In 2006, facing low morale and high turnover, the Hills & Dales General Hospital in Cass City, Michigan, introduced a new code of conduct. It forbade gossip, encouraged teamwork, and included an employee pledge to "represent Hills & Dales in the community in a positive and professional manner in every opportunity."

But the code failed the Facebook test. This April, the National Labor Relations Board, or NLRB, ruled it illegal after a Hills & Dales employee was punished for defending a fired co-worker in a Facebook post that called the hospital's managers "douchebags." The NLRB found the "no gossip" tenet and its broadly worded "positive and professional" pledge-which Hills & Dales cited when disciplining that worker-violated staff members' rights to discuss work conditions without retaliation.

Social-media policy may not be an entrepreneur's primary concern, but in an age of tweeting My boss is a jerk, the NLRB is on a crusade, some attorneys say, to rewrite the rule book. Its cudgel: the nearly 80-year-old National Labor Relations Act, which lets workers discuss wages and working conditions. Generally, most companies with two or more employees must follow those guidelines. If you recently wrote a social-media policy designed to protect your business from rogue employees' tweets-or maintain staff morale by keeping workers' gripes private-you may have already broken the law.

A 2013 study from accounting firm Grant Thornton found that only about a third of all companies had social-media policies. "We dove into social media in 2010," says Mark Scovera, president of the Tallahassee, Florida, economic development firm Access Florida Finance. He made Facebook and Twitter its main marketing vehicles before it had any social-media policy: "We were flying by the seat of our pants." One concern, he later realized, was whether his social-media expert could bring Access Florida's Facebook and Twitter followers to a new job.

Also this April, the NLRB had Valero Services, one of the world's largest oil refineries, rescind its social-media policy. Other companies cited range from General Motors to Bettie Page Clothing, which sells apparel inspired by the bygone pinup star. Some workers fired for social-media misbehavior were reinstated and compensated for lost wages-a disruption to a company's workplace and finances that would make any entrepreneur wince.

If a policy "says employees cannot talk about the boss or working conditions, you probably are going to run afoul of the NLRB," warns Mark Sullivan, a principal at Grant Thornton. Meanwhile, more than 25 states have passed or drafted legislation making it illegal for an employer to ask employees or job applicants for social-media logins, and a federal law is in the works.

Not all employee speech on social networks is safeguarded. Gregory King, an NLRB spokesman, says comments "are generally not protected if they are not made in relation to concerted group activity among employees." One oft-cited case involves an Illinois bartender fired-rightly, the NLRB ruled-for posting on Facebook that he hoped his "redneck" customers choked on glass.

Scovera ultimately tweaked his policy to ensure his social-media followers are company property. Seems sound, attorneys say. But it hasn't been tested in court. And these days, who knows? 

Regulatory Creep

The National Labor Relations Board and other institutions have quietly made several key rulings defining how employers may discipline employees for social-media activity.

June 2009: Rain City Contractors

In this case, regarded as the NLRB's first move to protect workers' social-media rights, a construction contractor reinstated workers fired for griping in a YouTube clip about unsafe work conditions.

February 2011: American Medical Response

The first NLRB case involving a Facebook firing. An employee was canned in 2009 for calling her supervisor a "dick" and "scumbag" on Facebook after he denied her request for union representation; AMR settled.

April 2012: The First Statewide Law.

Maryland passed the first state law protecting employees' social-media passwords from employers' demands. More than 25 states followed suit or have bills pending.

September 2012: Knauz BMW

The NLRB upheld the dismissal of a BMW salesman for mocking an accident at a neighboring car dealer on Facebook. The NLRB ruled employers can discipline workers engaging in such speech.

May 2013: New York City Department of Education

An appeals court ruled the DOE couldn't fire teacher Christine Rubino (left), who wrote on Facebook that she hated her students; she called them "devil's spawn." The court found the post was intended for friends; therefore, it was a private venting and deserved a lesser penalty.