A facility having a social media policy, is absolutely unnecessary as HIPAA already covers social media.
So many people think that if you don't mention the name or change the patient's name, that you are "in the clear" as far as HIPAA, not true.
Let me give you an example.
We had patient that suffered a horrible death from a very incompetent doctor who was one of those arrogant individuals that was ignoring every nurse on the floor who tried to tell him in advance, that the patient in trouble.
The next day, one of the nurses, without mentioning one detail about what happened, stated she had the night "from hell" at work...her place and unit of employment was clearly on her profile. She was assigned to the patient that died....who was her only patient, given the patient's fragile condition.
Well, she was friends with someone who was friends with the family, who saw the post on the nurse's friend's profile and KNEW that she was referring to their family member. It was reported to the hospital and the nurse was fired.
It was a HIPAA violation because the nurse had enough information on her profile so that the family member could tie her comment into the care of their family member, and they were not happy that the death of their loved one, caused her to have the night "from hell".
While HIPAA is not rocket science (and it really isn't), common sense goes a long way.