This story was co-published with NPR's Shots blog and the Des Moines Register.

When a certified nursing assistant in Hubbard, Iowa, shared a photo online in March of a nursing home resident with his pants around his ankles, his legs and hand covered in feces, the most surprising aspect of state health officials’ investigation was this: It wasn’t against the law.

The Iowa law designed to protect dependent adults from abuse was last updated in 2008, before many social media apps existed. It bars “sexual exploitation of a dependent adult by a caretaker,” which would have applied if the photo showed the resident’s genitals. It didn’t.

The nurse assistant was fired from Hubbard Care Center after a co-worker reported her to supervisors, but the state was unable to discipline her at all. She remains eligible to work in any nursing home in the state. Government documents did not name her.

“This was something no one expected,” said David Werning, a spokesman for the Iowa Department of Inspections and Appeals, of the case. The nurse assistant had used Snapchat to send the photo of the resident, who has dementia, to six colleagues, along with the caption “shit galore,” according to government reports.

“What we have is a very disgusting and humiliating situation,” Werning said, “but it does not meet the definition of sexual exploitation, and I think that was a surprise to everybody.”

Now Iowa officials are working to update the law to address changing technology, he said, “so we won’t be caught off-guard again.”

The Iowa incident is just one illustration of how regulators and law enforcement officials nationwide are struggling to respond when employees at long-term care facilities violate the privacy of residents by posting photos on social media websites.

In a story published last year, ProPublica identified nearly three dozen of these cases, the majority involving Snapchat, a social media service in which photos appear for a few seconds and then disappear. We’ve discovered nine more instances since then, including one in which a youth volunteer at a Colorado nursing home shared a selfie on Snapchat that showed a 108-year-old resident urinating. (You can read details of each incident here.)

Following ProPublica’s earlier coverage, Sen. Charles Grassley, the Iowa Republican who chairs the Senate Judiciary Committee, sent letters to social media companies and federal agencies asking what they are doing to stop the abuse. He’s taken Snapchat, in particular, to task because he said its online tool for reporting suspected abuse requires the affected person to file a complaint — a near impossibility for elderly people with dementia.

“When an individual tries to report a safety concern on behalf of someone else, say, an elderly nursing home resident, the tool produces the message: ‘We are unable to take action based on third-party reports,’” Grassley wrote to Snapchat on June 28. “An elderly nursing home resident victim is unlikely to have his or her own Snapchat account or have the knowledge or ability necessary to report abusive snaps on his or her own behalf.”

Snapchat’s website gives people several avenues to file complaints. But the pathway to report elder abuse isn’t straightforward, particularly for those unfamiliar with the app, which is popular among teenagers.

In replies to Grassley, Facebook and Snapchat have said they are doing what they can to deal with abusive pictures and videos that violate their terms of service.

“Although we cannot prevent physical abuse from occurring—whether in a nursing home or schoolyard—Snapchat is fiercely committed to terminating the accounts of Snapchatters who we believe have engaged in abusive behavior,” Snapchat’s general counsel Chris Handman wrote to the senator.

Facebook, which also owns Instagram, said it removes images depicting sexual violence and generally prohibits nudity. Anyone can report abusive content, the company said.

Grassley’s pressure also has regulators re-examining their handling of these cases. In a letter to the senator, Assistant Attorney General Peter J. Kadzik wrote that while the Justice Department has gone after nursing homes for poor care, “we have not yet brought any cases involving allegations of nursing home employees misusing social media or electronic devices to record elder residents in compromising positions. We wholeheartedly agree that such conduct is deeply troubling and unacceptable.” The Justice Department said it would share the concern with its Elder Justice Task Forces “to ensure that they are especially attuned to allegations of such conduct.”

Some state and local prosecutors have been more aggressive in pursuing such cases under laws that prohibit elder abuse, sexual exploitation and indecency. In Colorado, for example, the volunteer who took a selfie with the 108-year-old resident who was urinating has been charged in juvenile court with invasion of privacy.

The Office for Civil Rights within the U.S. Department of Health and Human Services could take action in such cases as part of enforcing the federal patient privacy law known as HIPAA. But that agency has not penalized any long-term care facility for photos posted online and has yet to release any social media guidance for nursing homes. An official told ProPublica that guidelines are in the works.

The nursing home industry isn’t waiting. Last month, the industry’s trade group issued its own suggestions for dealing with such situations, encouraging training and swift responses by these facilities when allegations are brought to light. The group also is holding training events around the country. Dianne De La Mare, vice president of legal affairs at the American Health Care Association, said nursing home companies “were all struggling with this.”

“We don’t want this stuff to happen anymore. To the greatest degree we can stop it, we want to,” she said.

The trade group noted that most instances of abuse have been reported by other staff members—a sign that most workers are diligent and do not tolerate such actions — but that some homes also hire outside companies to monitor social media.

While many facilities ban the use or possession of cell phones by employees when in resident areas, De La Mare said, they’ve also found such rules impractical to enforce.

“A lot of the younger people, your phone is like your wallet,” she said. “You would never be without your phone…It’s really difficult for [home officials] to say, ‘We understand you’re a single mom, you need to keep track of your kids, but that stays in your purse.’ It’s a challenge, I have to tell you that.”

As the Iowa case demonstrates, even nursing homes eager to respond to incidents responsibly face obstacles.

When it learned of the photo of its resident covered in feces, Hubbard Care Center contacted its local sheriff’s office. The office did not create a report or press charges; instead they encouraged the nursing home to contact health regulators, said Hardin County Deputy Sheriff Jeffrey Brenneman. The state investigated and initially fined the facility $8,500, which it reduced to $1,000 on appeal. Officials determined there was no evidence the facility knew or should have known that the assistant “might engage in such outrageous actions.” And state officials learned that the law wasn’t written with these situations in mind.

Kendall Watkins, a lawyer for the home, called the incident an “isolated act” to which the facility responded quickly and appropriately.

The nursing home has already updated its policy to define “exploitation” of residents to include “transmission, display, taking of electronic images of the dependent adult by a care taker in a private or compromised situation (i.e. using the bathroom, changing clothes, personal cares) for a purpose not related to treatment or diagnosis or as part of an ongoing investigation.”

Grassley said the incident in his home state troubled him. “It speaks to the lowest instincts of humankind that you never expect people to do,” he said. “If you’re a worker there, if you were really concerned about the patient, why wouldn’t you start immediately cleaning people up?”

Has your medical privacy been compromised? Help ProPublica investigate by filling out a short questionnaire. You can also read other stories in our Policing Patient Privacy series.