Website Governance

Purpose

To uphold the highest standards of security, compliance, and professional excellence, Mount Sinai Health System prohibits the creation and maintenance of independent websites (also known as "microsites" or "off-the-ranch" sites) unless explicit permission from the Digital Marketing and Branding teams has been granted.

Scope

This policy applies to any clinical-based website, URL, or other digital platform (including social media pages, per the Mount Sinai Health System Social Media and Digital Communications policy) containing the name, logo, data, intellectual property or contact information of Mount Sinai Health System, or any of its affiliates, or representing one’s affiliation with or professional work as a Mount Sinai Health System faculty member, physician, student, trainee, resident, volunteer, fellow, contractor, or employee. This policy does not apply to personal websites or blogs about nonprofessional topics (such as hobbies, recreational activities, or personal interests) that do not reference Mount Sinai Health System, use institutional branding, or represent professional affiliation with the institution.

Considerations

Conflict of Interest Considerations

Creating and maintaining independent websites may represent a conflict of commitment. This commonly happens through revenue-generating website content that creates competing interests with Mount Sinai Health System (e.g., ads, sponsorships, affiliate marketing, paid content, and consulting services). Independent websites may also compromise research integrity through the premature or selective disclosure of findings, and/or the promotion of noninstitutional treatments that contradict Mount Sinai’s standards of care.

Protected Health Information (PHI) and Personally Identifiable Information (PII) Considerations

Independent websites often lack the necessary safeguards for Protected Health Information (PHI) and Personally Identifiable Information (PII) and other IT security controls, making them vulnerable to data breaches and cyberattacks.
Health Insurance Portability and Accountability Act (HIPAA) compliance requires specific security protocols and monitoring systems that are available through Mount Sinai's digital infrastructure.
Independent sites may inadvertently expose patient information through inadequate security measures.
Data breaches involving PHI/PII can result in severe penalties, with fines up to $50,000 per violation.

Legal, Regulatory, Reputation, and Brand Considerations

Independent websites may violate Mount Sinai’s marketing guidelines, standards, and trademark usage, and may cause confusion among patients, researchers, and the general public about the Mount Sinai brand.
Individuals may unknowingly use trademarked or copyrighted material from third parties without appropriate licenses, exposing Mount Sinai and the individual to legal liability.
Mount Sinai is committed to ensuring that its websites are accessible to all users, per the Web Content Accessibility Guidelines (WCAG) 2.1 level AA. Independent websites may not adhere to Mount Sinai’s accessibility requirements.
Independent sites risk misalignment with institutional policies and digital best practices, placing Mount Sinai Health System’s reputation at risk.

Procedure for Clarification and Approval Requests

Individuals or departments seeking clarification on this policy should contact the Office of Industry Engagement and Conflicts of Interest at Conflicts.of.Interest@mssm.edu

To request approval to create or maintain an independent website or digital platform, contact the Digital Marketing team at webfeedback@mountsinai.org Requests should include the purpose of the site, intended audience, sponsoring department, proposed content, and designated owner. The Digital Marketing and Branding teams will review requests for alignment with institutional branding, digital strategy, governance, compliance, and user experience standards. Written approval must be obtained before any covered website or digital platform is created or launched.