As more organizations join the social media sphere it's important that they know how to "mitigate the risks while maximizing the rewards," according to the authors of a new white paper. This is especially true in the healthcare arena, where issues such as patient privacy and HIPAA can weigh heavily on all involved.

The white paper, authored by Maddie Grant and Lindy Dreyer of SocialFish, and Leslie T. White, founder and president of Croydon Consulting, provides eight steps for building social media capacity.

1. Monitor the social Web for discussions about your brand and industry.
Jeff Livingston, MD, who practices at MacArthur OB/GYN, in Irving, Tex, is  responsible for his practice's social media sites. He uses TweetDeck, which allows him to manage all of the practice's pages in one click. Livingston says he makes sure that the content on these pages represents his practice well.

 2. Understand your objectives for using social media.
According to UNC Health Care, a not-for-profit integrated healthcare system owned by the State of North Carolina and based in Chapel Hill, their intention for using social media was "to create an open dialog with the community about UNC Health Care."

Livingston, who frequently speaks in the community on sexually transmitted disease and teen pregnancy prevention, said initially his objective in using social media was to connect with teens in a way that they were familiar with. Now he says social media has helped the practice to better connect with the community.

3. Develop a social media strategy by prioritizing those objectives and applying your learning from monitoring in step one.
According to authors of the whitepaper, a social media strategy should include staff and anyone who may be actively engaging in social media on behalf of the organization. Will Weider, CIO of Ministry Health Care and Affinity Health System of Wisconsin, is going one step further. He posted a draft of the organization's social media and employee guidance policy, to his blog. "I am hoping this is a good crowdsourcing exercise and that your comments will improve this draft," he said.

Part of Livingston's social media strategy was being prepared to talk with patients once they put themselves out there. "We want you [the patient] to interact with us online, but without an outlet to talk to us we have a hole," he said. Patient portal technology from Tampa, Fla.-based Sage filled that hole, said Livingston. It extends the doctor-patient relationship electronically, he says.

4. Assess and mitigate your risks-include your legal counsel and insurance professional in the discussion.
Lindy Dreyer, one of the authors of the report says, for healthcare organizations HIPPA and malpractice risks are "obvious red flags." Above all patient information must remain private. The University of Texas: MD Anderson Cancer Center's blog policies and guidelines, say comments that include first and last names, locations or other personal or patient information are subject to editing or rejection. Mayo Clinic advises its employees who blog to do so in the first person, especially where a connection to the clinic is apparent. They advise including a disclaimer that says that your ideas are your own and do not reflect those of your employer.

5. Make sure your insurance coverage is appropriate for your social media activities.
Your organization may need to update its insurance policy to provide coverage for your social media work.

6. Adopt the appropriate policies and guidelines.
SocialFish & Croydon Consulting offer these tips for writing your first social media policy:
Pick one audience: It may be too overwhelming to try to write a policy that covers all your different audiences. For example, you could start by writing a policy that focuses on your employees, before you do one for the public.
Refer to other organizational policies in your social media policy: For example, include your organization's code of ethics.
Forget about the tools: Focus on universal truths about online behavior, like privacy or how to attribute copyright material.
Write more do's than don'ts: Eschew establishing a zero tolerance policy; avoid using words such as must, shall, always and never. Zero tolerance is very difficult to enforce and limits your options in addressing a transgression.
Copy from folks who are making it work: Check out the Web site Found in Cache, a social media resources for healthcare professionals from Ed Bennett, a Web strategist at the University of Maryland Medical System. The site, among other things, provides a list of social media policies developed by hospitals and other healthcare related groups.

7. Set up interdepartmental workflows for social media collaboration.
Social media requires a shift in the way associations view themselves and their relationships with members, say whitepaper authors. They advise breaking out of traditional silos and organizational hierarchies and thinking about how you can add more clarity to your policy by collaborating with staff.

8. Educate your staff and volunteers.
Make sure your staff is up-to-date on:
Terms of use/user agreements
Disclaimers
Community guidelines
Privacy policy
Copyright policy
Antitrust policy, branding/trademark guidelines
Blogging guidelines/blog moderation policy
Crisis communication plan: Give employees some guidance on identifying a potential incident and how to report it to the appropriate personnel. Such a plan usually identifies the official spokesperson, media contacts and key personnel.
Business continuity plan
Employee code of conduct
*Also make sure they are educated on the consequences of violating social media policies.

Click here to read the full white paper.