Elderly Monitoring Privacy Laws: Granny Cam Rules, HIPAA Gaps, and State Regulations

Installing cameras in your parent's home feels straightforward until you start asking the right questions. Is it legal to record a home care aide without telling them? What if your parent lives in a nursing home with a roommate? Does HIPAA protect the health data from your parent's wearable fitness tracker? The answers vary dramatically by state, by setting, and by whether audio recording is involved.

In-Home Cameras: What's Legal in Your Parent's Own Home

There is no blanket all-50-state rule for cameras in a parent's home. Legality depends on consent, whether audio is recorded, and who else is present; shared-home and care-facility rules are jurisdiction-specific. Obtain informed consent while your parent has capacity, or appropriate proxy/guardian authorization when capacity is absent, before installing monitoring.

The critical exceptions:

Treat bathrooms and bedrooms as off-limits. These spaces carry a heightened expectation of privacy, and cameras there create serious legal and ethical risk, especially if a home care aide, visiting nurse, family member, or roommate is recorded in a private moment.

Audio recording triggers wiretapping laws. Consent rules vary by jurisdiction; states such as California, Florida, Illinois, and Pennsylvania require all parties' consent for some audio recordings. If you install a camera with a microphone in your parent's living room and record a conversation between your parent and a home health aide, you may be violating state wiretapping law — even though the video itself may be treated differently.

The safest approach is to disable audio where appropriate and obtain the required consent from everyone whose conversation may be captured. A visible notice may be an additional requirement, but it is not a substitute for consent where the law requires consent.

Nursing Home and Assisted Living: State "Granny Cam" Laws

At least ten states have enacted specific legislation permitting electronic monitoring in nursing homes and assisted living facilities. The rules vary significantly.

Ohio (Esther's Law) allows residents or their legal representatives to install cameras in their nursing home rooms. The facility must accommodate the camera and cannot retaliate against the resident. If the resident has a roommate, written consent from the roommate is required. The law was named after Esther, whose family discovered abuse only after secretly installing a camera.

Illinois (Authorized Electronic Monitoring in Long-Term Care Facilities Act) permits cameras with formal written notice to the facility. Roommate consent is mandatory. The resident bears all installation costs. Facilities must post warning signs at building and room entrances. Tampering with a monitoring device is a misdemeanour.

Arizona allows in-room video monitoring in assisted living and nursing facilities but strictly prohibits audio recording. Camera angles must avoid capturing the roommate's bed area or private spaces.

Washington State (RCW 11.130) allows electronic monitoring under procedural rules that protect the resident's right to privacy. Camera fields of view must exclude areas where intimate personal care is provided.

In states without specific granny cam legislation, the legal landscape is murkier. Facilities often have their own policies prohibiting cameras, and families must negotiate with administrators.

The HIPAA Gap: Why Consumer Devices Aren't Protected

The biggest privacy misconception in elderly monitoring is that HIPAA (the Health Insurance Portability and Accountability Act) protects the data from your parent's smartwatch, fall detection pendant, or sleep tracker. It almost certainly does not.

HIPAA applies only to "covered entities" — healthcare providers, insurance plans, and healthcare clearinghouses — and their business associates. When a doctor prescribes a remote monitoring device, the data flows through a covered entity and receives HIPAA protection.

But when you buy a consumer fall detection pendant from Amazon, a GPS tracking watch from a direct-to-consumer company, or a sleep sensor from a retail store, the manufacturer is not a HIPAA-covered entity. All health data collected by that device — movement patterns, heart rate, sleep quality, GPS location — falls through the HIPAA gap entirely.

What the manufacturer may do depends on its privacy policy and applicable state and federal consumer-protection law. The policy and law may permit storage, analysis, aggregation, or potential sharing or sale of movement patterns, physiological metrics, and location data, so review the terms rather than assume a uniform rule. The FTC is a federal fallback for unfair or deceptive practices and health-breach reporting.

Emerging State Protections

Several states have enacted or are developing consumer health data privacy laws that partially close the HIPAA gap.

Washington's My Health My Data Act is the strongest current state-level protection. It requires consent before collecting consumer health data and provides a private right of action, meaning individuals can sue companies directly.

Illinois' Biometric Information Privacy Act (BIPA) protects biometric data (fingerprints, facial geometry, voiceprints) collected by consumer devices. If your parent's smartwatch collects biometric identifiers, BIPA may apply.

California's CCPA/CPRA gives consumers the right to know what data is collected, request deletion, and opt out of data sales — but it exempts businesses with fewer than $25 million in annual revenue, which excludes many small eldercare tech companies.

These state laws remain a patchwork. There is no unified federal consumer health data privacy law, and the protections available to your parent depend entirely on which state they live in.

Practical Steps to Protect Your Parent's Privacy

1. Read the privacy policy of every monitoring device before purchase. Look for language about third-party data sharing, anonymised data sales, and data retention periods.
2. Disable audio recording on all cameras in two-party consent states.
3. Never place cameras in bathrooms, bedrooms, or any space where intimate care is provided.
4. Get written consent from your parent if they have decision-making capacity. If they lack capacity, ensure an appropriate health-care proxy, guardian, or other authorized representative authorises monitoring under the applicable jurisdiction's rules.
5. Inform home care aides that cameras are present. Some jurisdictions require disclosure or posted notice, and failure to follow the applicable rule creates legal risk.

For a detailed privacy audit checklist, consent documentation templates, and a device-by-device data sharing assessment, the Aging in Place Technology Guide covers the legal and ethical framework across US, UK, Australian, and Canadian jurisdictions.