Imagine this scenario. You’ve decided to upgrade your practice’s website—or build a new one—and you’re thinking about what to include. One option below “screams high risk” for drawing AHPRA scrutiny, says David Gardner, a lawyer and former AHPRA investigator who now runs compliance training for health professionals.

Can you pick which one it is?

A) General health information with appropriate references to medical literature
B) A forum where patients can share experiences with different treatments
C) A blog where you discuss interesting, anonymised cases from your practice
D) Health news commentary with your professional opinion on new treatments

If you chose a blog highlighting de-identified cases, you’re definitely not alone. This was the most common answer picked by 46% of respondents in a recent Healthed survey of more than 2000 GPs. But while this can have potential pitfalls—as we’ll explain below, it’s actually not the riskiest option.

Hosting a forum on your website stands out as particularly risky, Gardner explains. “It has so much scope for things to go wrong in different ways.”

Yet only 22% of over 2000 GPs in a recent Healthed survey correctly identified it as the riskiest choice.

So, why is hosting an online forum (or Facebook group) so risky?

Online, people may be less likely to think before sharing information with strangers, Gardner says. “So they might be providing very sensitive and confidential information that essentially goes out there into the world.”

As a website’s publisher, you are responsible for the information other people post—and therefore have obligations around its use and disclosure, he explains. You’ll need to consider factors like consent, privacy, confidentiality and what could happen if they are breached—if, for example, someone screenshots and shares a post.

Hosting groups on sites like Facebook or Instagram may mean you’re not the direct publisher, “but you still have measures of control over what’s published,” Gardner says. “So it’s also very risky.”

Social media groups can also raise another problem: the need to ‘friend’ patients.

“I’ve seen several times where a practitioner has been reported for friending patients and they’ve said, ‘but I only did it because we’ve got this group’,” Gardner says. “You can see the clinical rationale. But it’s something to be absolutely avoided.”

Some content may pose a clinical risk

A forum’s purpose may not be clear to patients, which can lead to clinical risks, Gardner cautions. “Is it for patients to get clinical advice? Is it to simply have a chat with other people who are also undergoing treatment?”

For example, patients might expect that a doctor or nurse is reading what’s posted and will take action if any concerning symptoms or issues are mentioned.

“But also, patients talking to other patients about treatments is not necessarily something that a health practitioner should be endorsing or publishing, because each patient’s going to have their own experience based upon their own presentation,” Gardner notes.

Potential to breach AHPRA and TGA advertising codes

Additionally, if patients can compare notes on your forum, they may talk about having a great experience with a particular drug or health practitioner – which could be seen as advertising and may breach AHPRA or TGA codes.

How risky is sharing anonymised cases online?

The highest percentage of respondents (46%) in Healthed’s survey felt a blog discussing interesting but anonymised cases would be most likely to trigger AHPRA scrutiny. And this can indeed garner unwanted attention from the regulator, Gardner says, citing a tribunal case involving a hospital doctor who sent 12 de-identified patient records to two friends.

“When Queensland Health did an investigation, they couldn’t identify any of the 12 patients. So clearly their confidentiality wasn’t breached in that way. But nonetheless, he was reprimanded for it because he was essentially sharing things he found funny.”

“So it lacked respect for patients, and it didn’t display the kind of values that are expected of doctors.”

In other words, how you’re using the information matters.

Done the right way, sharing truly de-identified information is unlikely to raise concerns, Gardner says.

“If you are doing it for an educational and positive reason, you’re showing respect for the patients involved, you’re not joking about them or otherwise showing disrespect, it’s unlikely to result in regulatory action because you’re using that information for a legitimate purpose.”

For example, describing a patient’s slightly unusual presentation with measles in an anonymised blog post is unlikely to be problematic, “provided you don’t otherwise breach your obligations in relation to respect or things like that,” Gardner explains.

Get informed consent

The easiest way to minimise risk is to ensure patients give written consent to use de-identified information for educational purposes, Gardner says, noting you can include this on your standard consent forms.

However, if you want to share something particularly sensitive, such as photographs of sensitive areas, he recommends having a conversation about that specific issue and getting separate written consent from the patient.

Advertising vs educational?

It’s also essential to ensure the content is truly educational, he emphasises.

“Advertising is a contextual thing,” he explains.

“If it’s genuinely helpful and educational and you’re just talking about new developments and it’s clearly not an advertisement, then you should be fine.”

Frame opinions with care

Almost one-quarter (23%) of respondents thought health news commentary that included their professional opinion about new treatments was the riskiest option. But the risk hinges on how you present it, Gardner says.

“If your opinion is ‘this is great and it’s going to cure cancer’, then that is going to attract a lot of scrutiny.”

“If the opinion is ‘this is an interesting new development in the treatment of multiple sclerosis and you can ask us about it and we can refer you to specialists, or something like that—if it’s appropriately caveated and carefully and thoughtfully worded—it shouldn’t be an issue.”

Again, make sure your posts meet AHPRA and TGA requirements if they could be perceived as advertising.

Details matter

It’s also important to include relevant references and details.

“You wouldn’t want to, for example, start talking about a particular new treatment method if it hasn’t actually been approved for use in Australia, if it’s just in a clinical trial—unless you’ve made clear that it was in a clinical trial,” Gardner says.

Sharing general health information with appropriate references is very low risk, he adds.

When is it OK to share positive patient reviews?

If a patient blogs about their positive experience at your practice, and sends you the link, what should you do? The safest response is to do nothing beyond acknowledging the post, Gardner says.

While one quarter of survey respondents said they would share the blog either with attribution, modified treatment details, or a disclaimer about variation in individual results, all of these would be in breach if it discusses anything clinical.

AHPRA specifically prohibits the use of testimonials in advertising—but it’s crucial to understand that they define a testimonial as any positive statement or recommendation about the clinical aspects of a regulated health service.

Positive comments about non-clinical aspects—such as communication, waiting times or customer service—are not counted as testimonials and are therefore fine to use.

Key takeaways

• You are responsible for information posted on your website
• Like hosting a forum, social media groups are also risky
• Content you share in blogs or social media that includes patient cases should be respectful and properly de-identified
• Getting consent is the easiest way to minimise risk when you are discussing anonymised cases

For more on how to AHPRA-proof your online presence, check out this article where David Gardner shares 7 common pitfalls to avoid with your social media.