How Corporate Facebook Pages Can Raise Compliance Risks

What if someone recommends off-label uses for a drug on the Facebook page of a pharmaceutical company? Or how about if someone makes unsubstantiated claims about an investment product on the Facebook page of a financial firm. Increasingly, companies are concerned that their Facebook pages could expose them to compliance risks.

In fact, until recently, many pharmaceutical companies asked Facebook to disable the feature that allows just about anybody to post comments on their pages. Facebook obliged, and upheld an industry-wide agreement to keep public comments off pharmaceutical companies' Facebook pages. The pharmaceutical industry was the only one to get that exemption. But in August, Facebook decided to reverse that decision, opening companies to public comments and related compliance risks if they decided to keep their Facebook pages.

For pharmaceutical companies the potential regulatory risks on Facebook and other social media platforms include the possibility that consumers may exchange off-label advice for medications (use of medications for any condition other than the one cleared by the Food and Drug Administration).

Consumers could also potentially report negative reactions to medications or medical devices—known in the industry as adverse events (AE). If a consumer provided information on an adverse reaction without providing identifiable information for follow-up, companies could run afoul of the Food and Drug Administration's rule requiring AE reporting to the agency. Consequently, the loss of control over the public discourse in a third-party space introduced the possibility of an AE reporting nightmare.

After the new Facebook policy went into effect, AstraZeneca and Johnson & Johnson removed some of their pages in response to the policy change. Some companies removed all their Faceook pages, while some removed pages for specific brands.

Adding to pharma concerns about engaging in the social media space is the lack of specific guidelines from the Food and Drug Administration (FDA) on regulatory compliance on social media. However, while the industry waits for the FDA to roll out social media guidelines, for which the FDA formed a taskforce in 2009, these guidelines may not be imminent. The organization passed the projected roll-out date more than once.

Asked about when the guidelines may be published, FDA spokesperson Shelly Burgess issued a statement asserting the FDA's commitment to providing social media guidance on medical products, and wrote that “It is difficult to provide a timeframe … due to the extensive work and review process…”

Regardless of the FDA's timeline for releasing social media guidelines, many pharmaceutical companies have created guidelines for consumer comments. For example GlaxoSmithKline outlines the terms for posting on the page and provides a link for reporting adverse events. GSK spokesperson Sarah Alspach says it's important to be present and to be part of the discussion on Facebook, even as the company awaits regulatory guidance on the use of social media.

Social media experts see opportunities in social media engagement and risks for non-engagement even considering regulatory concerns. “More than possibly any other industry the pharmaceutical industry is constrained in how it communicates with its customers,” said Melissa Davies in a report on social media by Nielsen. Davies, who is healthcare strategic account director of NM Incite, a company that conducts social media market research, acknowledges that is possible pharmaceutical companies will run into AE reporting issues on social media, but, if they are engaged in and monitoring social media they “won't break the system.”

For companies in healthcare Davies said that a policy should be developed that is not platform-specific, so that it can apply across any medium or environment.

“Ignoring social media is a competitive risk. Everyone else is there. [Customers will wonder] why aren't you at the party?”

—Pete Scott,

Co-Author,

Auditing Social Media, a Governance and Risk Guide

That is exactly the strategy of Sanofi U.S., the U.S division of the global pharmaceutical company headquartered in Paris. Sanofi's policy is to pursue every mention of AE, regardless of the medium. While acknowledging that there will always be risks, Sanofi spokesperson Stacy Burch says, “We always follow this protocol.” To monitor comments on Facebook and other social media, Sanofi uses an outside vendor in addition to having internal personnel monitor interactions. “We monitor regularly and respond to communications as necessary,” said Burch.

Risks in Other Industries

The pharmaceutical industry isn't the only one with compliance concerns over comments on their Facebook pages. The financial industry is also susceptible. For example, investment advisers can be considered to be advertising their services via their Facebook profile or Twitter postings. The Financial Industry Regulatory Authority recently issued strict rules of engagement on such sites. Also, FINRA limits investment firms and their personnel from making recommendations on a product for one's services on sites like Facebook, LinkedIn, or Twitter. An investment broker's Facebook page could potentially be considered advertising.

Unlike the FDA, however, the SEC and FINRA have issued social media communication guidance. In January 2010 FINRA issued the guidelines (Regulatory Notice 10-6) designed by a taskforce created to address the issue. In August of this year, the agency issued additional guidelines (Regulatory Notice 11-39) to answer questions raised by the original guidelines. These latest guidelines allow for specified financial industry representatives to write blog posts without pre-approval, and outlines expectations for interaction on outlets like LinkedIn, Twitter, and Facebook and for archiving records and working with other technologies. In September of this year the SEC issued a request for input into revisions on the guidelines it issued previously.

AGE OF SOCIAL MEDIA

The chart below from the Pew Research Center shows the percentage of adult internet users in each age group who use social media.

Source: Pew Research Center.

In light of all the risks, why should companies in highly regulated industries bother to employ social media tools for their businesses? Many have the mindset that these outlets to reach customers are too massive to ignore. A report from August of this year by The Pew Internet and American Life Project, of the Pew Research Center, says that for the first time a majority of adults, 51 percent, that use the Internet also use social media. Fifty-Three percent of active online adults follow a brand on Facebook, says Sarah Pedersen, NM Incite's Strategic Account Director for the financial industry. That's a hefty portion of the population that companies not engaging are also not reaching by that venue.

In order to minimize the risks, social media experts advise companies to create a strategy. Companies “can't just get out there” says Pedersen. In the financial industry companies need agreement on their goals for each social media platform, including their Twitter feed, their Facebook page, she says. Also, companies need to understand what their company voice is online; the companies most successful in the social media space have specific, dedicated staff to represent the voice of the company, says Pedersen.

According to Pete Scott, co-author of Auditing Social Media, a Governance and Risk Guide, as inadvisable as it is to not have a presence on social media, it's worse to not have a strategy. Scott emphasizes to train employees on the policy. Scott points to the SEC guidance that says that if a company doesn't identify a spokesperson for a company's policy that means everyone in the company can speak for the company. He adds that it's OK to mention social media in the Human Resources policy, but it's best to have a stand-alone policy and refer to the other policies because all employees will be impacted to some degree.

Scott says companies also face risks in not having a presence and engaging the public. If companies aren't engaging, then they aren't listening. And, he says, if companies aren't listening, they will miss opportunities to respond and be proactive to conversations about their companies, and at some point, “you're gonna get dinged.” Besides, Scott says, “Ignoring social media is a competitive risk. Everyone else is there [customers will wonder] why aren't you at the party?