Policy Number: 11-027

Social Media

Category: Human Resources

Responsible Executive: Vice President for Human Resources

Responsible Office: Human Resources


1. Policy Statement

The purpose of this policy is to provide guidance for employees choosing to use social media to communicate, collaborate, and interact with students, faculty, staff, stakeholders, and the general public on matters concerning or impacting the University of Florida (UF). 

2. Applicability

This policy applies to all UF faculty, staff, and students who are employed by UF in any capacity. The guidelines also apply to other people (such as volunteers and appointees) who use internally managed university computing resources.This policy applies to all forms of social media, including, for example, Facebook, Twitter, Instagram, Snapchat, YouTube, LinkedIn, blogs, online comments, etc.This policy may apply to employees outside of work hours and while using personal accounts when use of social media affects an individual’s professional responsibilities, violates an applicable law, or constitutes a violation of UF regulation or policy. 

3. Definitions

Protected health information (PHI) is a term defined within the Health Insurance Portability and Accountability Act (HIPAA). HIPAA compliance is required of covered entities, including health care providers. PHI is any information in a medical record that can be used to identify an individual, and that was created, used, or disclosed in the course of providing a health care service, such as a diagnosis or treatment. PHI includes photographs and videos of the patient, even if the patient asked for the photo/video to be made or consented to it being made. It is best to return such photos to the patient, as long as no other patients are in the photos.

Personally Identifiable Information (PII), under FERPA, is any information, directory and nondirectory, that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. This may include the student’s name, names of parents or family members, the address of the student or student’s family; a personal identifier such as the student’s social security, UFID number, or biometric record, information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates, a list of personal characteristics, or any other information that clearly distinguishes the student’s identity. 

4. Policy Specifics

The University of Florida is committed to the highest standards of freedom of speech and expression. UF recognizes the vital role that social media can play in both expressing free speech and also in communicating, collaborating, and interacting with students, faculty, staff, non-UF colleagues, and the general public. UF encourages its employees to use social media as a means to connect with the UF community and foster thoughtful engagement and dialogue about the issues important to and impacting UF and its communities. This policy intends to protect the appropriate use of social media, while prohibiting conduct through social media that may be unlawful, contrary to UF regulations or policies, or violative of professional standards, when applicable.
This policy also provides suggestions for situations involving social media that could be damaging to the University or its constituents. 

4.1 – General Use

During working hours, UF employees may not spend more than minimal work time on personal activities, including the use of social media. Use during breaks and meal period is permitted. In some circumstances, a vice president, or designee, may authorize use of personal social media sites and accounts that further university interests. 

4.2 – Acceptable Use

UF equipment and resources, including in relation to social media activities, may only be used in accordance to the University’s Acceptable Use of Computing Resources Policy

4.3 – Activities Violating the Law or Policy

UF employees may not use social media in ways that violate federal, state, local and, when applicable, foreign laws. For example, social media communications depicting child pornography violate criminal laws and UF regulations. Social media communications constituting threats of violence or known or intended to cause severe emotional distress may violate the law and UF regulations. Social media communications containing false statements that could harm a person’s reputation are possibly defamatory and may result in civil liability. UF employees may not use social media in ways that violate UF regulations, policies, or procedures. For example, social media communications may not be used as a way to violate UF’s regulation prohibiting discrimination on protected class or violate UF’s policy prohibiting sexual harassment. Uses of social media in ways that constitute criminal or civil actions or in ways that violate UF regulations, policies, or procedures may be reviewed on a case-by-case basis. Substantiated violations of policy or law could result in disciplinary action, up to and including dismissal from the University. 

4.4 – Maintaining the Confidentiality of Student and Applicant Records

Federal laws, including the Family Educational Rights and Privacy Act (FERPA), Florida law, and University of Florida regulations governing the confidentiality of student and applicant records (and information from such records) apply to social media use. Personally identifiable information (PII) from student, alumni, or applicant records. PII includes, but is not limited to, academic records, disciplinary records, correspondence through e-mail or other means, or, with limited exceptions, any other records individually identifying students at the university or applicants to the university) should never be released via social media without approval of the Chief Privacy Officer. Before approved, written consent of all students and applicants involved approving disclosure to the broad public using social media for a particular purpose must be signed and dated. A general overview of FERPA is available on the UF Registrar’s FERPA website

4.5 – Safeguarding Patient Privacy and Patient Information

Use of social media, even in a personal capacity, must comply with state and federal law concerning patient privacy, including, but not limited to, compliance with the Health Insurance Portability and Accountability Act (HIPAA). Covered entities subject to HIPAA may not improperly share or disclose, including via social media, protected health information (PHI), unless that patient (or patient’s parent/guardian) has provided advanced written authorization of the release of such information. Patient information may not be posted on social media, even if it has been “de-identified.” Keep in mind the following:

  • It often is possible to identify patients even if their names or other obvious identifying information are not included.
  • Details, such as names, places of work/study, and the date/time stamp can make it easy to identify patients described, particularly to the patients themselves and their families and friends.
  • If patients contact those affiliated with UF via social media, simply responding to a patient, with no medical advice, is acceptable. Providing medical advice or information through social media is not permitted, even if the patient requests it.

Patients treated outside the U.S., for example, as part of a medical, research, or other international humanitarian mission, also have a right to privacy. In addition to U.S. and Florida requirements, foreign jurisdictions often have their own privacy laws that apply.  Patients’ identities and medical information, as well as photos, videos, and audio recordings featuring them, should be treated with the same respect shown to those of a patient receiving care in the United States. Be sure to identify and comply with U.S., Florida, and any other applicable privacy laws, keeping in mind the following:

  • Disclosing information about a patient treated in another country could be a violation of that country’s privacy laws, as well as U.S. and Florida laws and UF and Shands policies.
  • Before information, pictures/videos, or recordings featuring patients from outside the U.S. is created, posted, or transmitted, the University’s Chief Privacy Officer should be contacted for approval at privacy@ufl.edu.  Collecting certain data on individuals may also be subject to U.S., University of Florida, and foreign requirements on human subjects research.

A general overview of HIPAA privacy requirements, as well as HIPAA authorization forms, are available on the UF Privacy Office website

4.6 – Improper Disclosure Research and Intellectual Property

Releasing unpublished research data or unprotected intellectual property may impair its protection. In keeping with the University’s Intellectual Property Policy, unpublished research data or unprotected intellectual property may not be released through social media in a manner that impairs patent protection, violates any condition of an applicable research contract or grant, or violates any applicable law. 

4.7 – Other Forms of Restricted Data

Revealing other forms of legally restricted records, data, or information via social media is strictly prohibited. Records protected include but are not limited to:  Social Security numbers, financial information, employee or student medical information, limited access employee records pursuant to Section 1012.61, Florida Statutes, trade secrets, copyrighted materials, materials covered by export control laws and regulations, and other materials the university is required to maintain as confidential or has agreed to do so. While those affiliated with UF may disclose information about themselves, they should exercise caution in doing so for their own protection. Once disclosed through social media, the information may be accessed indefinitely and in many contexts (e.g., actual and potential employers, professional licensure authorities, elections, current and future family members) that may not have been contemplated at the time. 

4.8 – Misrepresentation

Those affiliated with UF may not portray themselves as acting or speaking on behalf of the university or any part of the university, such as the Health Science Center, Institute of Food and Agricultural Sciences (IFAS), a college, department, or any other unit, or present a social media account as an official university account, unless authorized to do so by the vice president, or designee, with jurisdiction over the applicable unit. Even when acting in one’s university capacity, UF faculty, staff, students, volunteers, etc. may not represent their own positions and opinions on social media as those of the university.  When using social media in a personal capacity, reasonable precautions must be taken to indicate that the activity is being conducted as a private person and not as an employee, agent, or spokesperson of the university. Precautions include using heightened privacy settings, not identifying oneself as a UF employee, and adding a disclaimer clarifying the views expressed are that of the individual. 

4.9 – Professional Standards

Those employed or in a course of study in a field that is subject to professional or ethical standards (e.g., licensed physicians, nurses, pharmacists, mid-level providers, dentists, registered dietitians, attorneys, accountants, etc.) must comply with those standards in their university capacity.  Such standards also apply to one’s personal capacity if the standards generally apply at all times or if one’s personal conduct would affect or reflect on his or her university role. Text, photos, videos, and other material posted on social media pages, including personal ones, should be in keeping with generally accepted professional and/or ethical standards for one’s field(s) of work and/or study. Depictions of behavior that do not comply with professional and/or ethical standards may result in disciplinary action, up to and including dismissal from the University. 

4.10 – UF Social Media Account Authorization

Authorization to present a social media account as an official university activity must come from the vice president with jurisdiction over one’s unit as well as the vice president for University Relations or his/her designee. Information about the approval process, as well additional resources and guidelines, is available on the University Relations Social Media Registration website

5. Review and Adjudication

The following is the department, office, or individual is responsible for overseeing implementation of and assuring compliance with this policy. Any individual with questions about the policy:
UFHR – Employee Relations
903 W. University Avenue
P.O. Box 115000
Gainesville, FL 32611
(352) 392-1072
EmployeeRelations@hr.ufl.edu (to expedite a response, please include the phrase Social Media in the subject line of any email inquiries or reports) 

6. Policy Violations

Failure to comply with this policy could result in disciplinary action, up to and including termination.
For possible sanctions for HIPAA violations, visit the “Recommended Sanctions” links on UF’s Health Information Privacy page.

Additional Resources

UF Reg. 4.007 Confidentiality of Student Records and Applicant Records
Acceptable Use of Computing Resources Policy
UF Privacy Office
UF Intellectual Property Policy
Student Code of Conduct
Florida Statute 1006.52
20 U.S.C. 1232g, Family educational and privacy rights
34 C.F.R. Part 99, Family educational and privacy rights

History

History: Revised 9-1-2018, Revised 11-3-2022