In terms of HIPAA compliance, sharing PHI on social media is only a permissible use when a Covered Entity has received a written authorization form the subject of the PHI. The authorization must state what PHI is being disclosed and why it is being disclosed, and the subject of the PHI must be made aware that because the Covered Entity has no control over what happens to PHI once it is shared on social media, it may not be possible to comply with a retraction of the authorization.