After arrival in a hospital, a man with suspected meningococcal septicaemia slips into a coma. One of his friends posts a message on the patient’s Facebook ‘wall’ informing three named contacts that the patient has meningitis and tells them to speak to a doctor. At the request of the Health Protection Unit (HPU), this message is later modified, to reduce unnecessary anxiety and to provide better guidance (Mandeville et al., 2013). Based on the harm principle and considerations of reasonableness, it will be argued that in this case the HPU is justified to contact the close contacts of the patient individually (via Facebook or otherwise), and to require the enterprising ‘friend’ of the patient to post a modified message on the patient’s Facebook wall advising close contacts to contact the HPU, without naming close contacts. Generally, the internal logic of social networking sites like Facebook (sharing personal information with a broad range of ‘friends’) is contrary to the logic of health care systems (keeping breaches of confidentiality to a minimum). Social networking sites (SNS) could justifiably be used for contract tracing, provided that such use complies with the well-established norms of health care systems.