The Subpoena and the Instagram Post
Dr. C, a Nebraska-licensed OD in Kearney, posts a color fundus photo on a public professional Instagram account. The caption reads: 'Rare choroidal nevus in a 29-year-old - great catch today!' No name or face appears, but the patient's coworkers recognize the rare diagnosis and the date, and the patient files a complaint with the Board. The record includes a note that Dr. C discussed the nevus with the patient and scheduled a 3-month follow-up. The Board investigator sends Dr. C a subpoena for the complete patient record and a notice to appear. Dr. C refuses to produce the record, telling the investigator: 'HIPAA forbids me from releasing anything without the patient's signed authorization, and the Board has no business regulating my personal social media.'
1. Must Dr. C produce the record to the Board? Does HIPAA prohibit the disclosure?
Read the worked answer
Dr. C must comply with the Board's subpoena unless she obtains a protective order or the Board withdraws it. The Board has statutory authority to investigate complaints and inspect records relevant to a licensee's practice. HIPAA permits disclosures to health oversight agencies for licensing and disciplinary activities, and it permits disclosures in response to legal process such as a subpoena. Patient authorization is not required for a Board investigation. Dr. C can raise objections, request confidentiality protections, or ask that the production be limited, but she cannot simply ignore the subpoena. Refusing to cooperate can itself support discipline. A 'personal social media' argument does not defeat the Board's authority when the post uses a patient's clinical image and arises from the optometric encounter.
2. Is the Instagram post a confidentiality or unprofessional-conduct issue even though no name appears?
Read the worked answer
Yes. Confidentiality protects identifiable health information, not only names. A rare diagnosis, the date of the encounter, the clinical image, and the phrase 'today' can make the patient identifiable to coworkers and others in a small community. Dr. C disclosed a patient image and clinical detail for a public audience without written authorization. The fact that she used a professional account, or that she did not name the patient, does not make the post safe. The Board can treat this as unprofessional conduct and a breach of patient confidentiality. It can also consider whether the post was misleading or sensationalized. Dr. C's clinical follow-up note does not cure the disclosure. The Board may discipline even without proof of financial harm or physical harm to the patient.
3. What should Dr. C have done before posting, and what should she do now?
Read the worked answer
Before posting, she needed either a valid written HIPAA authorization from the patient or true de-identification that removed the image, date, rare diagnosis, and any detail that could identify the patient. In a small community, that may be impossible for a rare condition. She should have used a general teaching image with consent or no patient image at all. Now she should preserve the original post and record, cooperate with the investigation, and avoid deleting or altering anything once a complaint is pending. She should provide the subpoenaed record, obtain counsel if needed, and respond to the notice to appear. She may also offer corrective education or a remedial plan. Deletion after notice can look like obstruction and worsen the disciplinary outcome.