Privacy Breach Due to Unauthorized Video Recording
Summary
The facility failed to protect the privacy of a resident during personal care, resulting in a serious breach of confidentiality. A Certified Nursing Assistant (CNA) recorded a video of a resident in a vulnerable state, slouched in a shower chair with her pants around her ankles and her shirt pulled up, exposing her bare body. The video also showed a large amount of fecal matter on the floor. The CNA then posted this video on Snapchat, a social media platform, with a text overlay and emoji that demeaned the resident. This incident was reported to the facility by an anonymous caller, leading to an investigation. The resident involved had a diagnosis of Alzheimer's disease and was severely cognitively impaired, requiring maximum assistance for daily living activities. On the day of the incident, the resident experienced multiple episodes of bowel incontinence, which led to her being taken to the shower room for cleaning. During this time, the CNA recorded and shared the video without the resident's knowledge or consent, violating her privacy and dignity. Interviews with staff revealed that the CNA was known to frequently use her phone while at work, and other staff members were aware of the video being taken. The facility's policy on personal cell phone use was outdated, allowing staff to use their phones in certain areas, but not while providing personal care. The social media policy clearly stated that staff should not post any photographs or videos of residents without permission, which the CNA violated by sharing the video on Snapchat.
Removal Plan
- RN #502 and LPN #506 spoke with CNA #500 advising her of the allegation received that she posted a video on Snapchat and that they needed to see her phone. RN #502 reviewed the contents of the phone and observed the video of Resident #28. The nurses required CNA #500 to delete the video from the camera roll and the recently deleted section of her phone.
- RN #502 informed CNA #500 that she was suspended, and CNA #500 was escorted from the building.
- RN #502 assessed Resident #28. Resident #28's physician was notified of increased lethargy and loose stools and new orders to hold medications and monitor vital signs was obtained and family was updated. Resident #28 family was notified.
- The Administrator began re-education of staff in the facility regarding the social media policy, which included protecting the privacy of others, and personal cell phone use. She also interviewed staff to determine if they have witnessed or were aware of any staff taking pictures or videos of residents on their phones. There were approximately 22 as needed (PRN) staff who had not received education with a plan for staff to continue as PRN staff arrive on-site for their scheduled shifts.
- The Administrator asked CNA #500 if she had taken pictures prior or posted any videos of residents in the past. The CNA denied taking any other photos or videos of residents and no other pictures or videos involving other residents were noted on the employee's phone.
- The Administrator sent text messages to approximately 77 employees in regards to the facility social media policy, which included protecting the privacy of others, and then re-educated all employees again as they came into the facility per their schedule. Many employees worked PRN or worked one to two days a month and still required education.
- RN #511 provided re-education to 33 staff who arrived for their scheduled shift on this day on the facility social media policy, which included protecting the privacy of others, and personal cell phone.
- The Administrator began to complete audits during rounds for cell phone use. The Administrator made observations of staff on the units to ensure staff did not have cell phones out, were maintaining privacy and confidentiality during hands on care, and reviewed the cell phone audit sheets, which were completed by the floor nurses twice on each shift to monitor for staff cell phone use. The audit sheets included the date, time, unit location, whether cell phone use was observed, who was observed using their cell phone (if applicable), what corrective action was taken, and the initials of the nurse completing the form.
- Medical Director #512 was notified by Regional QA Nurse #503 of the incident involving Resident #28.
- A meeting was held with Regional QA Nurse #503, Clinical Director #513 and Medical Director #512 to discuss the incident, actions being taken by the facility, and how continued re-education and auditing/monitoring of staff cell phone use while on duty and privacy/confidentiality during care would continue daily at this time.
- CNA #500's employment was terminated.
- An AD HOC meeting via telephone conference with Medical Director #512, Director of Nursing (DON), the Administrator, and Regional QA Nurse #503 to notify Medical Director #512 of the State agency survey and Immediate Jeopardy situation. A discussion occurred related to on-going education of all staff, and the continuation of monitoring staff cell phone use and resident privacy/confidentiality during care.
- Signs were posted in resident care areas which included: no cell phone usage on the floor.
- All residents with a Brief Interview for Mental Status (BIMS) score of eight or higher were interviewed by Bookkeeper #515 revealed to Privacy/Confidentiality.
- The facility implemented a plan to continue to monitor/audit for cell phone use on the unit and ensure residents privacy was maintained during care. Audits/monitoring would be completed by the DON and/or designee by observation on the units for personal cell phone use and observation of privacy being maintained during resident care three times per day for five days a week on various shifts/times for three weeks and then three times per day on various shifts/times for three times a week for three weeks. All audits would be reviewed by the Quality Assurance and Performance Improvement (QAPI) committee to determine the need for continuation of audits.
- The DON and/or designee would interview five staff members every week for eight weeks on various shifts and in various departments on abuse policies, definitions, reporting and understanding of the facility abuse policy and social media policy. Interviews would be reviewed by the QAPI committee to determine the need for continued education.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
A facility failed to ensure residents promptly received personal mail on Saturdays for 3 of 3 confidential residents reviewed. Residents stated they often had to wait until Monday for mail, while the Activity Director, BOM, DON, and Administrator gave conflicting accounts of who was responsible for weekend mail distribution and acknowledged there was no system in place to ensure Saturday delivery.
A GCA used a cellphone to video record a resident during ADL care in the resident’s room without consent while an NA was providing care. The resident was cognitively impaired, dependent for ADLs, and had behavioral symptoms and care rejection. The GCA said she believed she needed proof of what she witnessed, while the NA said she did not know she was being recorded. Facility leaders confirmed recording residents was prohibited and that the recording occurred during care.
Clinical Information Shared Without Permission: A resident admitted with altered mental status, hallucinations, and possible dementia had transfer referrals sent to other facilities by the SW without the resident’s or POA’s permission. The resident’s record showed a BIMS score of 13, while the care plan and elopement assessment documented cognitive concerns and a desire to go home. The family stated they had not requested referrals and were already arranging memory care placement, and the POA said she did not authorize sharing the resident’s information.
PHI Left Exposed on Medication Cart: An open laptop on an unattended med cart displayed a resident’s EHR, and multiple papers with residents’ PHI were left visible on top of the cart, including diet orders, med lists, appointment information, physician notes, and personal effects records. Facility leadership stated resident information and computer screens should be secured and not left visible or unattended.
A resident's care plan was posted in another resident's room, and a family member observed the wrong care plan inside a closet door and reported it to the DON. The family member said the resident's own care plan had been posted earlier, then went missing and was replaced with another resident's care plan. The DON verified the issue and stated the care plan should be in the right room for the right resident.
A caregiver violated a resident’s privacy during incontinence care by using a personal cell phone to contact an outside CNA who was not employed by the facility while the resident was present. Staff observed the caregiver on a video call, and a written statement noted the camera was turned toward the resident’s buttocks area and the mess on the floor.
Failure to Deliver Resident Mail on Saturdays
Penalty
Summary
Keep residents' personal and medical records private and confidential was deficient because the facility did not ensure residents promptly received their mail on Saturdays for 3 of 3 confidential residents reviewed for resident rights to receive personal mail. During a confidential group interview, 3 residents stated they did not always receive mail on Saturdays and had to wait until Monday when the Activity Director passed it out. During interviews, the Activity Director stated mail should be delivered to residents on Saturdays and that the facility had previously been cited for not delivering mail on Saturdays, with the solution being for the RN Supervisor to deliver mail on Saturday. The Business Office Manager stated weekend mail was placed in a locked box outside her door, that she was the only one with a key, and that there were times she gave Saturday mail to the Activity Director to distribute. The DON stated she was unaware residents were not receiving mail on Saturdays but expected mail to be delivered then, and the Administrator stated there was no system in place to ensure residents received mail on Saturdays.
Unauthorized Video Recording During Resident Care
Penalty
Summary
The facility failed to provide personal privacy during ADL care when a GCA used a cellphone to video record a resident while care was being provided in the resident’s room, without resident representative consent. The resident involved had diagnoses including diffuse traumatic brain injury without loss of consciousness and vascular dementia with mood disturbance. The admission MDS indicated the resident was cognitively impaired, had physical and verbal behavioral symptoms directed toward others, rejected care, and was dependent on others for ADLs. According to the investigative summary, staff reported the resident was resistant to care and combative at times. On the day of the incident, an NA asked the GCA to witness care because of the resident’s known behaviors. The GCA entered the room and sat behind the NA while the NA provided care. After the care was completed, the GCA began video recording while the NA was dressing the resident into a gown. The NA stated she did not know the GCA was recording and did not ask her to record the care. The GCA stated she recorded the care because she believed she needed proof of what she witnessed and thought that was what the NA wanted her to do. She also stated she did not tell the NA she was recording and later deleted the video. The DON, Scheduler, Nurse, and Administrator all confirmed that video recording or taking pictures of residents was not allowed in the facility and that the recording occurred during resident care in the room. The report also states the GCA had received orientation training on protecting patient privacy and HIPAA.
Clinical Information Shared Without Permission
Penalty
Summary
The facility failed to keep a resident’s clinical information private and confidential when the social worker sent transfer referrals to other nursing facilities without the resident’s and responsible party’s permission. The resident was admitted from the hospital with diagnoses including altered mental status, hallucinations, and type 2 diabetes mellitus without complications. Her admission MDS showed a BIMS score of 13, indicating she was cognitively intact, and the initial care plan noted anxiety medication use and impaired cognitive function or thought processes related to a new environment. The resident’s elopement assessment also documented cognitive impairment or a diagnosis associated with impaired judgment or wayfinding, a history of elopement or attempted elopement, family concern about unsafe leaving, and that the resident had verbally expressed a desire to go home. Hospital discharge notes documented suspected dementia with psychosis, neurology consultation, continued low-dose Seroquel and as-needed antipsychotics, possible Lewy body dementia, and a note about dependence counseling and weaning off a medication. The social worker documented that transfer referrals were sent to area nursing facilities as per the resident’s wishes. During interview, the family representative stated the resident and family had not requested referrals to other facilities and had already been arranging placement at a memory care facility, waiting for that facility’s room to be remodeled. The family representative also stated they were told the resident could not stay at the facility and that no discharge notice was given. Facility interviews showed the admission and discharge process was discussed at admission and during the 72-hour care plan meeting. The administrator, ADON, MDS coordinator, operations manager, and social worker stated the team discussed discharge planning, alternate placement, and that the resident wanted to move. The social worker stated he used nurses to translate and confirmed through nursing notes that the resident wanted to move, while also stating he doubted the resident had dementia because of the BIMS score. The POA stated she did not ask for referrals to be sent to other facilities and did not believe it was right that the resident’s information had been shared without permission. The facility’s discharge planning policy stated the discharge process should involve the resident and representative and document relevant resident information in the clinical record.
PHI Left Exposed on Unattended Medication Cart
Penalty
Summary
The facility failed to safeguard protected health information (PHI) for 4 of 4 residents identified in the report. During observation of the 300 hall, a laptop computer was left open on an unattended medication cart and displayed one resident’s electronic health record. In the same observation, multiple documents containing residents’ PHI were left exposed on top of the cart, including a diet order communication form with a room number, a medication list, appointment information, a physician appointment summary with physician notes, and an inventory of personal effects form for four different residents. Record review of the facility’s privacy policy stated that confidential or protected health information on desks or in other publicly accessible areas must be secured in designated work areas or locked storage, and computer screens must be locked when staff step away. During interviews, the Unit Manager stated that computer screens should be locked and patient information should not be left visible, the Corporate Director of Nursing stated all resident information must be secured and that staff are responsible for doing so, and the Administrator stated resident information should be secured by the person handling it and that leaving it visible and unattended could allow unauthorized access.
Resident Care Plan Posted in Wrong Room
Penalty
Summary
The facility did not ensure the security and privacy of medical information for one resident when R7's care plan was posted in R1's room. The facility's Resident Rights document states residents have the right to confidentiality concerning personal and medical information, and the HIPAA document prohibits leaving resident information accessible to people who have no right to see it. A family member observed R7's care plan posted inside the door of R1's closet and reported that it showed R7's name and care plan content. The family member stated R1's care plan had been posted previously, but it went missing and R7's care plan was posted instead. The DON later verified that another resident's care plan had been posted in R1's room and stated that a care plan should be in the right room for the right resident.
Privacy Breach During Incontinence Care
Penalty
Summary
Keep residents' personal and medical records private and confidential was violated when a caregiver used a personal cell phone during incontinence care for a resident who had an episode of bowel incontinence. During the care, the caregiver contacted a CNA who was not employed by the facility to ask for advice about how to handle the resident's resistance to care, allowing an unauthorized person to be involved while the resident was present. Facility records and staff statements showed the caregiver was observed on a phone call while performing incontinence care, and the call was identified as a video call because the camera was on. A written statement noted the caregiver turned the camera toward the resident's buttocks area and the mess on the floor. In an interview, the caregiver stated she called someone for advice on caring for someone resistant to care and identified the person as a CNA who was not employed by the facility; she denied that the call was a video call.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release August 26, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.