August 3, 2016 VIA ELECTRONIC TRANSMISSION Jocelyn Samuels Director Office for Civil Rights Department of Health and Human Services 200 Independence Avenue, SW Washington, DC 20201 Dear Director Samuels: On February 9, 2016, I contacted HHS regarding the troubling problem of nursing home abuse via social media. This previous correspondence noted dozens of instances of elder abuse beginning in 2012 and perpetrated through the use of social media platforms such as Facebook, Instagram, and Snapchat. For example, my letter noted the case of an Illinois man, Channing J. Butler, who was accused of soliciting men to have sex with elderly women in a memory care facility where he was an employee. 1 Following his arrest, Butler was charged with solicitation to commit aggravated criminal sexual assault. 2 This instance was just one example of a troubling practice of elder abuse within nursing homes that often consists of nonconsensual photographs of partially nude residents shared on Snapchat, Facebook, and Instagram. 3 These cases demonstrate the ease with which the elderly can be abused and exploited using emerging social media websites and technologies. While the individuals in the previous cases faced action from their employers and prosecution by state authorities, a recent instance of abuse has escaped prosecution as a result of authorities deeming that the activities did not violate the law. In March of this year, in Hubbard, Iowa, a certified nursing assistant shared a photo of a nursing home resident with dementia with 1 Mary Schenk, Man arrested over alleged plot to videorecord sex with memory-care patients, THE NEWS GAZETTE (Jan. 19, 2016), http://www.news-gazette.com/news/local/2016-01-19/man-arrested-over-alleged-plotvideorecord-sex-memory-care-patients.html 2 Id. 3 See Charles Ornstein, Inappropriate Social Media Posts by Nursing Home Workers, Detailed, ProPublica (Dec. 21, 2015), https://www.propublica.org/article/inappropriate-social-media-posts-by-nursing-home-workers-detailed. Director Jocelyn Samuels August 3, 2016 Page 2 of 3 his pants around his ankles, and his legs and hand covered in feces. 4 The nurse assistant sent the photo to friends, captioned “s--- galore,” utilizing Snapchat.5 However, despite the clearly abusive and exploitive nature of this activity, Iowa’s dependent abuse law deals only with “sexual exploitation of a dependent adult by a caretaker,” which state health officials deemed to be inapplicable in this situation because the dependent’s genitals were not shown. 6 While Iowa lawmakers are confronting this gap between the law and modern technology, it is important to understand the standards those in the medical profession are held to and how those standards are enforced by your agency. The Health Insurance Portability and Accountability Act (HIPAA) is a patient privacy law within OCR’s jurisdiction. As such, OCR is responsible for investigating nursing home abuse allegations relating to privacy, which would include exploitation of residents via photography. The Centers for Disease Control and Prevention (CDC) reports that the “physical and psychosocial consequences of elder abuse are numerous and varied.”7 It is unclear what is being done to ensure that these consequences are avoided. Reports have stated that OCR could act in these situations as part of their authority to enforce HIPAA, but it is not clear what OCR has done to protect against the threats to patient privacy and dignity that are put at risk by irresponsible and abusive use of social media.8 As technology and social media expand, we owe it to our nation’s elderly population to ensure quality nursing home care, which debasement of patients does not fulfill. Therefore, I would like to know more about what rules and protections are in place to prevent and punish these types of abuses. Please answer the following questions and provide the requisite information: 1. Are the nursing home abuses that occurred in Hubbard, Iowa violations of HIPAA? Please explain. If not, why not? 2. OCR has stated that it intends to issue guidance with respect to HIPAA and the use of social media. When will that guidance be issued? 3. In the past five years, how many of OCR’s investigations dealt with HIPAA violations in nursing homes related to social media use? Of those, how many resulted in civil penalties or referral to the Department of Justice for criminal prosecution? 4 Charles Ornstein and Jessica Huseman, Nursing Home Residents Being Exploited Online – Legally, The Des Moines Register (Jul. 14, 2016) available at http://www.desmoinesregister.com/story/news/health/2016/07/14/nursing-home-residents-being-exploited-onlinelegally/87023610/ 5 Id. 6 Id. 7 Elder Abuse: Consequences, Centers for Disease Control and Prevention, Injury Prevention & Control: Division of Violence Prevention, http://www.cdc.gov/violenceprevention/elderabuse/consequences.html (last visited Jan. 28, 2016) 8 Ornstein, Nursing Home Residents Being Exploited Online – Legally, available at http://www.desmoinesregister.com/story/news/health/2016/07/14/nursing-home-residents-being-exploited-onlinelegally/87023610/ Director Jocelyn Samuels August 3, 2016 Page 3 of 3 4. On OCR’s website, it notes that as of May 31, 2016, 575 criminal referrals were made to the Department of Justice relating to HIPAA. 9 Of those, how many dealt with HIPAA violations in nursing homes? Of those, how many involved social media related abuse? 5. When an employee of a nursing home engages in activity that potentially violates HIPAA, what are the requirements of the nursing home to report that activity? Thank you in advance for your cooperation with this request. Please number your responses according to their corresponding questions and respond no later than August 17, 2016. If you have questions, please contact Josh Flynn-Brown or Paul Junge of my Committee staff at (202) 224-5225. Sincerely, Charles E. Grassley Chairman Committee on the Judiciary 9 U.S. Department of Health and Human Services, Enforcement Highlights, available at http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html