Elderly Monitoring Privacy Laws: Granny Cam Rules, HIPAA Gaps, and State Regulations

Installing cameras in your parent's home feels straightforward until you start asking the right questions. Is it legal to record a home care aide without telling them? What if your parent lives in a nursing home with a roommate? Does HIPAA protect the health data from your parent's wearable fitness tracker? The answers vary dramatically by state, by setting, and by whether audio recording is involved.

In-Home Cameras: What's Legal in Your Parent's Own Home

If your parent owns or rents their home and lives alone, installing cameras in common areas (living room, kitchen, entryways) is legal in all 50 states. The homeowner has broad authority over recording within their own property.

The critical exceptions:

Bathrooms and bedrooms are off-limits. Every state recognises a reasonable expectation of privacy in spaces where a person undresses or bathes. Cameras in these rooms — even in your parent's own home — create legal liability, especially if a home care aide, visiting nurse, or family member is recorded in a private moment.

Audio recording triggers wiretapping laws. Twelve states (including California, Florida, Illinois, and Pennsylvania) are "two-party consent" states, meaning everyone being recorded must consent to audio capture. If you install a camera with a microphone in your parent's living room and record a conversation between your parent and a home health aide, you may be violating state wiretapping law — even though the video itself is legal.

The safest approach: use cameras with microphones disabled in two-party consent states, or display a clear, visible sign informing anyone entering the home that recording is in progress.

Nursing Home and Assisted Living: State "Granny Cam" Laws

At least ten states have enacted specific legislation permitting electronic monitoring in nursing homes and assisted living facilities. The rules vary significantly.

Ohio (Esther's Law) allows residents or their legal representatives to install cameras in their nursing home rooms. The facility must accommodate the camera and cannot retaliate against the resident. If the resident has a roommate, written consent from the roommate is required. The law was named after Esther, whose family discovered abuse only after secretly installing a camera.

Illinois (Authorised Electronic Monitoring in Long-Term Care Act) permits cameras with formal written notice to the facility. Roommate consent is mandatory. The resident bears all installation costs. Facilities must post warning signs at building and room entrances. Tampering with a monitoring device is a misdemeanour.

Arizona allows in-room video monitoring in assisted living and nursing facilities but strictly prohibits audio recording. Camera angles must avoid capturing the roommate's bed area or private spaces.

Washington State (RCW 11.130) allows electronic monitoring under procedural rules that protect the resident's right to privacy. Camera fields of view must exclude areas where intimate personal care is provided.

In states without specific granny cam legislation, the legal landscape is murkier. Facilities often have their own policies prohibiting cameras, and families must negotiate with administrators.

The HIPAA Gap: Why Consumer Devices Aren't Protected

The biggest privacy misconception in elderly monitoring is that HIPAA (the Health Insurance Portability and Accountability Act) protects the data from your parent's smartwatch, fall detection pendant, or sleep tracker. It almost certainly does not.

HIPAA applies only to "covered entities" — healthcare providers, insurance plans, and healthcare clearinghouses — and their business associates. When a doctor prescribes a remote monitoring device, the data flows through a covered entity and receives HIPAA protection.

But when you buy a consumer fall detection pendant from Amazon, a GPS tracking watch from a direct-to-consumer company, or a sleep sensor from a retail store, the manufacturer is not a HIPAA-covered entity. All health data collected by that device — movement patterns, heart rate, sleep quality, GPS location — falls through the HIPAA gap entirely.

This means the manufacturer can, under most circumstances, share, sell, or aggregate your parent's daily movement patterns, physiological metrics, and location data with third-party brokers. The only federal backstop is the FTC, which can pursue companies for deceptive privacy practices but does not regulate data collection itself.

Emerging State Protections

Several states have enacted or are developing consumer health data privacy laws that partially close the HIPAA gap.

Washington's My Health My Data Act is the strongest current state-level protection. It requires consent before collecting consumer health data and provides a private right of action, meaning individuals can sue companies directly.

Illinois' Biometric Information Privacy Act (BIPA) protects biometric data (fingerprints, facial geometry, voiceprints) collected by consumer devices. If your parent's smartwatch collects biometric identifiers, BIPA may apply.

California's CCPA/CPRA gives consumers the right to know what data is collected, request deletion, and opt out of data sales — but it exempts businesses with fewer than $25 million in annual revenue, which excludes many small eldercare tech companies.

These state laws remain a patchwork. There is no unified federal consumer health data privacy law, and the protections available to your parent depend entirely on which state they live in.

Practical Steps to Protect Your Parent's Privacy

1. Read the privacy policy of every monitoring device before purchase. Look for language about third-party data sharing, anonymised data sales, and data retention periods.
2. Disable audio recording on all cameras in two-party consent states.
3. Never place cameras in bathrooms, bedrooms, or any space where intimate care is provided.
4. Get written consent from your parent if they have decision-making capacity. If they lack capacity, ensure their healthcare proxy or power of attorney authorises monitoring.
5. Inform home care aides that cameras are present. Most states require this, and failure to disclose creates legal risk.

For a detailed privacy audit checklist, consent documentation templates, and a device-by-device data sharing assessment, the Aging in Place Technology Guide covers the legal and ethical framework across US, UK, Australian, and Canadian jurisdictions.