Social media HIPAA violation series: Glenview Nursing Home and videos

A Snapchat video of employees taunting a dementia patient led to a lawsuit against Glenview Nursing Home for violating patient privacy and abuse prevention policies.

The situation

In December 2018, certified nursing assistants Brayan Cortez and Jamie Montesa, employees of Glenview Nursing Home in Illinois, filmed and posted a Snapchat video taunting 91-year-old Margaret Collins, a dementia patient. The footage showed Cortez waving a hospital gown in front of Collins while Montesa filmed and added the caption, "Margaret hates gowns," with laughing emojis. Collins, visibly distressed, waved her hands in fear during the incident.

Collins’ daughter, Joan Biebel, described the video as "disturbing," noting that her mother is frail and feared she would be forced to wear the gown. “My mother had an expectation of privacy,” Biebel said, adding that the incident prompted her to contact the police. Cortez and Montesa were arrested on misdemeanor charges, and Collins was moved to another facility.

A lawsuit filed on Collins’ behalf accused the nursing home of violating the Nursing Home Care Act, HIPAA, and Illinois privacy laws. The Illinois Department of Public Health determined the facility failed to enforce its abuse prevention policy, leaving Collins feeling "degradation and shame."

Read more: What is HIPAA? 

What rules were violated

HIPAA mandates the protection of patient privacy, including prohibiting the sharing of any identifiable information about a patient without authorization. By posting the video on Snapchat, the employees violated Collins’ privacy and exposed her to humiliation.

The Nursing Home Care Act and Illinois state privacy laws further protect residents from abuse and neglect. Glenview Nursing Home failed to enforce its abuse prevention policies, contributing to the incident. Attorney Margaret Battersby Black, representing Collins, described the incident as “abuse, plain and simple,” adding that Collins was "bullied and taunted instead of being cared for."

The facility terminated both employees, stating that the actions violated its standards and policies.

In the news: OCR issues guidance to hospitals, nursing homes on non-discrimination 

How companies can avoid violations in the future

To prevent incidents like this, nursing homes and healthcare facilities must strengthen their policies and practices:

• Strict enforcement of abuse prevention policies: Ensure all staff are trained to recognize and prevent behavior that could harm or humiliate residents. Policies should include clear consequences for violations.
• HIPAA training for all employees: Regularly educate staff on patient privacy laws and stress the consequences of using social media irresponsibly.
• Active supervision and monitoring: Implement measures to monitor employee behavior, especially in patient care settings, to prevent abuse or misconduct.
• Encourage a culture of respect: Foster an environment where respect and dignity for residents are core values, reinforced through training and leadership.
• Swift action on complaints: Respond promptly to any reports of abuse or privacy violations, demonstrating zero tolerance for such behavior.

“This was completely wrong,” said Biebel. “My mother deserved care and dignity—not to be humiliated and afraid.” To prevent incidents like this, facilities must prioritize resident well-being and enforce strict safeguards, ensuring patients receive the respect and care they deserve.

See also: Social media & HIPAA compliance: The ultimate guide

FAQs

Can healthcare organizations address patient queries on social media platforms?

Healthcare organizations should refrain from discussing specific patient health details on social media. Encourage patients to use secure communication channels or contact their healthcare provider directly for personalized inquiries. 

How can social media be used for HIPAA compliant patient engagement?

Use social media to share general health info and educational content. Encourage patients to seek personalized advice through secure channels to ensure privacy. 

See also: HIPAA Compliant Email: The Definitive Guide