Social media policy for care homes

The rule: no law names the policy, but five sources shape it

No statute or regulation requires a care home to have a document called a social media policy, and the Care Quality Commission (CQC) publishes no social media standard. The policy exists to put duties the home already carries into practice, and each part of it should be traceable to one of them.

• Privacy and dignity. Regulation 10 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires the registered person to secure dignity and respect, including “ensuring the privacy of the service user”. CQC's guidance on Regulation 10 says: “Each person's privacy must be maintained at all times including when they are asleep, unconscious or lack capacity.”
• Safeguarding. Regulation 13 says “Service users must be protected from abuse and improper treatment”, and that care or treatment “must not be provided in a way that” is “degrading for the service user”. A photograph or video that humiliates a resident is a safeguarding matter, not only a breach of policy.
• Records. Regulation 17(2)(c) requires the provider to “maintain securely an accurate, complete and contemporaneous record in respect of each service user”. Information about a resident belongs in that record, held by the home, not on a personal account.
• The care worker Code. Standard 5 of the Code of Conduct for Healthcare Support Workers and Adult Social Care Workers in England (Skills for Care and Skills for Health, 2013) is “Respect people's right to confidentiality”: workers must “treat all information about people who use health and care services and their carers as confidential” and “only discuss or disclose information about people who use health and care services and their carers in accordance with legislation and agreed ways of working”. The Code is non-statutory: Skills for Care says it “is voluntary but is seen as a sign of good practice”, and it is “commonly used alongside the Care Certificate”.
• Nurses' professional duties. Paragraph 20.10 of the NMC Code asks nurses, midwives and nursing associates to “use all forms of spoken, written and digital communication (including social media and networking sites) responsibly, respecting the right to privacy of others at all times”, and the NMC's guidance on using social media responsibly covers “WhatsApp, Instagram, TikTok, Facebook and so on” and “both professional and private personal use”.

Data protection law runs under all five. A photograph of an identifiable resident is personal data, and section 170 of the Data Protection Act 2018 makes it an offence for a person “knowingly or recklessly” “to obtain or disclose personal data without the consent of the controller” (the controller here being the care provider), subject to the defences in section 170(2) and (3). The data protection regulator is the Information Commission, still known as the ICO, which replaced the Information Commissioner on 30 September 2026.

The CQC regulations apply in England. The NMC's guidance applies to its registrants wherever they work: nurses and midwives across the UK, and nursing associates in England. The same duties reach domiciliary care, where the photograph would be taken in the person's own home rather than a residential lounge.

What a care home social media policy covers

A policy that answers the questions staff and families actually ask usually has seven parts:

1. The home's own accounts: which pages exist, who holds the log-in details, who may post, and who approves a post before it goes up.
2. Residents' photographs and stories: the consent behind each one, how it is recorded and reviewed, what happens when a resident lacks capacity to decide, and what is never posted whatever the consent.
3. Staff's personal accounts: what staff may say about their work, and the absolute rule against residents' images and details.
4. Online contact with residents and families: friend requests, direct messages and relationships that existed before the resident moved in.
5. Nurses and other registered professionals: the extra duties their regulator places on them.
6. Families and visitors: photographs taken at visits and events that include other residents, and what the home asks of visitors.
7. When something goes wrong: a post about a resident, criticism of the home online, and a member of staff who raises a concern in public.

The policy should be referred to from the staff code of conduct, the induction checklist, the confidentiality policy and the disciplinary procedure, so that a breach is handled the same way whoever commits it. Cover it at induction and in refresher training, including for bank and agency staff, and have the provider's board, owner or registered manager approve it and review it each year alongside any breaches. Group chats between staff are a separate question with their own risks; the care home staff WhatsApp guide covers them. A care home run by a charity should also read the charity social media policy guide, which covers the trustees' side.

The home's own pages and residents' photographs

Used well, the home's page does real good: positive stories about residents' lives build families' trust, connect the home with its local community and show prospective staff what the work is like. The policy's job is not to stop that. Families value the birthday cake, the singer, the trip to the seaside, but every one of those posts is the home processing a resident's personal data for its own purposes, so it needs a lawful basis, and for a public promotional page that basis is in practice the resident's consent.

Many photographs in a care home also reveal something about health: a wheelchair, a hoist, a feeding cup, a dementia care unit's sign, a birthday on a nursing floor. UK GDPR Article 4(15) defines “data concerning health” as personal data “which reveal information about his or her health status”, and Article 9(1) prohibits processing it unless a condition applies. For a home's own posts, the realistic condition is Article 9(2)(a): “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes”. Since 20 August 2025 Article 9(2) applies only where “the processing is based on Article 6(1)”, so the home also needs an Article 6 lawful basis – here, the resident's consent under Article 6(1)(a). Explicit consent means a clear, specific agreement to this use – the home's public Facebook page, say – not a tick on the admission pack covering “photographs”.

• Record consent per purpose and review it. Separate the care record photograph, the noticeboard in the home, the newsletter to families and the public page. A resident may agree to one and not another.
• Make withdrawal easy. Article 7(3) gives the right “to withdraw his or her consent at any time”, and “It shall be as easy to withdraw as to give consent.” The policy should say who removes the photograph and how quickly.
• Start from capacity. Under section 1 of the Mental Capacity Act 2005, “A person must be assumed to have capacity unless it is established that he lacks capacity.” A diagnosis of dementia is not that finding: many people living with dementia can decide whether their photograph goes on a public page, and capacity is judged decision by decision.
• When a resident cannot decide, the cautious answer is not to post. A decision for a person who lacks capacity “must be done, or made, in his best interests”, and “regard must be had to whether the purpose for which it is needed can be as effectively achieved in a way that is less restrictive of the person's rights and freedom of action”. A best-interests decision is not the resident's consent for UK GDPR purposes, and a relative's agreement is not the resident's consent either. An attorney under a health and welfare lasting power of attorney, or a deputy appointed by the Court of Protection, may have authority to decide for the resident, but must still decide in the resident's best interests. The defensible policy is not to publish an identifiable photograph of a resident who cannot consent; crop, choose another picture, or post the cake. The Regulation 11 consent guide explains who can make decisions for an adult.

Consent is not the only test. Ask whether the resident would be content to be seen that way by people they have never met, years from now. Personal care, distress, confusion, a resident asleep in a chair and the last weeks of life fail that test whatever form has been signed, because Regulation 10's privacy duty holds “at all times including when they are asleep, unconscious or lack capacity”. Photographs that include other residents in the background need those residents' consent too, which is why many homes shoot events from behind or at a distance.

Name who may post and who answers comments and messages on the page. A complaint can arrive as a comment at eleven at night. Regulation 16(2) requires “an accessible system for identifying, receiving, recording, handling and responding to complaints by service users and other persons”, so a complaint received on the page goes into that system, and the reply on the page should be short, contain nothing about the resident, and offer a private route.

Staff in their own lives: personal accounts and boundaries

The core rule for staff is simple and absolute: no photographs, videos or details of residents on personal accounts, whether named or not. Kindly meant posts break it most often – a resident's birthday, a visit from a therapy dog, a goodbye after a death. The Code's standard 5 applies to the carer, Regulation 10 binds the home to secure residents' privacy, and a carer who discloses residents' information without the provider's consent risks the section 170 offence, because what a carer knows about a resident comes from work, not from their private life.

Not naming the resident does not make the post acceptable. The NMC tells its registrants that if they refer to their work on social media they must respect people's “right to privacy and confidentiality”, and that “This is regardless of whether you believe that there is a risk they could be identified.” Families recognise a lounge, a cardigan or a hand. A good policy applies the same standard to all care staff.

For nurses, midwives and nursing associates, the NMC's guidance sets out conduct that can put their registration at risk, including “sharing confidential information inappropriately”, “posting pictures of patients and people receiving care without their consent”, “posting inappropriate comments about patients” and “building or pursuing relationships with patients or service users”. That guidance binds NMC registrants only; for care workers who are not registered, the Code of Conduct is the comparable standard, and the home's policy is what makes it enforceable at work.

• Friend requests. The NMC says registrants “should not use social networks to build or pursue relationships with patients and service users as this can blur important professional boundaries”. Most homes apply that to all staff and extend it to residents' families, with a way to declare a friendship or family tie that existed before the resident moved in.
• Private messages from families. A relative who asks a carer on Facebook how Mum slept should be thanked and pointed to the home's phone line or the manager. The answer is care information and belongs in the record.
• Privacy settings. The NMC's warning applies to everyone: “even the strictest privacy settings have limitations. This is because, once something is online, it can be copied and redistributed.”
• Colleagues and the employer. Comments about colleagues follow the home's bullying and harassment policy, and criticism of the home follows the concerns route in section 05, not a general ban.

Say in the policy that a breach is a disciplinary matter and name the procedure. The code of conduct guide covers the other six standards a care worker is held to.

When a post goes wrong, and when a post raises a concern

Three situations recur, and the policy should give each its own route.

A post about a resident. Ask for it to be taken down at once, and keep a record of what was posted, by whom, when and who saw it. Decide whether it is a personal data breach: under Article 33 of UK GDPR the controller must report a breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the post degraded or humiliated the resident, treat it as a safeguarding concern under Regulation 13 and follow the safeguarding procedure, which may mean a referral to the local authority. If it amounts to abuse or an allegation of abuse, the registered person must also notify CQC without delay under Regulation 18(2)(e) of the Care Quality Commission (Registration) Regulations 2009. Tell the resident and, where appropriate, their family. Where the member of staff is an NMC registrant, consider whether a referral to the NMC is needed. The care home data protection guide covers the breach log.

A family's critical post, or a crisis. Do not argue in public, and do not answer with anything about the resident's care. Invite the family into the complaints procedure that Regulation 16(2) requires the home to run; Regulation 16(1) adds: “Any complaint received must be investigated and necessary and proportionate action must be taken”. When the home is in the news – after an inspection report, a serious incident or an outbreak – the policy should name the one person who speaks for it online, and ask the rest of the care team not to reply, however unfair a post seems.

A member of staff who raises a concern in public. This is where a social media policy most often overreaches. Section 43J of the Employment Rights Act 1996 says “Any provision in an agreement to which this section applies is void in so far as it purports to preclude the worker from making a protected disclosure”, and section 47B gives a worker “the right not to be subjected to any detriment” by the employer “done on the ground that the worker has made a protected disclosure”. But a post to the public is a protected disclosure only if two things hold. It must first be a qualifying disclosure: under section 43B the worker reasonably believes it is made in the public interest and tends to show wrongdoing such as a danger to health or safety or a breach of a legal obligation. And it must meet the stricter conditions of section 43G (or, for a failure of an exceptionally serious nature, those of section 43H, below):

• the worker “reasonably believes that the information disclosed, and any allegation contained in it, are substantially true”;
• the worker “does not make the disclosure for purposes of personal gain”;
• one of the conditions in section 43G(2) is met – for example, the worker has already raised substantially the same information with the employer or with a prescribed person, or reasonably believes they would suffer a detriment if they did; and
• “in all the circumstances of the case, it is reasonable for him to make the disclosure”, judged by matters including who the disclosure is made to (for a public post, anyone who sees it), the seriousness of the failure, whether it is continuing, and whether the disclosure breaches a duty of confidentiality the employer owes to someone else – such as a resident.

Section 43H is a second route, for a failure “of an exceptionally serious nature”. It needs none of the section 43G(2) conditions, so the worker need not have raised the matter first, but the belief in substantial truth, the bar on personal gain and the reasonableness test still apply, and on reasonableness “regard shall be had, in particular, to the identity of the person to whom the disclosure is made”.

CQC is a prescribed person for “the provision of adult social care services in England” on the government's list of prescribed people and bodies. So the policy may ask staff to raise concerns through the whistleblowing procedure or with CQC rather than on social media, and may treat a public post that is not a protected disclosure as a disciplinary matter. It should say plainly that nothing in it stops a protected disclosure, and the home must never penalise one. The whistleblowing policy guide sets out the procedure the social media policy should point to.

The messages behind the post

A social media policy governs the public post, but the post is usually the last message in a chain. The activities coordinator drops twenty photographs from the garden party into the staff group so that someone can choose one for the page; three residents in them have not agreed to the public page, and every photograph now sits on a dozen personal phones. A daughter messages the carer she knows best to ask for a picture of her mother at the party, and the carer sends it from her own phone. A senior sees a colleague's post about a resident on a Sunday, screenshots it and sends it to the manager, and that screenshot is the first record of a breach the home may have to report within 72 hours.

Each of those is the home's information about a resident, and the consent rules, the breach clock and the confidentiality duty in this guide all apply to it. In a consumer messaging app the home does not hold those messages and cannot produce them, and when a member of staff leaves, the photographs and the trail go with them.

ComplyChat provides channels for work conversations, with everyone added told that the channel is on the record, and a mobile number verified by SMS as the identity, so bank and agency staff, and families where the home chooses, can be reached without a work account. Messages are recorded on the server as they are sent, and on paid plans, once the provider's Microsoft 365 tenant is connected, conversations are kept there under the retention schedules the provider already runs. ComplyChat is not a social media tool: it does not run the home's pages, store its photograph library or record residents' consent.

A question for the next management meeting: for the last photograph the home posted, could you show where it was taken, who it was shared with before it went up, and the consent that covered it?

Questions people ask

What should a care home social media policy include?

A care home social media policy should cover the home's own accounts and who may post; residents' photographs and the consent behind each one; what staff may and may not post about work on personal accounts; online contact with residents and families; the extra duties of NMC-registered nurses; and how breaches are handled, without stopping protected disclosures. Each part puts into practice CQC Regulations 10, 13 and 17, the care worker Code of Conduct and data protection law.

Can care staff post photos of residents on social media?

No, not on personal accounts. The care worker Code asks staff to “treat all information about people who use health and care services and their carers as confidential”, the NMC names “posting pictures of patients and people receiving care without their consent” as conduct that can put a nurse's registration at risk, and disclosing residents' personal data without the provider's consent can be an offence under section 170 of the Data Protection Act 2018.

Can a care home post photos of residents on Facebook?

Only with a lawful basis – in practice the resident's consent, which they can withdraw at any time and which must be as easy to withdraw as to give (UK GDPR Article 7(3)). If the photograph reveals anything about the resident's health, it is special category data and needs the resident's explicit consent for that specified purpose (Article 9(2)(a)). Where a resident lacks capacity to decide, a best-interests decision under the Mental Capacity Act must consider the less restrictive option, which usually means not posting, and is not the same thing as the resident's consent.

Can carers be friends with residents' families on Facebook?

Most care home policies say no. The NMC says nurses “should not use social networks to build or pursue relationships with patients and service users as this can blur important professional boundaries”, and homes commonly apply the same rule to all staff and to residents' families, with a route to declare a relationship that existed before the resident moved in.

Do the NMC social media rules apply to care workers?

The NMC's guidance binds nurses, midwives and nursing associates, including those working in care homes, for both professional and private use. Care workers who are not on a professional register are held to the non-statutory Code of Conduct for Healthcare Support Workers and Adult Social Care Workers in England and to their employer's policy.

Can a social media policy stop staff raising concerns online?

It cannot gag protected disclosures: any term in an agreement between worker and employer is void so far as it tries to stop one (Employment Rights Act 1996 s43J), and a worker must not suffer a detriment for making one (s47B). But a public post is protected only if it is a qualifying disclosure in the public interest and meets the stricter conditions in s43G (or, for an exceptionally serious failure, s43H) – for example the worker reasonably believes it is substantially true, is not acting for personal gain, has usually raised it with the employer or a prescribed body such as CQC first, and it is reasonable in all the circumstances. So the policy should route concerns to the whistleblowing procedure and to CQC, and say it does not stop protected disclosures.

Official guidance and your next step

The primary sources are CQC's guidance on Regulation 10; the NMC's social media guidance, read online, which is short and worth giving to every nurse at induction; the care worker Code of Conduct; and the legislation linked above. Quotations are from those pages as published on 28 October 2026.

This guide is a summary for care providers in England, not legal advice about a particular post, disciplinary case or disclosure. Nurseries and schools have their own guides: social media policy for a nursery and social media policy for schools.

Then do one thing: take the last ten photographs on the home's public page and, for each resident in them, find the consent that covers that page. Where you cannot, take the photograph down and fix the consent form before the next event.