“Generally, HIPAA covered entities and business associates should not be sharing identifiable information with social media companies unless they have HIPAA authorization [from the individual] and consent under state law,” said Iliana Peters, a privacy lawyer with the firm Polsinelli.