HLT 308V DQ 2: social media patient privacy risk guide
HLT 308V's Topic 1 DQ 2 is a describe-then-extend prompt: report how a real risk management program already handles social media and patient privacy, then propose three further protective steps — with the emphasis on 'further', because restating current policy is only half the question.
Editorial process
Last reviewed · August 11, 2026
What distance does HLT 308V DQ 2 want between describe and propose?
The prompt has two verbs and grades the distance between them. 'Briefly describe' asks what your organization's risk management program already does about social media and patient information privacy — and the parenthetical '(or at that of a typical health care organization)' is an escape hatch for students without workplace access, not an invitation to vagueness: a 'typical' program still has nameable components, usually a social media policy, HIPAA training with annual refreshers, and disciplinary procedures for breaches. 'Provide three examples of risk management steps your organization could take to further protect patient information' is the graded half, and the word 'further' means your three steps must go beyond what you just described. Students who describe training and then propose training have written one answer twice. Give the description two or three named components and stop; its whole job is to make the gap your proposals will fill visible.
Strong further-steps are specific enough to implement and clearly social-media-shaped rather than generic privacy hygiene. The professional literature gives you a menu: adopting the NCSBN/ANA social media guidelines as enforceable policy rather than guidance; auditing public platforms for organization-identifiable posts; requiring device-level controls so patient photographs cannot originate from personal phones in clinical areas; building social media scenarios into HIPAA training rather than treating the two as separate modules; and defining an incident-response path for suspected social-media disclosures, since a deleted post is not an undisclosed one. Each of your three should name the mechanism, who runs it, and what failure it prevents. Steps built this way also survive the obvious instructor follow-up — 'who does this, and how would you know it worked?' — which vaguer proposals cannot. That specificity is not decoration; it is what makes a proposal a control.
The brief requires a minimum of one peer-reviewed reference — note that a regulatory white paper is authoritative but not peer-reviewed, so anchor the requirement with a journal source and use the regulatory guidance as supporting citations. This is a risk management course, so frame everything in its vocabulary: the risk is identifiable (disclosure of PHI through informal channels), the controls are layered (policy, training, technology, response), and the residual risk is what your three steps exist to shrink.
Likely learning objectives
Inferred from the brief — check these against your own rubric.
- 01Characterise an existing risk management program's social-media and privacy controls in named components rather than generalities.
- 02Design three implementable protective steps that demonstrably extend, not restate, the described program.
- 03Distinguish peer-reviewed evidence from regulatory guidance and use each where the prompt requires it.
- 04Frame social-media privacy exposure in risk management vocabulary: identified risk, layered controls, residual risk.
Read the full question
Review every instruction before using the planning guidance that follows.
Course-wide instructions that accompany this question
ADDITIONAL INSTRUCTIONS FOR THE CLASS Discussion Questions (DQ) Initial responses to the DQ should address all components of the questions asked, include a minimum of one scholarly source, and be at least 250 words. Successful responses are substantive (i.e., add something new to the discussion, engage others in the discussion, well-developed idea) and include at least one scholarly source. One or two sentence responses, simple statements of agreement or “good post,” and responses that are off-topic will not count as substantive. Substantive responses should be at least 150 words. I encourage you to incorporate the readings from the week (as applicable) into your responses. Weekly Participation Your initial responses to the mandatory DQ do not count toward participation and are graded separately. In addition to the DQ responses, you must post at least one reply to peers (or me) on three separate days, for a total of three replies. Participation posts do not require a scholarly source/citation (unless you cite someone else’s work). Part of your weekly participation includes viewing the weekly announcement and attesting to watching it in the comments. These announcements are made to ensure you understand everything that is due during the week. APA Format and Writing Quality Familiarize yourself with APA format and practice using it correctly. It is used for most writing assignments for your degree. Visit the Writing Center in the Student Success Center, under the Resources tab in LoudCloud for APA paper templates, citation examples, tips, etc. Points will be deducted for poor use of APA format or absence of APA format (if required). Cite all sources of information! When in doubt, cite the source. Paraphrasing also requires a citation. HLT 308V Topic 1 DQ 2 I highly recommend using the APA Publication Manual, 6th edition. Use of Direct Quotes I discourage overutilization of direct quotes in DQs and assignments at the Masters’ level and deduct points accordingly. As Masters’ level students, it is important that you be able to critically analyze and interpret information from journal articles and other resources. Simply restating someone else’s words does not demonstrate an understanding of the content or critical analysis of the content. It is best to paraphrase content and cite your source. LopesWrite Policy For assignments that need to be submitted to LopesWrite, please be sure you have received your report and Similarity Index (SI) percentage BEFORE you do a “final submit” to me. Once you have received your report, please review it. This report will show you grammatical, punctuation, and spelling errors that can easily be fixed. Take the extra few minutes to review instead of getting counted off for these mistakes. Review your similarities. Did you forget to cite something? Did you not paraphrase well enough? Is your paper made up of someone else’s thoughts more than your own? Visit the Writing Center in the Student Success Center, under the Resources tab in LoudCloud for tips on improving your paper and SI score. Late Policy The university’s policy on late assignments is 10% penalty PER DAY LATE. This also applies to late DQ replies. Please communicate with me if you anticipate having to submit an assignment late. I am happy to be flexible, with advance notice. We may be able to work out an extension based on extenuating circumstances. If you do not communicate with me before submitting an assignment late, the GCU late policy will be in effect. I do not accept assignments that are two or more weeks late unless we have worked out an extension. As per policy, no assignments are accepted after the last day of class. Any assignment submitted after midnight on the last day of class will not be accepted for grading. Communication Communication is so very important. There are multiple ways to communicate with me: Questions to Instructor Forum: This is a great place to ask course content or assignment questions. If you have a question, there is a good chance one of your peers does as well. This is a public forum for the class. Individual Forum: This is a private forum to ask me questions or send me messages. This will be checked at least once every 24 hours.
Turn the brief into deliverables
- 01A brief description of how the risk management program at your organization (or a typical one) addresses social media and patient information privacy, as stated.
- 02Three examples of risk management steps the organization could take to further protect patient information.
- 03Support from a minimum of one peer-reviewed reference, per the prompt.
How should the current-state and three steps be organised?
The program as it stands
Describe the existing risk management posture on social media and privacy — the policy, the training, the enforcement path — briefly and concretely, so the gap your steps will fill is visible.
Step one, two, three
Present each proposed step as a control: what it is, who operates it, and which disclosure pathway it closes — drawn from the professional guidance menu (enforceable social media policy, platform auditing, device controls, integrated training scenarios, incident response).
The evidence base
Attach the peer-reviewed source where it does work (evidence that breaches happen through informal channels, or that guideline adoption changes behaviour) and the regulatory guidance as the standards your steps operationalise.
Residual risk close
End by naming what remains exposed even after your three steps, which shows risk management thinking rather than a solved-problem claim.
Which privacy and social media sources satisfy the reference rule?
Recommended databases
- NCSBN
- OJIN (Online Journal of Issues in Nursing)
- HIPAA Journal
- CINAHL or PubMed for the peer-reviewed minimum
Search sequence
- 1.Read the NCSBN nurse's guide to social media for the profession's named misuse scenarios — these make the current-state description concrete.
- 2.Use the OJIN regulatory-perspective article as the peer-reviewed anchor; it covers electronic and social media guidelines from within the nursing literature.
- 3.Skim HIPAA Journal's social media guidance for the enforcement examples (settlements over social-media disclosures) that justify treating this as a live risk.
- 4.Pick your three steps only after the reading, checking each against your current-state description for genuine extension.
Reference shortlist
These are authoritative starting points, not a ready-made bibliography. A qualified reviewer must confirm that each source fits the assignment and supports the claim beside which it is cited.
Nothing here is cleared for citation until you have read it.
- 01
A Nurse's Guide to the Use of Social Media
National Council of State Boards of Nursing · 2018
The regulator's misuse scenarios and recommendations — the raw material for both the current-state description and the enforceable-policy step. Authoritative but not peer-reviewed; pair with the OJIN article for that requirement.
- 02
Guidelines for Using Electronic and Social Media: The Regulatory Perspective
OJIN: The Online Journal of Issues in Nursing · 2012
The peer-reviewed anchor the prompt's minimum-one rule needs — a journal treatment of electronic and social media guidance including the regulatory case examples.
- 03
HIPAA Social Media Guidelines
The HIPAA Journal · 2026
Current enforcement context — including settlements over social-media PHI disclosures — that turns 'this is risky' from assertion into documented exposure your steps answer.
Review before submission
Common mistakes
- Proposing steps the described program already contains — 'further' is in the prompt, and three restatements of current policy answer half the question.
- Writing generic privacy measures (encrypt data, train staff) with no social-media specificity when the prompt names social media twice.
- Citing only regulatory guidance when the prompt demands at least one peer-reviewed reference — a board white paper is authoritative but not peer-reviewed.
- Using the 'typical organization' escape hatch as licence for vagueness instead of describing a typical program's actual named components.
- Listing steps without owners or mechanisms — in a risk management course, a step that cannot be implemented or audited is not a control.
Submission checklist
- Current-state description names at least two concrete program components (policy, training cadence, disciplinary procedure).
- Exactly three further steps, each social-media-specific, each with a mechanism and owner.
- Each step demonstrably absent from the current-state description.
- At least one peer-reviewed journal reference cited, plus any regulatory guidance used.
- Post formatted and cited to the course's APA expectations.
Use this guide to plan and review your own work. Follow your institution's rules and read our academic-integrity policy.
Written by
Aaron Bishop
MA, Education
assignment interpretation and research-methods coaching across disciplines
Aaron leads the EssayCrackers editorial desk. He works on how assignment briefs are read — what a rubric is actually asking for, and where students most often answer a different question than the one set.
Reviewed by
Dr. Nathan Cole
PhD, Rhetoric & Composition
Argumentation and thesis development
Nathan teaches first-year composition and directs a university writing center. He reviews EssayCrackers guides for argumentative soundness and citation accuracy.