For the second installment of our series on five key social media questions all health care employers should consider, we explore the ins and outs of monitoring an employee’s online activity.

At some point you may be faced with a situation where you have reason to believe one of your employees is violating the organization’s social media policy. Perhaps a coworker reports that an employee is posting disparaging comments about a patient, a doctor, or another coworker on Facebook or Twitter.

In order to investigate, you may want to monitor the employee’s social medial activity or other online activity. Before engaging in such monitoring, however, you need to ensure that the monitoring will not violate any state or federal privacy laws. Here are a few points to consider.

First, is the information publicly available? Can you gather the evidence you need for your investigation through public sources? If the employee has no privacy settings in place on his or her social media accounts and the posts are available to the “world” then that information is fair game. Likewise, in most cases, if a coworker voluntarily, on his or her own initiative, provides a copy of an employee’s post to management, that post is not considered private. Nor is a post read by a supervisor, where the employee previously “friended” the supervisor (a situation, however, that supervisors should attempt to avoid in the first place).

In contrast, if you have to use the employee’s password to obtain the information, or if you have to use subterfuge or coercion to gain access to the post, that’s not “fair game” and you should not engage in such activity. (In fact, in many states it is against the law to require that an employee or job applicant provide an employer with their social media login information.)

Second, what does your organization’s social media or electronic use policy say? Is the employee on notice that he or she can be monitored or does the employee have an expectation of privacy? If you are relying on a generic electronic monitoring policy, has it been updated to reflect that electronic monitoring includes monitoring of social media activity?

Third, consider what steps you can take to make sure the monitoring is reasonable and focused as narrowly as possible to get you the information you need but not extraneous – and possibly protected – information. Social media posts often contain a mixture of personal and professional information, so the more that you can filter non-relevant personal information out, the better.

Finally, consider seeking legal counsel. Employee privacy rights and monitoring laws vary a great deal from state to state (not to mention from country to country). Investing in some legal assistance on the front end may save you greater pain and liability down the road.

Have you monitoring an employee’s social media activity? What measures have you put in place to ensure the monitoring is legally compliant?