Nursing Facilities to Face Surveyors’ Review of Photo and Video Policies

The Centers for Medicare and Medicaid Services (CMS) this month took aim at the unauthorized taking and sharing of photos and videos – including through social media – in nursing facilities. In response to media reports and congressional attention to the inappropriate taking and sharing of photos and videos by some nursing facility employees, CMS directed surveyors to (i) review nursing facilities’ policies relating to the taking, keeping or sharing of photos, videos or other recordings; (ii) investigate allegations related to unauthorized photos or videos; and (iii) evaluate whether to cite facilities for abuse, violations of resident privacy and/or violations of training requirements if staff have taken or shared unauthorized recordings. 

Although the CMS action specifically applies to certified nursing homes, it should prompt other health care providers to evaluate whether their own policies and procedures address these issues. Reported incidents of unauthorized use of social media accounts by health care staff are not limited to nursing facilities. Last month, the mother of a deceased patient sued a Chicago hospital and an emergency room nurse, alleging that the nurse tweeted a photo of the patient’s bloody trauma room. 

The CMS action followed reports by news media and the ProPublica organization regarding inappropriate taking and sharing of photos or videos, often using social media networks such as Facebook, Instagram and Snapchat.  ProPublica reported 47 incidents in the last 4 years. Many of these reported incidents are shocking, involving explicit photos or videos of residents in embarrassing or humiliating situations. Other incidents are less shocking – such as photos of a resident on a nurse aide’s social media account – but nevertheless were unauthorized. Many of the incidents involved nurse aides. 

The CMS Survey and Certification memo, S&C: 16-33-NH, interprets existing laws and regulations.  The memo states that taking, keeping, or sharing of inappropriate or unauthorized photos may be treated as a violation of the following federal requirements:

• A resident’s right to privacy (42 C.F.R. § 483.10(e); F-164)
• Prohibitions on abuse of a resident (42 C.F.R. §§ 483.13(b); F-223)
• Staff treatment of residents (42 C.F.R. § 483.13(c); F-226)
• Training on abuse prevention (42 C.F.R. § 483.13(c); F-226)
• Nurse aide competency (42 C.F.R. § 483.75(e); F-495)
• Facility response to alleged violations (42 C.F.R. §§ 483.13, 483.75; F-225, F-490, F-493)

Although initial reaction to the CMS memo focused on social media, the guidance is directed more broadly, prohibiting the taking, keeping or sharing of unauthorized photos or videos. The memo states that violations could occur, for instance, with an unauthorized photo of a resident’s room or of a resident participating in an activity in a common area. (These recordings could also run afoul of HIPAA or state privacy laws. In some of the extreme examples cited by ProPublica, employees faced criminal sanctions and/or delicensure for their activities.)  Accordingly, facilities that wish to take or keep such photos or videos must obtain written consent from the resident or Responsible Party, and be able to demonstrate later to surveyors that the photo or video was authorized.

The memo directs state agency surveyors to:

1. Request and review “nursing home policies and procedures related to prohibiting nursing home staff from taking or using photographs or recordings in any manner that would demean or humiliate a resident(s).”  Survey teams are directed to request these policies in Standard surveys until all certified nursing homes have been reviewed for compliance.    
2. Review facilities’ policies related to photos and videos in any future survey, “as necessary based upon identified concerns and/or complaints.” 
3. Investigate any allegation that an unauthorized photograph or recording of a resident has been “taken, kept, and or distributed on social media or transmitted by multimedia messaging by staff,” or any allegation that a recording humiliates or demeans a resident, whether or not the recording was distributed via social media. Depending on the seriousness of the allegation, state surveyors must investigate the allegation within 2 to 10 days of the allegation, and must evaluate whether to refer the incident to local law enforcement. CMS directs surveyors to determine how the resident responded to the situation, to interview family members, and, if no family members are available, to determine how a “reasonable person” would be affected by the situation.
4. Report any individual who has abused a resident to the facility, licensing authorities and (if applicable) to the nurse aide registry and law enforcement. 

When a facility learns of any alleged incident involving unauthorized photos, videos or use of social media, it should determine immediately whether the allegations could constitute abuse, a breach of state or federal privacy laws and/or state or federal criminal laws. These incidents should be treated like other allegations of abuse, with an investigation, appropriate reporting to officials and taking steps to prevent further potential abuse. Examples of prevention activities cited by CMS include staffing changes, increased supervision, protection from retaliation and/or counseling for the resident.  Facilities and their employees who do not abide by these policies subject themselves to considerable legal liability in addition to the CMS regulatory issues, including civil tort claims such as invasion of privacy, assault, and intentional infliction of emotional distress, as well as potential criminal liability.

Surveyors must begin asking for facilities’ social media policies by September 4, 2016. To address these issues, nursing facilities (and other health care providers) should:

• Immediately develop or update their policies pertaining to the taking, keeping and sharing of photos, videos and other recordings – including the use of social media to share any photo or video. These policies should address not only the clearly inappropriate situations cited by news reports, but also situations that staff intend as benign gestures, such as posting unauthorized photos (such as photos of a facility holiday party) or “friending” a resident on Facebook. Policies might also include provisions requiring employees to make clear that they do not speak for the facility if they post content about their workplace. (Labor laws prohibit employers from strictly barring their employees from discussing their workplace online.)
• Implement a procedure for ensuring that the taking and sharing of photos of residents, at a holiday party for instance, are authorized in writing by the resident or Responsible Party.
• Train all staff on these photo/video, social media and employment policies, and document staff members’ agreement to comply with the policies.
• Ensure that their employment policies and/or agreements clearly allow for disciplining (including terminating) employees who inappropriately use social media or who take, keep or share unauthorized photos or videos.
• Ensure that policies prohibit employees from retaliating against other employees for following the facility’s policy or for reporting a breach of the policy.
• Ensure that staff responsible for handling allegations of abuse are trained to recognize and respond to allegations involving social media, photos and videos.
• Ensure that only authorized staff can post content to your facility’s website or social media channels.
• Evaluate operational policies to prevent employees from taking or sharing unauthorized photos and videos, such as banning personal devices from clinical areas.
• Actively monitor employee compliance with the policies, and immediately address any violations of the policies, with appropriate disciplinary action taken against the offending employee.

Health care providers are well advised to deploy and train their employees and have the requisite investigative, regulatory and employment resources ready to respond to any alleged incident.