Which statement about HIPAA and social media is CORRECT?

Correct answer: B. A patient may post publicly about their own care and name their dentist, because HIPAA restricts the covered entity, not the patient

• A. Cropping the face does not de-identify an image. Intraoral photographs, radiographs, distinctive restorations and dental anomalies can all identify an individual, and photographic images are explicitly listed among the eighteen HIPAA identifiers. Written authorization is required.
• B. CORRECT. HIPAA binds COVERED ENTITIES and their business associates. A PATIENT is free to disclose their own health information however they wish, including praising or criticising their dentist by name on a public platform. HIPAA imposes no obligation of secrecy on the patient.
• C. Absence of a name is not sufficient. Protected health information includes any information that could reasonably identify the patient, and identification is often possible from the image, the date, or contextual details.
• D. This is the most frequently penalised error in practice. A patient's public review does NOT waive their privacy rights, and a dentist who confirms the patient was even treated at the practice — let alone discusses the treatment — has made an unauthorised disclosure. Respond generically or invite the person to contact the office privately.

Note: The practical rule for social media: written, specific, signed authorization before any patient image or detail is posted; never confirm or deny that a named individual is a patient; never discuss care in a public forum; and remember that a signed authorization can be revoked.