8

Using Social Media to Perform Your Job

• Take responsibility for what you publish– Remember the durability of the publications on the

internet

• When you speak on behalf of your employer– Identify yourself and your role– Write in the first person– Make clear when you are speaking for yourself and

when for your employer– Only speak on behalf of your employer when your

statements are based on:• Law• Written standards, policies, longstanding

practices• Explicit permission

9

…To Perform your Job

• If you work for government, respect Users’ First Amendment Rights– Can moderate blogs for obscene,

threatening, discriminatory, harassing, or off topic speech

– Must include these limits in terms of service for blogs

– Cannot refuse to post or delete most other types of speech, including speech with which your employer disagrees, , or insulting, angry, or oppositional speech. Post all comments other than those excluded for the reasons above, and then

10

….To Perform Your Job

• Respect Copyright Law– Never post whole articles,

publications, videos or songs without first receiving written permission from the owner. Never quote more than a short excerpt, and if possible provide a link to the original

– Fair use exemption DOES permit you to copy in your social media parts of works for certain purposes, including • quotation of excerpts in a review or

criticism for purposes of illustration or comment;

• quotation of short passages in a scholarly or technical work, for illustration or clarification of the author’s observations;

©

11

…. To Perform your Job

• Protect Confidential Information– Don’t post legally protected personal information that you

have obtained at work on a blog– Don’t report conversations without permission– Don’t post information about policies or plans that have

not been finalized by your employer– If you have to exchange personal information using social

media during an emergency, remove identifying information (ex: patient’s name)

12

…To Perform Your Job

• Consider your content– Social media is an official

government communication tool and will be sought out by mainstream media

• Don’t feed the rumor mill. Don’t admit or deny rumors; just say “no comment”.

• Handle negative comments by: – Providing accurate information in

the spirit of helpfulness– Respectfully disagreeing– Acknowledging that it is possible

to hold different points of view on some topics

13

…To Perform Your Job

• Provide links– If you reference a law, regulation

or policy, please provide a link to it!

• Respect your audience and coworkers– No “group” slurs, personal

insults, obscenity, or conduct unacceptable in your workplace

– The Commonwealth’s residents include a diverse set of customs, values and points of view.

– Stay away from politics, religion, ethnic origin, and gender issues

– Don’t air your differences with fellow employees via social media

14

…To Perform Your Job

• You will make mistakes; when you do– Own up to it and correct it quickly

but– Don’t alter previous posts without

indicating that you have done so– Don’t remove the incorrect

information; strike through it. – Link the correction to the incorrect

information, and vice versa

• Don’t pick fights

• When someone else makes misrepresentations about your agency correct them, but do so politely and stick to the facts

15

…To Perform Your Job

• Use your employer’s social media site or identity only to contribute to their mission. What you publish should– Help you and your co-workers

perform your jobs better– Inform citizens about

emergencies and government services and how to access them

– Make the operations of your agency transparent and accessible to the public

– Create a forum for receipt of candid comments from residents about how government can be improved

– Encourage civic engagement

16

…To Perform Your Job

• Use your best judgment– If it doesn’t feel right, don’t

publish it

• Don’t forget your day job– Social media is addictive.

Even if its part of your job, don’t ignore the other parts

– Seek guidance from your supervisor about the correct balance

• Media inquiries: find out now who to take media inquiries to

17

. . . To Perform your Job

• If you are subject to HIPAA– HIPAA protects “protected health information”, “individually identifiable health

information”– Seek legal counsel for full definition of PHI and to determine if you are covered

• Typically, agencies participating in emergency medical services as community responders, first responders, or transport responders, are subject to HIPAA

– Do not share PHI using social media – Advice from Department of Homeland Security First Responder Communities of

Practice Virtual Social Media Working Group: • Train social media users about what PHI is and that they can’t store or transmit it

over social media• Post messages on social media profiles alerting users as to what information is

covered by HIPAA and that they are not to share it over social media • Include HIPAA restrictions in terms of conduct for social media platforms• Monitor social media profiles for release of HIPAA protected information • Seek legal counsel on the question of whether you are subject to HIPAA

18

On the Job, for Personal Purposes

• Make sure this is allowed by your employer

• Make sure your personal use is not attributable to your employer

• Establish a separate identity from your work identity

• Conform with relevant portion of your workplace policies and relevant laws and regulations (harassment and discrimination, confidentiality, ethics, code of conduct, copyright law, etc.)

• If allowed, can’t be excessive

• If using your employers ITRs, follow acceptable use policy

19

Outside of Work, for Personal Purposes

• Make sure it’s not attributable to your employer or your function at your job, even indirectly.– You are an EMT and your name is Zachary

Nightingale. You post a video on YouTube ridiculing elderly people and their medical needs, and list it as “by Zachary Nightingale”. Your name is unusual enough that viewers in your local area might easily associate it with you and your job.

• Some employer policies may apply to your personal use outside of work, if such use relates to your ability or perceived ability or willingness to do your job– Example: you are a fireman in a regional fire

fighting force in Northwestern Mass. and blog that you do not like people from North Adams and your regional response team should not help them during a fire

– Example: you are the affirmative action officer on your police force. You use your own name to identify yourself on Twitter. You send multiple tweets containing ethnic and racial slurs to your followers.

20

Legal Highlights

• Difficult area of law, and different rules depending on whether your employer is public or private sector, what your job is, and other circumstances

• Passwords to private accounts– Protected from employer unless– You transmit them over and store them in

employer mail system and access to your private account is part of a reasonably conducted search of workplace misconduct

• Protected speech– All employees: union activity or other speech

protected by the National Labor Relations Act (e.g. complaints about wages, hours, and working conditions)

– Public Sector Employees: First Amendment protects

• Political speech or matter of public concern• Spoken outside employee job duties when • Free speech rights weighed against government

need to provide efficient and effective services = balance goes to free speech

21

Sample Cases

• O’Connor v. Ortega, 480 U.S 709 (1987)

• Karl Knauz Motors, Inc. and Robert Becker, Case No. 13-CAA-46452 (NLRB)

• Pietrylo v. Hillstone Restaurant Group d/b/a Houston's (U.S.D.C. D. N.J. 2008)

• Costco Wholesale Corporation and United Food and Commercial Workers Union, Local 371, NLRB Case 34–CA–012421

• City of Ontario, California, et al. v. Quon et al. (2010)

• Marshall v. Mayor and Alderman of the City of Savannah (U.S.D.C. S.D Georgia 2010)

22

HIPAA and Social Media

• Ask your counsel

• Are you a covered entity?

• Privacy–Deidentify data