Privacy Breach Due to Unauthorized Video Recording
Summary
The facility failed to protect the privacy of a resident during personal care, resulting in a serious breach of confidentiality. A Certified Nursing Assistant (CNA) recorded a video of a resident in a vulnerable state, slouched in a shower chair with her pants around her ankles and her shirt pulled up, exposing her bare body. The video also showed a large amount of fecal matter on the floor. The CNA then posted this video on Snapchat, a social media platform, with a text overlay and emoji that demeaned the resident. This incident was reported to the facility by an anonymous caller, leading to an investigation. The resident involved had a diagnosis of Alzheimer's disease and was severely cognitively impaired, requiring maximum assistance for daily living activities. On the day of the incident, the resident experienced multiple episodes of bowel incontinence, which led to her being taken to the shower room for cleaning. During this time, the CNA recorded and shared the video without the resident's knowledge or consent, violating her privacy and dignity. Interviews with staff revealed that the CNA was known to frequently use her phone while at work, and other staff members were aware of the video being taken. The facility's policy on personal cell phone use was outdated, allowing staff to use their phones in certain areas, but not while providing personal care. The social media policy clearly stated that staff should not post any photographs or videos of residents without permission, which the CNA violated by sharing the video on Snapchat.
Removal Plan
- RN #502 and LPN #506 spoke with CNA #500 advising her of the allegation received that she posted a video on Snapchat and that they needed to see her phone. RN #502 reviewed the contents of the phone and observed the video of Resident #28. The nurses required CNA #500 to delete the video from the camera roll and the recently deleted section of her phone.
- RN #502 informed CNA #500 that she was suspended, and CNA #500 was escorted from the building.
- RN #502 assessed Resident #28. Resident #28's physician was notified of increased lethargy and loose stools and new orders to hold medications and monitor vital signs was obtained and family was updated. Resident #28 family was notified.
- The Administrator began re-education of staff in the facility regarding the social media policy, which included protecting the privacy of others, and personal cell phone use. She also interviewed staff to determine if they have witnessed or were aware of any staff taking pictures or videos of residents on their phones. There were approximately 22 as needed (PRN) staff who had not received education with a plan for staff to continue as PRN staff arrive on-site for their scheduled shifts.
- The Administrator asked CNA #500 if she had taken pictures prior or posted any videos of residents in the past. The CNA denied taking any other photos or videos of residents and no other pictures or videos involving other residents were noted on the employee's phone.
- The Administrator sent text messages to approximately 77 employees in regards to the facility social media policy, which included protecting the privacy of others, and then re-educated all employees again as they came into the facility per their schedule. Many employees worked PRN or worked one to two days a month and still required education.
- RN #511 provided re-education to 33 staff who arrived for their scheduled shift on this day on the facility social media policy, which included protecting the privacy of others, and personal cell phone.
- The Administrator began to complete audits during rounds for cell phone use. The Administrator made observations of staff on the units to ensure staff did not have cell phones out, were maintaining privacy and confidentiality during hands on care, and reviewed the cell phone audit sheets, which were completed by the floor nurses twice on each shift to monitor for staff cell phone use. The audit sheets included the date, time, unit location, whether cell phone use was observed, who was observed using their cell phone (if applicable), what corrective action was taken, and the initials of the nurse completing the form.
- Medical Director #512 was notified by Regional QA Nurse #503 of the incident involving Resident #28.
- A meeting was held with Regional QA Nurse #503, Clinical Director #513 and Medical Director #512 to discuss the incident, actions being taken by the facility, and how continued re-education and auditing/monitoring of staff cell phone use while on duty and privacy/confidentiality during care would continue daily at this time.
- CNA #500's employment was terminated.
- An AD HOC meeting via telephone conference with Medical Director #512, Director of Nursing (DON), the Administrator, and Regional QA Nurse #503 to notify Medical Director #512 of the State agency survey and Immediate Jeopardy situation. A discussion occurred related to on-going education of all staff, and the continuation of monitoring staff cell phone use and resident privacy/confidentiality during care.
- Signs were posted in resident care areas which included: no cell phone usage on the floor.
- All residents with a Brief Interview for Mental Status (BIMS) score of eight or higher were interviewed by Bookkeeper #515 revealed to Privacy/Confidentiality.
- The facility implemented a plan to continue to monitor/audit for cell phone use on the unit and ensure residents privacy was maintained during care. Audits/monitoring would be completed by the DON and/or designee by observation on the units for personal cell phone use and observation of privacy being maintained during resident care three times per day for five days a week on various shifts/times for three weeks and then three times per day on various shifts/times for three times a week for three weeks. All audits would be reviewed by the Quality Assurance and Performance Improvement (QAPI) committee to determine the need for continuation of audits.
- The DON and/or designee would interview five staff members every week for eight weeks on various shifts and in various departments on abuse policies, definitions, reporting and understanding of the facility abuse policy and social media policy. Interviews would be reviewed by the QAPI committee to determine the need for continued education.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
Failure to protect resident medical information on the 2B med cart. During a med pass, an RN left the cart unattended in the hallway with the computer screen open and displaying identifiable resident information, and later confirmed that anyone passing by could see residents' personal and confidential data.
An LPN on the Cardinal Unit left a laptop screen open and papers with resident personal information on top of the med cart outside a resident room, making the information visible to anyone passing by. The LPN confirmed the screen was not closed and the papers were left exposed, contrary to the facility policy for maintaining confidentiality during med administration.
A resident's door had a posted "Feeder" sign, and meal tickets for several residents were placed where they could be seen by the public on a hall. The sign and tickets contained resident-specific information, including names, room numbers, and dietary instructions, and staff confirmed the postings were used to direct feeding and meal service. The DON stated the postings were HIPAA and resident rights issues because they exposed PHI and affected resident dignity and privacy.
An LVN left 19 residents’ medical records tucked under a laptop on an unattended treatment cart in a hallway. The records included names, DOBs, diagnoses, treatment plans, and several wound photos, and the LVN stated this violated HIPAA and residents’ privacy and confidentiality rights.
Failure to Protect Resident Confidential Information: A resident’s shower sheet containing personal health information was left unattended on the nurse counter in full view at the 400-nurse station. The ADON, Administrator, and DON all identified the incident as a HIPAA and privacy violation, and CNA B stated she had no reason for leaving the information uncovered despite prior HIPAA training.
Opened Resident Mail: Two cognitively intact residents did not receive unopened correspondence. One resident received VA mail that had been opened and taped shut, and staff and family still had the envelope. For another resident, staff opened and sorted cards and letters from the public, said some were inappropriate, and did not ask the resident whether he wanted the mail opened or read to him. Staff acknowledged residents have the right to receive mail unopened, and facility records showed no care plan focus related to mail privacy.
Failure to Protect Resident Medical Information
Penalty
Summary
The facility failed to maintain the confidentiality of residents' medical information on one of five medication carts, the 2B Medication Cart. During a medication pass observation, the Registered Nurse left the medication cart unattended in the hallway with the computer screen open and displaying resident information. In an interview shortly afterward, the RN confirmed that the cart had been left unattended with the screen open and that identifiable resident information could be seen by anyone passing by, resulting in a failure to keep residents' personal and confidential medical information private.
Resident Information Left Visible on Medication Cart
Penalty
Summary
The facility failed to maintain the confidentiality of residents' medical information on one of five units, the Cardinal Unit. The facility policy on Medication Administration/Disposition stated that confidential resident health information is to be maintained during medication administration, with the electronic health record in privacy mode when the nurse is away from the medication cart and paper documentation kept in a closed binder. During an observation on the Cardinal Unit, an LPN left the laptop screen open and papers displaying resident personal information on top of the medication cart outside a resident room, making the information visible to anyone passing by. In an interview shortly afterward, the LPN confirmed that the laptop screen was not closed and that papers with resident personal information were left on the medication cart.
Confidential Resident Information Posted in Public View
Penalty
Summary
The facility failed to protect the confidentiality of resident health information when a sign reading "Feeder" was posted on a resident's door. The resident's family member, who was the resident's representative and power of attorney due to dementia and Alzheimer's disease, reported seeing the sign taped to the door of the resident's private room and showed a screenshot of the posted sign. The family member told an LVN that the sign was demeaning and degrading, and the LVN later confirmed that the sign had been on the resident's door and that she removed it. The facility also failed to keep meal ticket information private for six residents on the 700 Hall. During observation, six lunch meal tickets were seen posted behind the name plate of two residents' rooms, and the tickets included each resident's name, room number, and dietary notes with special instructions. The tickets were visible to the public and anyone with access to the hall. CNA staff stated that residents on the hall ate in their rooms and that meal tickets were placed on the wall behind the name plate so kitchen staff could serve the correct meals. Interviews with CNA staff and the LVN showed that staff were aware the meal tickets contained resident information and were used to guide meal service, but the tickets were still placed where they could be seen by others. The DON stated that a sign posted on a resident's door with medical information would be a HIPAA violation and a resident rights issue, and that meal tickets in public view would also violate HIPAA. The facility policy stated that PHI should not be intentionally or unintentionally disclosed and that written PHI should not be easily accessible to unauthorized staff or visitors.
Unattended resident records left under laptop on treatment cart
Penalty
Summary
The facility failed to protect the privacy and confidentiality of 19 residents’ medical records when LVN 8 left the records tucked under a laptop computer on top of an unattended treatment cart in the hallway between Nursing Station 1 and a resident room. During the tour, surveyors observed two binder-clipped stacks and one loose stack of papers under the laptop computer on Treatment Cart A. When the surveyor looked at the documents, the papers were identified as medical records for Residents 7, 9, 13, 23, 26, 27, 33, 39, 45, 53, 55, 57, 60, 65, 82, 101, 106, 107, and 129. The records contained resident names, dates of birth, diagnoses, and treatment plans. Several of the records also contained black-and-white photographs of wounds, including those for Residents 7, 23, 45, 55, 57, 65, 106, and 107. The loose pages included nursing assignments for the same day. LVN 8 stated the records were placed under the laptop because they were believed to be safer there and later stated that leaving them there unattended violated HIPAA and residents’ rights to privacy and confidentiality. The residents whose records were exposed had a range of conditions, including dementia, severely impaired cognition, fluctuating capacity, dysphagia, diabetes, Parkinson’s disease, hemiplegia, malnutrition, and mobility limitations. Some residents were documented as lacking capacity to understand and make medical decisions, while others had severely impaired cognition or fluctuating capacity. Facility staff interviewed after the observation stated that medical records should not be left under a laptop computer on a treatment cart and that such records were accessible to anyone in the hallway.
Failure to Protect Resident Confidential Information
Penalty
Summary
The facility failed to protect the confidentiality of personal health care information for 1 of 8 residents reviewed. On 07/30/2026 at 10:15 AM, during observation of the 400-nurse station, a shower sheet for Resident #1 was left unattended for approximately three minutes in full view on the nurse counter. The shower sheet was used to document scars, skin abnormalities, or wounds, and it contained the resident’s personal, private information. Record review showed Resident #1 was an [AGE]-year-old female admitted on [DATE] with diagnoses of paralytic ileus, essential hypertension, and lymphedema. During interviews, the ADON stated staff were trained on HIPAA and resident rights and acknowledged that leaving resident information in the open could allow others to see wound information and affect privacy. The Administrator stated leaving the shower sheet open at the nurse station was a HIPAA violation and a dignity violation. The DON also stated leaving patient information open on the desk and leaving the desk was a HIPAA violation and privacy concern. CNA B stated she had no reason for leaving the resident’s personal information uncovered and said she had been trained to turn shower sheets over or put them in her pocket.
Opened Resident Mail
Penalty
Summary
The facility failed to allow two residents to receive unopened mail at the facility. For Resident #35, record review showed a male resident with diagnoses including COPD, hypertension, age-related physical debility, and cognitive communication deficit, while his annual MDS assessment showed a BIMS score of 15, indicating he was cognitively intact. His care plan contained no focus or intervention related to his ability to receive mail in the facility. Resident #108 was also cognitively intact, with a BIMS score of 14, and had diagnoses including Type 2 diabetes, Parkinsonism, and PTSD; his care plan likewise contained no focus or intervention related to receiving mail in the facility. Resident #108 stated he received a piece of mail from the VA that had been opened and taped shut, and his family member had the opened envelope. The envelope was observed and appeared to have been opened with a letter opener and then taped. The REC stated that she and the security guard handled mail, that she sorted mail when it was received, and that mail addressed to residents was opened and then sent to the corporate office or to family members. She also stated that residents have the right to receive mail unopened and that she did not understand why Resident #108’s mail was opened. For Resident #35, staff stated that cards and letters from the public were opened and sorted because some were considered inappropriate, and that staff did not speak with Resident #35 before opening them. AA R stated the resident was not asked whether he wanted the cards opened in front of him or filtered, and acknowledged that residents have the right to open their own mail. Resident #35 stated he received cards that were opened. The AD stated staff had a meeting and said the cards must be read to him, while the ADM stated the resident should have made the decision about whether to read the cards and that one card was filtered out. The FM stated the facility had permission to do everything they did and that the facility read a bad card and the FM told the facility not to read it to him.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release October 8, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.