Best examples of privacy policy examples for nursing homes

Real-world examples of privacy policy examples for nursing homes

Let’s start where most lawyers don’t: with actual language you might see in a modern nursing home privacy policy. These are not one-size-fits-all, but they reflect how many U.S. facilities are writing policies in 2024–2025 to address HIPAA, state law, and family expectations.

Below are several examples of privacy policy examples for nursing homes that you can adapt. Each one highlights a different section you’ll almost always need: resident rights, consent, data sharing, technology use, and complaints.

Example of a resident privacy rights section

A good policy starts by telling residents what rights they have in plain English. Here is an example of language you might see:

Your Privacy Rights
We respect your right to keep your health information private. Under federal and state law, you have the right to:
• See and get a copy of your medical and billing records kept by our facility, usually within 30 days of your request.
• Ask us to correct information you believe is inaccurate or incomplete.
• Ask us not to share your information for certain purposes, such as with specific family members or caregivers. We may not be able to agree to every request, but we will tell you our decision.
• Ask for a list of certain disclosures we have made of your health information.
• Receive this privacy policy in paper or electronic form.
• File a complaint if you believe your privacy rights have been violated, without fear of retaliation.

This is one of the best examples of how to balance legal accuracy with readability. It mirrors HIPAA rights described by the U.S. Department of Health & Human Services (HHS) while staying understandable to residents and families.

For reference, you can compare your wording against HHS guidance on HIPAA rights:

https://www.hhs.gov/hipaa/for-individuals/index.html

Consent is where nursing homes often get into trouble, especially around sharing information with family members, powers of attorney, and caregivers who “just want an update.” A strong policy gives clear guardrails.

Here is an example of a consent and communication section:

How We Share Information With Your Family and Caregivers
With your permission, we may share relevant health information with your family members, legal representative, or other persons involved in your care or payment for your care. You can tell us who we may talk to and what we may share.
If you are unable to agree or object, we may share information that we believe is in your best interest, consistent with applicable law. For example, if you have an emergency, we may share information with a family member involved in your care.
You may change your preferences at any time by notifying our Privacy Officer in writing.

Stronger policies in 2024–2025 are also spelling out communication channels. Here’s another example of language you might see:

Phone, Email, and Text Updates
At your request, we may provide appointment reminders or care updates by phone, email, or text message. These methods may have additional privacy risks, such as messages being seen by others with access to your device or account. You may opt out of these communications at any time.

These examples include clear references to risk and choice, which regulators increasingly expect when electronic communication is involved.

Data sharing is where nursing homes intersect with hospitals, labs, pharmacies, and insurers. The best examples of privacy policy examples for nursing homes explain this in a way residents can follow, without hiding the reality that information has to move for care to happen.

Here is a practical example of a data use and disclosure section:

How We Use and Share Your Health Information
We use your health information to provide care and to operate our facility. For example, we may:
• Share information with hospitals, physicians, therapists, and pharmacies involved in your treatment.
• Send information to your insurance plan, Medicare, or Medicaid to obtain payment for your care.
• Use information to improve quality of care, such as reviewing falls, infections, or medication errors.
• Share information when required by law, such as reporting abuse, neglect, or certain infections to public health authorities.
When we share information with organizations that perform services for us (for example, billing or electronic record services), we require them by contract to protect your information.

For public health examples, many policies now explicitly reference reporting requirements, which are guided by agencies like the CDC and state health departments:

https://www.cdc.gov/longtermcare/index.html

This kind of wording shows regulators that you understand your reporting obligations, while letting residents know when and why their data leaves the building.

Technology and EHR: newer examples of privacy policy examples for nursing homes

Electronic health records (EHR), tablets at the bedside, and remote access for off-site physicians are now standard. Policies that still read like it’s 2005 are red flags. More recent examples of privacy policy examples for nursing homes explicitly address technology, access controls, and cybersecurity.

Here is an example of how a policy might describe EHR and access controls:

Electronic Records and Security
We maintain your health information in electronic and paper form. We use technical and administrative safeguards designed to protect your information, including user authentication, access controls, and activity monitoring.
Only staff members who need your information to perform their job duties are allowed to access your records. We provide training to staff on privacy and security requirements and take disciplinary action when policies are not followed.

To reflect 2024–2025 trends, many facilities are also adding language about remote access and telehealth:

Remote Access and Telehealth
Some of your care may be provided by clinicians who access your records remotely or who communicate with you using audio or video technology. We use platforms that are configured to support privacy and security requirements, but no system is risk-free. We limit remote access to authorized users and monitor access for inappropriate activity.

This kind of example of policy language acknowledges modern care models while setting realistic expectations about risk and safeguards.

Cameras, monitoring, and visitors: examples include sensitive gray areas

One area where residents and families have strong opinions is monitoring: hallway cameras, room cameras requested by families, and wearable devices. State laws vary widely, so you need local legal advice, but you can still learn from examples of privacy policy examples for nursing homes that address the issue directly.

Here is an example of language about facility cameras:

Video Monitoring in Common Areas
For safety and security, we may use video cameras in common areas such as entrances, hallways, and dining rooms. These cameras do not record audio. We do not use cameras in resident bathrooms or in private areas where you would reasonably expect privacy.

And an example of how some facilities are handling resident- or family-installed cameras in rooms, where state law permits:

Resident-Installed Cameras in Rooms
In certain circumstances and where allowed by law, residents or their legal representatives may request to install a camera in the resident’s room. We require a written consent process that addresses roommate privacy, staff notice, and placement of signage. We may limit or remove cameras that violate the privacy rights of other residents or staff.

These examples include clear conditions and limits, which is exactly what regulators and ombuds programs look for when they review policies.

For more context on resident rights and monitoring, facilities often look to resources from organizations like the National Consumer Voice for Quality Long-Term Care:

https://theconsumervoice.org/issues/other-issues/privacy

Examples of privacy policy examples for nursing homes: staff training and enforcement

A policy that looks good on paper but never shows up in staff behavior is a liability. Stronger policies now include short, direct statements about training and enforcement.

Here is an example of how that might read:

Staff Responsibilities and Training
All employees, volunteers, and contractors must follow this privacy policy and applicable privacy laws. We provide training on privacy and security when staff are hired and at regular intervals. Staff who fail to protect resident information may face disciplinary action, up to and including termination.

Another example of privacy policy examples for nursing homes adds a bit more detail on practical expectations:

Use of Personal Devices
Staff may not take resident photos or videos on personal devices or share resident information through personal email, text messages, or social media, unless specifically authorized and in compliance with this policy and applicable law.

These examples include clear, enforceable rules that match what surveyors and inspectors are seeing as common problem areas: texting, photos, and social media.

Incident response and breach notification: newer best examples

Data breaches in health care are rising, and long-term care is not immune. HHS and the Office for Civil Rights (OCR) have reported consistent increases in reported breaches across health care settings. Nursing homes that want to show maturity in 2025 are adding explicit breach notification sections.

Here is a practical example of breach-related language:

Privacy Incidents and Data Breaches
We investigate all reports of possible privacy or security incidents. If we determine that your information has been accessed, used, or disclosed in a way that is not allowed by law, we will evaluate whether this is a reportable breach. When required, we will notify you in writing, usually within 60 days of discovery, and explain what happened, what information was involved, and what you can do to protect yourself.

This is one of the best examples of policy language that lines up with HIPAA breach notification rules without drowning residents in legal citations.

For background on breach reporting expectations, see:

https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

Complaint process and contact details: examples include clear next steps

Regulators expect a named contact and a straightforward complaint process. Residents and families expect to know who to call when something feels off.

Here is an example of a complaint and contact section:

Questions and Complaints
If you have questions about this privacy policy or believe your privacy rights have been violated, you may contact our Privacy Officer at:
• Mailing address: [Facility Address]
• Phone: [Facility Phone Number]
• Email: [Privacy Office Email]
You may also file a complaint with the U.S. Department of Health & Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

This is an example of policy language that both meets legal expectations and reassures residents that speaking up will not affect their care.

Pulling it together: using these examples of privacy policy examples for nursing homes

If you’re drafting or revising a policy, the examples of privacy policy examples for nursing homes above give you building blocks. Most facilities will need to cover at least the following areas in some form:

Resident privacy rights and how to exercise them
Consent and communication with families and caregivers
Data use and sharing for treatment, payment, operations, and legal reporting
Technology and electronic health records, including remote access
Monitoring and cameras, especially in resident rooms and common areas
Staff responsibilities, training, and use of personal devices
Incident response and breach notification
Complaint procedures and contact information

The best examples do three things at once:

Stay aligned with HIPAA and state law.
Use language that residents and families can actually understand.
Reflect how your nursing home really operates in 2024–2025, not how it looked on paper ten years ago.

The point is not to copy and paste. Instead, treat these examples as a checklist and a style guide. Take the examples of privacy policy examples for nursing homes that fit your operations, adjust them for your state’s requirements, and have legal counsel review the final draft before adoption.

FAQ: nursing home privacy policy examples

What are some common examples of privacy policy examples for nursing homes?
Common examples include sections on resident rights, consent for sharing information with family, data sharing with hospitals and insurers, rules on cameras and monitoring, staff use of personal devices, and breach notification procedures.

Can you give an example of how a nursing home should describe data sharing with hospitals?
A typical example of clear language is: “We share your health information with hospitals, physicians, therapists, and pharmacies involved in your treatment to coordinate your care, such as when you transfer to or from a hospital or specialist.” This kind of example of wording shows why the sharing happens and who is involved.

Do nursing home privacy policies have to mention HIPAA by name?
Not always, but most U.S. facilities do. Even when HIPAA is not spelled out in detail, the policy should reflect HIPAA standards and any stricter state rules. Many of the best examples of privacy policy examples for nursing homes refer to “federal and state privacy laws” and then link to or reference HIPAA rights.

Are there public examples of nursing home privacy policies I can review?
Yes. Many multi-facility operators and nonprofit long-term care organizations publish their privacy policies on their websites. When you review them, look for the same elements covered in the examples include in this guide: resident rights, consent, data sharing, technology, monitoring, and complaints.

How often should a nursing home update its privacy policy?
Most facilities review at least annually or when there are regulatory changes, new technology (for example, a new EHR or telehealth platform), or incidents that expose gaps. Using updated examples of privacy policy examples for nursing homes, like the ones above, can help you identify areas that need a refresh.

Best examples of privacy policy examples for nursing homes in 2025