This guide is a reaction to what feels like daily blunders I see — both in my daily role as a Business Systems Analyst for the State of New Hampshire serving DoIT and DHHS, and in conversations with my wife Kaitlin, a Geriatric Care Manager who regularly engages with friends and family on Facebook, Instagram, and elsewhere online. The key takeaway for me has been that the average person is too carefree with when and how they share PII (Personally Identifiable Information) and PHI (Personal Health Information) across all media. My aim is to share some best practices for how to protect your own information and better respect the information of others.

What Is PII (Personally Identifiable Information)?

PII is any information that can be used to identify a specific person. This includes:

  • Name
  • Address
  • Phone number
  • Email
  • Social Security number
  • Birthdate

It's the kind of info that, if someone gets hold of it, they could figure out who you are or misuse it — for identity theft, for example. Think of it as the personal details you wouldn't want just anyone to know.

What Is PHI (Personal Health Information)?

PHI is any information about your health that can be linked to you as an individual. This includes:

  • Medical records
  • Doctor visits
  • Test results
  • Prescriptions
  • Health insurance details

It's sensitive information you'd only want your doctor or trusted people to know — and it deserves to be treated accordingly.

Why Should You Keep PII and PHI Private?

  1. Identity Theft: PII like your name, address, or Social Security number can be used by criminals to impersonate you, open fraudulent accounts, or steal your money.
  2. Financial Loss: If PII or PHI falls into the wrong hands, scammers might access your bank accounts, credit cards, or insurance.
  3. Privacy Invasion: PHI like medical records or diagnoses is deeply personal. Unauthorized sharing can lead to embarrassment, discrimination, or misuse by employers or insurers.
  4. Legal Risks: Sharing PII or PHI carelessly can violate laws like HIPAA, potentially leading to fines or legal trouble.
  5. Fraud and Scams: Hackers can use PII and PHI to create targeted scams — fake medical bills or phishing emails — tricking you into giving up more sensitive information.

Get Familiar with HIPAA and How It Protects You

A HIPAA violation is when someone breaks the rules set by the Health Insurance Portability and Accountability Act — the U.S. law that protects people's personal health information. A violation happens when someone improperly shares, accesses, or uses PHI without permission: a doctor posting a patient's details on social media, a hacker stealing health data, or an employee accessing records they shouldn't. Failing to keep PHI private and secure can lead to fines or legal trouble.

HIPAA is violated so often it can be dizzying to keep up with. Whether it's a nurse making a TikTok when they should be caring for a patient, or an office accidentally sending your information to a different patient's family, these things happen daily. Being aware of your rights is the first step to staying safe.

How Can You Be Safer on Social Media?

  1. Limit What You Share: Avoid posting your full name, address, phone number, birthdate, or health details publicly. Share only what's necessary.
  2. Adjust Privacy Settings: Set your accounts to private, control who can see your posts, and restrict access to personal data.
  3. Be Cautious with Comments: Don't share others' PII or PHI in public responses, even if asked. Just because a conversation begins online doesn't mean the response must stay there. If you have something to share that involves sensitive data, take it offline — call them, speak in person. Don't post your mother's medical details on Facebook for all to see because someone asked a question in a comment thread.
  4. Use Strong Passwords: Create unique, strong passwords and enable two-factor authentication to secure your accounts.
  5. Avoid Public Wi-Fi: Don't access social media on unsecured networks. Use a VPN if needed to encrypt your connection.
  6. Think Before Posting: Consider the long-term impact of sharing health updates or personal stories. Once it's online, it's very hard to retract.
  7. Report Violations: If you see someone improperly sharing PII or PHI, report it to the platform.
  8. Educate Others: Encourage friends and family to follow these practices to prevent accidental exposure of sensitive information.

In Conclusion

It can feel daunting to stay safe online. While there are no absolutes, being thoughtful about what you share goes a long way toward better safety for yourself and others. Keep the concept of "least privilege" in mind — share as little as necessary with as few people as possible. And when in doubt, keep anything you'd hesitate to post online, offline.