Violation of Privacy and Confidentiality Policies
Summary
The facility failed to ensure staff implemented policies and procedures related to personal privacy and confidentiality for one resident. Specifically, a Unit Manager used a personal cell phone to take a picture of the resident's wound, which is against the facility's Clinical Photography Policy. The policy states that clinical photography should only be done with a completed Photography Consent Form and should not be taken on personal devices. The resident's health care proxy had consented to clinical photography, but the use of a personal phone was a clear violation of the policy. During a clinical meeting, the Unit Manager showed the photo of the resident's wound to the Director of Nursing (DON) and offered to show it to the Administrator, who declined. The Unit Manager made a joke about her husband not liking to see such photos, which was witnessed by the Social Worker and other staff members. The Social Worker reported the incident to Human Resources (HR), who then brought it to the attention of the Administrator and the DON. Despite reviewing the unit cell phone, no photos of the wound were found, raising concerns about the use of personal devices for clinical photography. Interviews with various staff members, including the Social Worker, HR Staff Person, DON, Rehab Director, and the Administrator, confirmed the incident. The Unit Manager denied taking the photo on her personal phone and claimed she was joking about her husband. However, the Rehab Director and Social Worker believed the photo was on a personal phone, as the phone used was white, unlike the facility's black phones. The Administrator and DON assumed the photo was taken on the unit cell phone but could not find any evidence of it. The incident highlights a breach of the facility's policy and the need for strict adherence to privacy and confidentiality protocols.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
A resident with dementia, severe cognitive impairment, and total dependence for ADLs was resting in bed with her door open when another resident wandered into the room and began moving the blankets covering her. Staff, including an LPN and CNAs, reported that residents on the memory care unit were allowed to wander without boundaries, including entering other residents’ rooms. This practice conflicted with the facility’s policy requiring respect for resident dignity and privacy, resulting in a failure to protect the resident’s privacy while she was in bed.
Two CNAs violated privacy and confidentiality requirements when one CNA used a personal cell phone to record and photograph two residents during a perceived altercation and then sent the video to another CNA. The residents, who had significant medical conditions including paraplegia, seizures, dysphagia, and severe cognitive impairment, were dependent on staff for ADLs. The second CNA reported that a family member later took her phone without permission, accessed the contents, and transmitted the videos and photos to facility leadership. Facility staff, including an LVN, the DSD, and the administrator, stated that HIPAA rules and facility policies prohibit staff from recording residents on personal devices and allow resident photographs only with consent and for medical purposes as part of the chart, and that the facility’s "Stop and Watch" process requires observation and reporting, not filming.
A resident’s privacy rights were violated when staff, following the direction of a former administrative staff member, opened the resident’s delivered packages without obtaining consent. The facility’s Mail/Package Screening policy required written consent before opening items and recognized residents’ rights to receive unopened mail and packages, including those delivered by non-postal carriers. The resident reported that they were told they had no right to unopened deliveries if not sent via the U.S. Postal Service, and the Nursing Home Administrator confirmed that the resident’s deliveries had been opened without the resident’s knowledge or permission, in violation of facility policy and privacy requirements.
A resident who was cognitively intact and required supervision with ADLs was discharged, and an LPN mistakenly sent that resident’s representative home with another resident’s medications and written discharge instructions, which included detailed information on multiple prescribed drugs for serious conditions such as cerebral infarction, seizures, and sepsis. The error was discovered at shift change when the night nurse could not locate the second resident’s medications in the cart. The administrator and DON confirmed that the wrong medications and paperwork had been provided, and the discharging resident’s representative later reported to police that they had received another resident’s private health information, although none of the incorrect medications were taken.
A cognitively intact resident with Huntington’s disease and other conditions was participating in chair exercises when a CNA used a personal cellphone to record the resident lifting her leg above her head, without any signed photo release or consent from the resident’s POA. Two other CNAs watched the event and did not report it. Other staff later observed the CNAs laughing and viewing the image on the phone. Review of incident reports, staff statements, and the facility’s social media policy confirmed that the recording was taken in the work area using a personal device and that facility policy prohibits taking or sharing resident photos or videos without prior written permission.
A cognitively intact, fully dependent and always incontinent resident received incontinence care from a CNA in a shared room without the privacy curtain being drawn, despite the roommate being present. During the care, the resident’s genital area and buttocks were exposed while the CNA removed the adult brief and cleaned the resident. The resident later reported that staff sometimes forget to pull the curtain and that this exposure sometimes bothers him, and the CNA acknowledged not using the privacy curtain, contrary to facility policy on resident privacy during personal care.
Failure to Protect Bedbound Resident’s Privacy on Memory Care Unit
Penalty
Summary
The facility failed to maintain privacy for a resident with dementia and severe cognitive impairment who was dependent on staff for all ADLs while she was in bed in her room. The resident’s EMR and MDS assessments documented severe cognitive impairment and total dependence for ADLs, and her care plan reflected this dependence. During observation, the resident was resting in bed covered with blankets, with her room door open to the hallway, when another resident wandered into the room and began moving the blankets covering her. A licensed nurse removed the wandering resident from the room after being informed of the incident. Staff interviews revealed that on the memory care unit residents were allowed to wander wherever they wanted, with no boundaries for wandering, including going into and out of other residents’ rooms, despite a facility policy stating that resident dignity and privacy are to be respected. This failure to provide privacy occurred in the context of a memory care unit practice that permitted unrestricted wandering into other residents’ rooms, including the room of a cognitively impaired, fully dependent resident who was in bed at the time.
Unauthorized Resident Recording and Disclosure Violating Privacy and Confidentiality
Penalty
Summary
The deficiency involves a failure to protect residents’ privacy and confidentiality when a CNA used a personal cell phone to record and photograph two residents without their knowledge or consent, and then shared that content with another CNA. One resident had paraplegia, depression, muscle weakness, dorsalgia, and polyneuropathy, was cognitively intact, and dependent on staff for ADLs. The other resident had diagnoses including seizures, dysphagia, acute kidney dysfunction, and muscle weakness, was able to make needs known but could not make medical decisions, had severely impaired decision-making, and was also dependent on staff for ADLs. Both residents were therefore in a position of dependence on staff for care at the time of the incident. According to CNA 2, on a specific date she recorded a video of the two residents because one resident started an altercation with the other. She stated she recorded the incident for “evidence” and to show CNA 1, acknowledging that recording residents was not part of facility policy and that she should not have recorded or taken photographs of them. CNA 1 confirmed that she received the video on her personal cell phone from CNA 2 and stated that the recording was made for “safety purposes” due to a situation that was perceived as potentially escalating to physical aggression. CNA 1 reported that she did not share or post the video on social media or distribute it to others, but that a family member took her phone without permission and accessed its contents. CNA 1 further stated that this family member sent the video and pictures of the two residents to the facility, and that she notified the facility that her phone had been taken but did not disclose that it contained videos or photographs of the residents because she was unaware that the family member had accessed or distributed them. The DSD reported receiving a text message from an unknown number containing approximately two videos and an undetermined number of photographs of the two residents, along with the names of CNA 1 and CNA 2. The DSD, LVN 2, and the Administrator each stated that staff were required to follow HIPAA regulations, that staff were not permitted to record or possess videos or photographs of residents on personal devices, and that any photographs of residents required consent and had to be for medical purposes as part of the medical record. Facility policies on confidentiality, residents’ rights, and dignity stated that unauthorized release, access, or disclosure of resident information, including video or audio, was prohibited and that staff must protect resident privacy and treat residents with dignity and respect. The videos received by the DSD did not show an altercation between the residents, and staff interviews confirmed that filming residents was not part of the facility’s “Stop and Watch” process, which instead required observation, intervention, and reporting of changes in condition or behaviors to nursing staff.
Plan Of Correction
This Plan of Correction is the facility's credible allegation of compliance. Preparation and/or execution of this plan of correction does not constitute admission or agreement by the provider of the truth or facts alleged, or conclusions set forth in the statement of deficiencies. The plan of correction is prepared and/or executed solely because it is required by the provisions of federal and state law. F0583 Personal Privacy/Confidentiality of Records How corrective action(s) will be accomplished for those residents found to have been affected by the deficient practice: Corrective actions were immediately implemented for Resident 1 and Resident 2 upon identification of the deficient practice. The facility initiated an investigation on 03/23/2026 and conducted immediate interviews with staff and residents utilizing structured interview tools to assess scope, impact, and additional potential concerns. Interviews confirmed the incident was isolated and no additional residents reported privacy violations or concerns. The staff members involved were removed from duty immediately. Following completion of the investigation, both employees were terminated in accordance with facility policy due to violation of resident rights, HIPAA, and facility confidentiality policies. Both employees completed formal Declarations and Attestations of Deletion of Unauthorized Recordings, confirming removal of all recordings and non-distribution of content. Documentation includes: Ashley Zelaya, CNA – Declaration executed 03/30/2026 at 9:21 AM, attesting deletion of all recordings and acknowledgment of policy violation Leslie Bram Reyes, CNA – Declaration executed 03/26/2026 at 10:42 AM, attesting deletion of all recordings and acknowledgment of policy violation Residents and/or responsible parties were notified. Social Services completed assessments with no identified psychosocial harm. All corrective actions were completed by 03/26/2026. How the facility identifies other residents having the potential to be affected by the same deficient practice and what corrective action will be taken. A facility-wide audit was initiated on 03/25/2026 using the Briarcrest Comprehensive Privacy, Recording, and Resident Rights Audit Tool. The audit included direct observation, staff interviews, and resident interviews to evaluate compliance with privacy practices, personal device use, and HIPAA requirements. Interviews were conducted using standardized staff and resident interview tools to ensure consistency and thoroughness in data collection. Findings from the audit confirmed that no additional residents were affected by the deficient practice and no additional incidents of unauthorized recording or disclosure were identified. Staff were immediately re-educated by Director and staff development on HIPAA Privacy Rule requirements, the facility's prohibition on personal device recordings, and the appropriate use of the Stop and Watch process for reporting changes in resident conditions. This corrective action was completed by 03/27/2026. What measures will be put into place or what systemic changes will the facility make to ensure that the deficient practice does not recur. The facility implemented systemic changes to prevent recurrence of the deficient practice by reinforcing a zero-tolerance policy for unauthorized recordings and strengthening staff accountability related to resident privacy and confidentiality. Staff completed mandatory re-training by the Director of Staff Development on Resident Rights, HIPAA, and Privacy/Confidentiality requirements. Staff were required to re-acknowledge facility policies related to confidentiality and personal device use. The facility implemented routine supervisory rounding to monitor compliance with personal device restrictions. In addition, the facility installed visible signage at the receptionist area clearly articulates that video recording is strictly prohibited inside resident rooms and in any facility areas where residents are present. The facility also posted signage throughout the entire facility, in both English and Spanish, indicating that video recording is not allowed to ensure clear communication to staff, visitors, and all individuals entering the facility. Privacy and HIPAA compliance were further integrated into new employee orientation, annual competencies, and ongoing in-service education. The Director of Staff Development completed initial re-education by 03/27/2026, and staff completed required training by 04/05/2026. How the facility plans to monitor its performance to make sure that solutions are sustained. To ensure sustained compliance, the facility incorporated privacy and confidentiality monitoring into its Quality Assurance and Performance Improvement (QAPI) program. The facility implemented an ongoing monitoring system beginning on 03/25/2026 utilizing the established audit tool, which confirmed that no additional residents were affected, and no further incidents occurred during the initial audit period. The facility will continue monitoring through weekly audits for four consecutive weeks, followed by monthly audits for three months. These audits will include direct observation of staff practices, verification of compliance with personal device policies, and evaluation of adherence to HIPAA and privacy requirements. Audit findings will be documented using standardized tools and reviewed by the Director of Nursing, with results reported to the Quality Assurance and Performance Improvement (QAPI) Committee for analysis and trending. If any issues are identified, immediate corrective action will be implemented, including re-education and progressive discipline as appropriate. If no trends or repeat deficiencies are identified after the monitoring period, the facility will discontinue routine auditing and remove the issue from active QAPI monitoring. Dates when corrective action will be completed. 4/17/2026
Failure to Protect Resident Privacy by Opening Delivered Packages Without Consent
Penalty
Summary
The facility failed to ensure a resident’s privacy rights regarding personal mail and delivered packages, resulting in a breach of confidentiality for one resident (R1). The facility’s written policy on Mail/Package Screening stated that delivered items would be opened by the facility only upon written consent from the resident and acknowledged residents’ rights to send and promptly receive unopened mail and other letters, packages, and materials, including those delivered by means other than the U.S. Postal Service. During an interview, Resident R1 reported that facility staff, acting under the direction of a previous administrative staff person, were opening packages delivered to the resident without obtaining consent, and that the previous administrative staff person had told the resident that because the packages were not always delivered by the U.S. Postal Service, the resident did not have the right to receive them unopened. In a separate interview, the Nursing Home Administrator confirmed that Resident R1’s deliveries had been opened previously without the resident’s knowledge or permission, contrary to facility policy and the resident’s privacy rights. This deficiency was cited under 28 Pa. Code 201.14(a), Responsibility of licensee, based on the facility’s failure to follow its own policy and to protect the resident’s right to privacy of mail and delivered packages.
Privacy Breach When Wrong Discharge Medications and Instructions Given to Another Resident
Penalty
Summary
The facility failed to ensure the privacy and confidentiality of a resident's health information when discharge medications and paperwork for one resident were mistakenly given to another resident's representative. Resident #70, who was cognitively intact and required supervision with ADLs, was discharged on 09/30/25. At discharge, LPN #142 accidentally provided Resident #70's representative with Resident #71's medications and written discharge instructions instead of Resident #70's. Resident #71 had been admitted with diagnoses including cerebral infarction, seizures, and sepsis and had active physician orders for multiple medications, including Norvasc, aspirin, Biotin, Cozaar, folic acid, Keppra, Lipitor, methotrexate, metoprolol, polyethylene glycol, prednisolone eye drops, sennoside, and Synthroid. The error was not identified by facility staff until shift change, when the night shift nurse was unable to locate Resident #71's medications in the medication cart. The Administrator and DON reported that nursing staff realized the wrong medications and discharge instructions had been given to Resident #70 approximately two to three hours after the resident left the facility. Resident #70's representative later reported the incident to the police and confirmed that the facility had sent home another resident's medications and discharge instructions, and that none of those medications had been taken. Both the Administrator and Resident #70's representative confirmed that private health information for Resident #71 had been disclosed to Resident #70 and her representative, contrary to the facility's HIPAA policy, which states that the facility will protect the privacy and confidentiality of residents' individually identifiable health information.
Unauthorized Cellphone Recording of Resident Without Consent
Penalty
Summary
The facility failed to ensure the confidentiality and privacy of a resident’s personal and medical information when a CNA used a personal cellphone to record the resident without consent. The resident, admitted with diagnoses including Huntington’s disease, anxiety, and protein calorie malnutrition, was cognitively intact with a BIMS score of 13 and required one-person assistance with ADLs. During a chair exercise activity in the dining room, the CNA observed the resident lifting her leg above her head and took out her cellphone to take a picture/video of the resident. Two other CNAs stood nearby, watched the resident performing the exercises, and witnessed the recording being made but did not report it. The resident’s POA later confirmed that she had not given authorization for any photos or videos to be taken of the resident. Multiple staff interviews and document reviews corroborated that the recording occurred and that it involved the resident’s image being captured without prior authorization. The Activities Director and Business Office Manager both observed the three CNAs outside the dining room laughing and looking at a cellphone image of the resident with her leg pointed straight up. Review of the incident reports and staff statements confirmed that the recording was made on a personal cellphone in the work area. The Admissions Coordinator verified that there was no signed photo release authorization for the resident, and review of the facility’s Social Media Policy showed that employees are prohibited from using personal electronic devices in the work area without written approval and from taking or sharing resident photos or videos without prior written permission from the resident or authorized agent. Observation of the video by the Administrator and DON further confirmed that the resident had been recorded without authorization, constituting a breach of confidentiality and privacy.
Failure to Ensure Privacy During Incontinence Care
Penalty
Summary
The deficiency involves a failure to maintain privacy during incontinence care for Resident #3. The resident was admitted with multiple diagnoses including lung disease, heart failure, diabetes, anxiety, gastric reflux, hypertension, arthritis, and a gastric bleed. A quarterly MDS assessment dated 01/14/26 documented that the resident was cognitively intact, dependent on staff for personal hygiene, toileting, bathing, dressing, transfer, and mobility, and was always incontinent of bowel and bladder. Facility policy on Resident Rights stated that residents have the right to privacy and confidentiality, including personal privacy during personal care. On 03/25/26 at 8:58 A.M., a surveyor observed CNA #137 gather supplies and enter the double-occupancy room of Resident #3, closing the door while the resident’s roommate remained in the room in his wheelchair. Although a privacy curtain divided the room, the CNA did not draw the curtain at any time during the incontinence care. The CNA removed the resident’s adult brief, exposing his genital area for cleaning, and then had him roll to his left side toward the wall, which exposed his buttocks to his roommate while care continued. During an interview at 9:04 A.M. the same day, the resident stated that CNAs sometimes forget to pull the curtain during incontinence care and that it sometimes bothers him to be exposed to his roommate when present. CNA #137, present during the interview, acknowledged she had not pulled the privacy curtain.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release May 27, 2026) and official state health department websites — never guesswork.
Trusted by long-term care providers and associations.
