Policy for Voice-Controlled Devices Used in Senior Care Facilities

Over the last two years, the COVID-19 pandemic created a variety of challenges to both health care systems and the individuals they serve, but dire circumstances also fostered particular health care innovations. Voice-controlled devices (“VCDs”) have helped senior care facility populations combat feelings of isolation and loneliness that were exacerbated by visiting restrictions and distancing measures implemented in response to the pandemic. However, introducing VCDs into a senior care environment created certain concerns for the owners and administration of such facilities. We examine key privacy rights considerations as well as best practices for shaping effective policies for VCD usage in senior care settings.

Residential senior care facilities were tasked with creating new avenues for their populations to have meaningful interactions with family, friends, clergy and professional advisers, such as social workers, attorneys, and financial planners. To facilitate these important conversations, senior care facilities introduced VCDs, such as Amazon’s Echo and Google’s Nest devices, as tools for residents to use in maintaining these important relationships.

Senior care facilities have encountered specific challenges regarding compliance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). In addition to HIPAA, senior care facilities’ management and administration must also remain mindful of privacy rights afforded to residents by both federal and state law, such as those codified in New Jersey (as well as other states). Amazon has begun to directly partner with senior care facilities to introduce Echo devices into a partner’s facilities and, in tandem, provide to such partners policies and guidance related to installing and utilizing the Echo devices. However, senior care entities that implement VCDs on their own accord must craft policies and procedures with little formal guidance from governmental or regulatory bodies. For organizations that do not have the financial resources to partner directly with Amazon and benefit from its ready-made policies, preparing policies and procedures that sufficiently address all areas of concern can be a difficult task, as they must remain mindful of a variety of issues which include:

  • assuring that the facility remains compliant with all applicable laws, including HIPAA;
  • protecting the privacy rights of the population under their care, including implementing and maintaining appropriate safeguards; and
  • considering practical and logistical issues in implementing the use of VCDs.

The above three concerns alone implicate a broad array of topics including, but not limited to, overseeing appropriate installation and programing of the VCDs, assuring that individuals in the presence of a VCD at the facility understand pertinent privacy concerns, notifying visitors and other third parties of the presence of VCDs, and addressing VCD use that does not comply with the facility’s policy and procedures. Further, after preparing appropriate policies and procedures for VCD use, senior care facilities must also address implementation. For example, administration should consider the most effective means by which it could provide sufficient disclosures related to VCDs to residents, visitors, and third-parties at the facilities, as well as establish a procedure for obtaining acknowledgements and consents of such parties as to the facility’s VCD policy. Further, management and administration must take into account the need to train its staff on how to operate a VCD and perform basic functions on common VCDs, such as muting the microphone to prevent the VCD from passively capturing verbal communications.

While introducing VCDs to senior care facilities has proved beneficial to resident populations and created a new option for outside communication with family and loved ones, safe and constructive VCD use places the onus on a facility’s management and administration to draft, adopt, and implement carefully considered policies and procedures to protect privacy rights.