On August 5, 2016, the Centers for Medicare and Medicaid Services (CMS) published a Survey and Certification Memorandum (Notice) urging State health departments to enforce violations by nursing homes in posting patient images on social media. This development was interesting given that the Office for Civil Rights (OCR), the enforcer of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules, presumably should already be cracking down on any such violations of resident rights as a violation of HIPAA. According to Modern Healthcare, increased instances of nursing home staff inappropriately posting resident pictures on social media may have sparked this pronouncement by CMS.
Specifically, CMS will more strictly enforce, through State agencies, corrective actions to ensure that employee postings of residents in a degrading manner do not occur in the nursing home setting. Interestingly, the Notice does not discuss nursing homes reporting such employee conduct to OCR, but does indicate that employees should report such postings on social media of residents as abuse “to at least one law enforcement agency.”
All this makes HIPAA compliance and, now, compliance with CMS certification standards more important given that there are now two major federal agencies—OCR and CMS—that are looking to prosecute nursing homes for violations of resident rights. Several facilities over the years probably have experienced picture-taking by employees or staff on outings or trips with residents outside or inside of the facility, which results in the posting on social media of those employees’ pictures which contain resident images. Most of the employees’ images were likely posted by employees on social media, but were not intended to degrade or humiliate residents, but rather to post the residents as “friends” of the employees. Unfortunately, the law doesn’t work that way, and the government will be cracking down on even well-meaning employees in nursing homes who post images of residents on social media.
Neville M. Bilimoria, Partner, Health Law Practice Group, Duane Morris LLP – Chicago, 312.499.6758, nmbilimoria@duanemorris.com