!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.1//EN” “http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd”>
Legal Considerations for Digital Internet Marketing
By the ADA Legal Division
• Comprehend the basics of the federal and state laws concerning advertising
• Recognize privacy concerns related to social media
• Appreciate legal and legal-related concerns when responding to negative reviews
• Observe the legal and ethical issues related to social couponing.
• Understand basic copyright issues related to social media
What are the legal considerations with respect to digital Internet marketing? The short answer is almost exactly the same considerations that you would have with respect to marketing your practice using any other medium — plus a few extras.
Federal Rules and Regulations16
Advertising Claims Generally
Under the Federal Trade Commission Act (FTC Act) and its supporting regulations (and often parallel state laws), advertising in digital media must be truthful, non-deceptive and fair, and advertisers must have evidence to back up their claims. Advertising is deceptive if it is likely to mislead consumers in a “material” way — that is, in a way that would be expected to influence a consumer’s decision. Ads may be considered deceptive by virtue of what they affirmatively say. But they can also be deceptive if they do not include something material or if they contain true statements that, taken together and in context, imply something that is not true or supported. For example, an ad may truthfully claim a product “whitens teeth,” but if an accompanying set of before-and-after photos shows dramatic differences beyond what the average consumer could reasonably expect, then the ad may be considered deceptive.
Advertisers must be able to support any claims they make with appropriate evidence. If, for example, an advertiser claims that “60 percent of dentists surveyed recommend this treatment,” then the advertiser must possess a valid survey showing this to be the case; likewise a claim that the advertiser offers “the lowest prices in town” must also be supported. This requirement does not apply to mere “puffery.” Subjective claims, silly claims, obvious hype and other claims that no reasonable person would believe typically are not considered deceptive, and need not be supported by evidence. Some popular advertising claims have generated their own detailed regulations designed to avoid consumer confusion and set standards for the type of supporting evidence required. These common claims include price reduction claims, claims involving comparisons to competitors’ prices and savings based upon the purchase of other merchandise, claims involving “free” offers, and claims regarding warranties and guarantees.
The principle that consumers should have the information they need to evaluate a claim applies to all forms of advertising, including digital and social media. How that information is communicated may vary depending upon the medium. Often, a link to an Internet address from which more information may be obtained will likely be sufficient. As always, advertisers should consult a qualified attorney to assist them in understanding what requirements may apply in their individual circumstances.
Endorsements and Testimonials
Endorsements and testimonials (opinions and experience concerning products or services) can be considered commercial speech and regulated under the FTC Act. As such, an endorsement or testimonial must represent the endorser’s actual opinion and experience with the product or service being endorsed. In addition, unless it is obvious, the endorser must clearly disclose any material connection with the advertiser. The key objective of the law is truthfulness — the FTC seeks to ensure that a viewer or reader understands the endorser’s relationship to the advertiser so that proper weight to the opinions being offered can be given.
The FTC has issued Guides Concerning the Use of Endorsements and Testimonials in Advertising to assist in explaining proper usage of endorsements and testimonials in advertising. The Guides focus on the type of endorser — expert, organizational and consumer — and provides criteria for evaluating each. Under the FTC statement “[a]dvertisers are subject to liability for false or unsubstantiated statements made through endorsements, or for failing to disclose material connections between themselves and their endorsers.” The FTC Guides can be found at www.ftc.gov/policy/federal-register-notices/guides-concerning-use-endorsements-and-testimonials-advertising-16.
One common way these rules affect dentists results from patients using consumer review websites in choosing a new dentist. Planting fake positive reviews to increase one’s positive standing on such sites may constitute a violation of the laws governing endorsements and testimonials.
Advertisers must be able to support any claims they make with appropriate evidence. If, for example, an advertiser claims that “60 percent of dentists surveyed recommend this treatment,” then the advertiser must possess a valid survey showing this to be the case.
State regulations and any applicable administrative rules are an essential resource for dentists who are making digital Internet marketing decisions.
Illinois17, for example, provides this rather extensive list of information that can be marketed:
• Office hours
• Schools attended
• Announcements about opening, changing or returning to practice
• Additions to or deletions from professional dental staff
• Dentist hospital affiliations
• Specialty licenses held, board certifications, professional society memberships, limitations or concentrations of practice
• Credit arrangements or acceptance of Medicare/Medicaid patients
• Foreign language ability
• Fees for routine professional services (with a statement that fees may be adjusted due to complications or unforeseen circumstances unless the fees do not vary under any circumstances)
• Description of offices in which dentist practices, e.g., accessibility to the handicapped, laboratory facilities on the premises and convenience of parking
The state dental practice acts should be reviewed for specific advertising prohibitions. The most common regulation is the prohibition against false, deceptive, or unsubstantiated representations in advertising. This is the touchstone for any and all advertising. Most states have particular regulations for announcing dental specialties and fees or discounts in connection with dental services. Some states prohibit licensed dentists from advertising that the dentist can perform a particular procedure without the patient experiencing any pain.18 Many states prohibit licensed dentists from claiming that the dentist provides superior dental services without adequate substantiation for the claim.19 In some states, it is unlawful for a licensed dentist to claim that a procedure is curative or preventative.20
Dentists who violate these advertising and marketing prohibitions run the risk of suspension, revocation, or limitation of their license to practice within the state, or injunction, fine, and censure and reprimand. Accordingly, dentists must be knowledgeable about their state’s advertising requirements and ensure that their practice marketing conforms to applicable state law.
Dentists must be knowledgeable about their state’s advertising requirements and ensure that their practice marketing conforms to applicable state law.
Stories about possible violations of patient privacy through social media have recently appeared in the news. For example, news media have recently reported that:
• A hospital took away a doctor’s privileges for an online post that included information that could be used to identify a patient.21
• A hospital identified an incident involving employees who allegedly used social media to discuss patients.22
• An emergency room worker posted a photo of her workstation, which included a computer screen displaying information about a patient. The patient subsequently notified law enforcement that she was the victim of identity theft.23
Whether a dental practice posts a message or photo on the practice’s social media site, or a member of the dental team makes a personal post, privacy laws may be violated if the post identifies a patient, or could be used to identify a patient, and the patient has not authorized the disclosure.
Successfully managing the risks through appropriate policies, procedures and training can help dental practices benefit from social media while protecting patient privacy in compliance with applicable federal and state laws. A dental practice’s policies and procedures prohibiting improper disclosures of patient information should clearly apply in any context, whether inside or outside of the dental practice, and whether the disclosure is electronic, on paper, or oral.
The Security Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires covered dental practices to have reasonable safeguards in place to protect electronic patient information. The HIPAA Privacy Rule requires a covered dental practice to obtain patient authorization before disclosing identifiable patient information unless the disclosure is permitted by HIPAA, such as a disclosure for treatment, payment, or health care operations. If patient information is disclosed in violation of HIPAA, the dental practice may be required to provide breach notification to the patient(s), the federal government, and, in some cases, the media. HIPAA violations can also result in substantial monetary penalties, and some HIPAA violations carry criminal penalties.
HIPAA-covered dental practices must also comply with applicable state law that is more stringent than HIPAA. Dental practices that are not covered by HIPAA must comply with applicable state law. State laws protecting patient information may include medical confidentiality laws, data security laws, and laws requiring breach notification when sensitive personally identifiable information is improperly disclosed. Violations of state privacy laws can result in fines, and some state laws give individuals the right to take legal action.
Therefore, before posting on social media, a dental practice should carefully review content to determine whether the content complies with applicable law. For example, a covered dental practice that wishes to post patient before-and-after photos on a social media site may be required to obtain HIPAA-compliant written authorization from the patients if the photos could be used to identify the patients. Under HIPAA, full face photos and comparable images are considered identifiers.
Even if a patient has voluntarily made his or her health information public, HIPAA and certain state privacy laws still apply to the information. For example, if a patient discusses his or her health information with the news media, or in a social media post or online rating service, a covered dental practice must continue to protect the information in compliance with HIPAA and applicable state laws.
This is not to say that a dental practice can never respond to a patient’s social media post, only that the dental practice must do so in compliance with applicable laws, and that such laws may prohibit disclosures that identify the patient. For example, in response to a patient’s post stating that her questions were not answered to her satisfaction, a dental practice may be able to respond with a general statement that does not identify the patient, such as, “We encourage patients who have questions about their care to call our office right away so we can provide any follow up information they require.” If a patient posts a complaint about wait time, a dental practice may be able to respond, “Occasionally a dental emergency requires us to alter our schedule, and we apologize to patients who are affected when this happens.”
To help prevent privacy law violations on social media:
• Understand and comply with applicable federal and state privacy and data security laws
• Train staff never to disclose identifiable patient information or sensitive personal information via social media without proper patient authorization.
• Keep in mind that patient information that is protected by privacy laws can extend beyond traditional patient records. Photo or videos of a patient, even just sitting in the waiting area, may be protected patient information. Merely revealing that an individual is a patient may violate privacy laws.
• HIPAA protects information that identifies a patient, or that could be used to identify a patient. Even if a patient’s name is not disclosed, if other data elements are disclosed that make the information identifiable then the data can still be protected by HIPAA.
• Even if a patient has publicly disclosed his or her health information, HIPAA still applies to that information. A covered dental practice must protect patient information even if the patient has willingly made the information public.