People-managing the "social media generation"

Media item: article

Date published: 16 August 2023

Subject: workplace management

This page records the media item. The original article is the property of its publisher and is not reproduced here.

The version of this that matters to patients

Management advice about younger staff is generic. What is not generic is what happens when a workplace full of phones is also a place holding your health information.

Every person in a dental practice — registered or not — is bound by obligations about your information, and the ones that bite hardest are the newest. The practice's own statement is the Privacy Policy.

Confidentiality applies to everyone in the building

Registered practitioners are bound by the Dental Board's code of conduct and by privacy law — see Dentists & Registered Specialists and Our Team.

Everyone else — dental assistants, receptionists, practice managers, treatment coordinators, cleaners, IT contractors — is bound by the practice's obligations under privacy law, and by their employment contract. Which roles are registered and which are not is set out in Dental hygienist vs dentist and What is the difference between a dental therapist and a dental hygienist?

Being unregistered does not mean being unaccountable for confidentiality. A practice is responsible for the conduct of its staff, and a breach by an unregistered employee is still a breach.

What that means concretely:

Nobody may look at your record without a reason to. Browsing the file of a neighbour, an ex-partner, a celebrity or a colleague is a breach even if nothing is disclosed. Access itself is the breach.
Nobody may discuss you outside the practice, including in an anonymised anecdote that could identify you in a small community.
Nobody may photograph you, your mouth, or your records without specific consent for that specific purpose.

Photographs, video and social media

This is where the generational framing actually has content.

Clinical photographs, intraoral scans and radiographs are health information, regardless of whether a face appears in them — see How safe are dental X-rays? and Technology. So are appointment lists visible on a screen in the background of a staff photo.

The requirements:

Consent must be specific to the use. Consent to treatment is not consent to publication. Consent for a clinical record is not consent for Instagram. What consent to treatment does cover is set out at Understanding Your Treatment.
It must be informed, freely given, documented and revocable. "Freely given" is difficult to guarantee when the person asking is the practitioner about to treat you, which is why a good practice asks afterwards, in writing, with no pressure.
A patient can withdraw consent later, and the practice should be able to act on it.
Staff photographs in clinical areas routinely capture screens, files, whiteboards and other patients. That is the most common accidental breach in health workplaces, and it is entirely preventable by policy.
Under the National Law, a practitioner is responsible for content on pages they control, including comments — and testimonials about clinical care are prohibited in advertising, so patient comments praising treatment are a compliance problem, not a marketing win. This is covered in more detail at Meet Dr Amelia Judson: Dentist & Influencer, and the limits on published images at the Before & After Gallery.

Data security, which is now the bigger risk

Health is consistently among the most-breached sectors in the notifiable data breach reporting published by the Office of the Australian Information Commissioner (OAIC), and the major Australian health data breaches of recent years have made the consequences concrete.

Why health data is targeted: it cannot be reissued. A card number is replaced in a week. Your medical history, identity documents and Medicare number are permanent, which makes them valuable for identity fraud and, in the worst cases, extortion.

What the law requires of practices:

The Notifiable Data Breaches scheme obliges an organisation to assess a suspected breach and, where it is likely to result in serious harm, notify the affected individuals and the OAIC.
The Privacy Act's Australian Privacy Principles require reasonable steps to protect personal information, and health information is sensitive information with stronger protections.
The Victorian Health Records Act applies in addition, in this state.

What a well-run practice actually does: individual logins rather than a shared password, multi-factor authentication, access limited to what each role needs, audit logs, encrypted backups tested by restoring them, a written breach response plan, secure disposal of paper and old hardware, and vetting of the third-party software and IT providers that hold or touch the data. The same unglamorous operational discipline applies to sterilisation and radiation records — see Interview with Dr Kia Pajouhesh at the 2014 Telstra Business Awards.

What you can reasonably ask: how your information is stored, who can see it, whether it is held or backed up offshore, and what the practice would do if it were breached. Ask through Contact Us.

Your rights over your own information

You have a right of access to your health record, including radiographs. A reasonable fee may apply for copies. This matters most when you move practices or seek a second opinion.
You have a right to correction of inaccurate information.
You can complain — to the practice first, then to the Health Complaints Commissioner (Victoria) or the OAIC, depending on the nature of the complaint.
My Health Record operates on an opt-out basis; you control your own settings, including which documents are uploaded and who can see them. Check them if you have never looked.

And the management point, briefly

The generational framing in articles like this is usually overstated. The obligations described above are not new, and they are not generational. What has changed is that every employee now carries a publishing platform in their pocket, so the gap between a lapse of judgement and a permanent public disclosure has collapsed from days to seconds.

The practices that handle this well do it with clear written policy, induction that covers it properly, and a culture where raising a near-miss is safe — not by treating a generation as a problem. The archive's other workforce items are Staff motivation and confidence, Stopping staff separation and The great resignation in the health sector; the practice's own entry points are Graduate Program and Dental Internship.

Common questions

Am I allowed to post a review of my dentist online?

Yes. AHPRA's testimonial guidance states plainly that the prohibition "does not affect ... patients sharing information, expressing their views online or posting reviews on review platforms". Section 133 of the National Law binds the advertiser, not the patient, and it bites only when a review is used to advertise a regulated health service. A practice is responsible for a review appearing somewhere it controls — its own website, or its own social media page with the reviews function switched on. AHPRA is equally clear that advertisers "do not have to remove or try to remove a review on a website or in social media over which they do not have control".

Which of my comments would a practice have to take down?

Only the ones touching a clinical aspect. AHPRA's test asks whether the comment expresses a symptom — the reason for seeking treatment — a diagnosis or treatment received, or an outcome, including the practitioner's skills or experience "either directly or via comparison". Those are testimonials and cannot be used in advertising. Comments "about customer service or communication style that do not include a reference to clinical aspects are not considered testimonials", so a note about the reception staff, the parking or how clearly something was explained is not caught at all.

Why does a practice turn its reviews off instead of replying to mine?

Because replying can itself be the breach. AHPRA accepts that not every platform allows editing or removal, but says whoever controls the page "is still responsible for ensuring compliance with the prohibition on testimonials", and that this "may be achieved by disabling the reviews/testimonials functions". It also warns advertisers to "take care if they choose to engage with reviews on third-party websites as this may be considered using a testimonial to advertise a regulated health service". Silence under a clinical review is usually compliance rather than indifference.

Can a practice publish only the flattering part of a review?

No. AHPRA treats selective editing as potentially false, misleading or deceptive, and gives the examples: editing a negative review so it reads as positive, and trimming a mixed review so that only the positive comments survive, which "falsely implies that the reviewer only had positive feedback". Selectively including or excluding whole reviews has the same defect. The guidance is to publish only complete and unedited reviews that are not testimonials — which in practice means a curated wall of praise is a warning sign rather than a recommendation.

What should I ask before agreeing to a photograph being published?

Ask where it will appear, whether it is advertising, what else is in frame, and how to withdraw consent later. For a before-and-after pair, AHPRA's guidance is that images are less likely to mislead when they are "as similar as possible in content, camera angle, background, framing and exposure", with consistent posture, clothing, make-up, lighting and contrast, any alteration explained, and the treatment the only visible change. Note what it does not require: there is no rule obliging a before-and-after image to carry a "results vary" disclaimer, and a practice that offers one in place of matched photography has answered the wrong question.

Practical details

Smile Solutions, Level 1, 220 Collins Street, Manchester Unity Building, Melbourne VIC 3000. Phone 13 13 96, or theteam@smilesolutions.com.au. Monday–Friday 8.00am–6.00pm, Saturday 8.30am–1.30pm, Sunday by appointment. See also Our Location.

Every practitioner's registration can be verified free on the AHPRA public register at ahpra.gov.au.

This page records a published article and its date, with general information about privacy and data obligations in Australian health practice. Privacy law is administered by the OAIC and, in Victoria, the Health Complaints Commissioner, and it changes; confirm current requirements with them. This is not legal advice, a diagnosis or a treatment plan. Third-party published content is not reproduced.

Smile Solutions trades under ABN 28 193 514 103.