HIPAA Violation Due to Use of Personal Devices for PHI
Summary
The facility failed to comply with the Health Insurance Portability and Accountability Act (HIPAA) by not safeguarding resident-identifiable information. Clinical and non-clinical staff, including the attending physician, nurses, nursing managers, and administrative personnel, used their personal cell phones to exchange residents' Protected Health Information (PHI) and confidential biographical details. This included using an app called Signal to send group text messages containing sensitive information such as residents' full names, dates of birth, and clinical details. The staff, including the Licensed Vocational Nurse (LVN) and Director of Nursing (DON), admitted to using their personal devices for these communications, even when off duty, without ensuring the app's encryption status. The facility's administration, including the Administrator (ADM) and Clinical Consultant (CC), acknowledged the risk of a potential breach of residents' PHI due to the use of personal devices. The facility's California Employee Handbook allowed the use of personal mobile devices for facility-related business but required strict compliance with confidentiality policies. However, the staff's practice of accessing and exchanging PHI on personal devices, even when not on the clock, posed a significant risk of a privacy breach. The facility's Policy and Procedure on confidentiality, dated 10/2017, emphasized safeguarding residents' personal and medical records, which was not adhered to in this instance.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
Incomplete and inaccurate medication orders were found for two residents after record review and staff interviews. One resident’s Toujeo insulin glargine order listed conflicting clinical indications, with staff stating the order had been mistyped, and another resident’s hydroxyzine HCl PRN anxiety order omitted the dose even though the resident had previously been receiving 25 mg tablets.
Missing discharge and transfer orders in resident records: The DON confirmed that discharge or transfer orders were not obtained or documented for multiple residents. One resident was discharged back to an ALF in stable condition after insulin instructions were reviewed, another had a note stating the MD ordered hospital transfer but the order was not completed in the record, and a third had respiratory distress and altered mental status with an MD order to send to the ER, but no transfer order was found. The facility policy required a physician order for emergency transfer or discharge.
Incomplete death documentation: A resident’s record lacked progress notes and an incident report describing what occurred when the resident passed away in the facility. Although the chart included the POLST, death record, MDS, and an encounter note stating CPR was started and 911 was called, facility leaders verified there were no documents covering the morning of the death.
A resident with depression, chronic pain, and COPD had an order for PRN oxycodone 10 mg. The medication was signed out on the narcotic accountability record multiple times, but there was no matching MAR documentation. The LVNs stated they administered the doses but failed to chart them on the MAR due to human error, and the DON confirmed the documentation was incomplete.
Incomplete Documentation of Care Conference Participation: The facility failed to accurately document whether two residents or their responsible parties were informed of, attended, or declined quarterly care plan conferences. One resident had COPD, seizures, dysphagia, hypotension, and cognitive impairment, while the other had AFib, HF, HTN, hypothyroidism, hyperlipidemia, dementia, and depression. Care conference forms showed staff attendance, but the sections for resident or RP participation were left blank, and an LVN acknowledged she did not document the invitations or attendance status in the EMR.
Incomplete Documentation of Chronic Scalp Wound: A resident with a chronic scalp lesion/wound had inconsistent and incomplete skin/wound documentation in the EMR. Weekly skin assessments sometimes omitted the lesion entirely, and when it was documented, key details such as size, shape, color, and drainage were missing. The record also lacked documentation of a comprehensive assessment after maggots were found and removed from the wound, and staff acknowledged the chart did not provide a complete picture of the wound status or care provided.
Incomplete and inaccurate medication orders in resident records
Penalty
Summary
The facility failed to ensure a physician order was clarified for its clinical indication and medication dosage, resulting in inaccurate documentation in the resident medical record. The deficiency was identified through record review and staff interviews and involved 2 of 2 residents reviewed. The facility’s documentation policy stated that the resident medical record should be accurate, objective, and clinically relevant. One resident was admitted and readmitted with diagnoses including morbid obesity with alveolar hypoventilation and diabetes. A physician order listed Toujeo SoloStar insulin glargine 300 units/ml as 120 units subcutaneously one time a day related to morbid obesity with alveolar hypoventilation, and also listed Toujeo SoloStar insulin glargine 300 units/ml as 120 units subcutaneously at bedtime related to type 2 diabetes. During interview, the CRN stated the evening dose was for diabetes and the morning dose was for obesity, then later stated the insulin glargine order should have been for diabetes and not obesity and had been mistyped by the nurse. Another resident was admitted and readmitted with diagnoses including quadriplegia, depression, and anxiety disorder. That resident’s MAR showed an order for hydroxyzine HCl every 8 hours as needed for anxiety, but the order did not include a dose. The CNO confirmed the dose was missing and stated the resident had previously been receiving hydroxyzine 25 mg tablets and the person entering the order did not catch the 25 mg.
Missing discharge and transfer orders in resident records
Penalty
Summary
The facility failed to ensure that discharge or transfer orders were present in the medical records for 3 of 4 residents reviewed for discharge. Resident #120 was admitted with diagnoses including type I diabetes mellitus with hyperglycemia, gastroparesis, schizophrenia, depression, hypothyroidism, dysphagia, anemia, hypertension, cognitive communication deficit, and long-term insulin use. A health status note documented that the resident was discharged back to an ALF in stable condition, with discharge instructions provided and explained, insulin administration reviewed, and transportation arranged by facility staff; however, the DON stated that no discharge orders were obtained. Resident #3 was admitted with diagnoses including hyperkalemia, gastrostomy care, hypertensive chronic kidney disease, acute kidney failure, type 2 diabetes mellitus with diabetic chronic kidney disease, COPD, atherosclerotic heart disease, anemia in chronic kidney disease, and muscle weakness. A progress note stated that the MD reviewed labs and ordered the resident sent to the hospital, but the record did not contain the completed order, and the DON stated the paperwork had been completed for discharge but no physician order was written. Resident #118 was admitted with diagnoses including metabolic encephalopathy, type 2 diabetes mellitus, hypertensive heart disease with heart failure, dysphagia following CVA, and muscle weakness; a progress note documented respiratory distress and altered mental status, with the MD notified and ordered the resident sent to the ER, but the physician orders did not show an order to transfer the resident from the facility to the hospital. The facility policy required a physician order for emergency transfer or discharge and for anticipated discharge to the community.
Incomplete Death Documentation
Penalty
Summary
The facility failed to maintain a complete, accurate, and readily accessible medical record for one resident, R29, related to the resident’s death in the facility. R29’s hospital discharge summary showed discharge to the nursing home in stable condition, and the POLST indicated attempt CPR. The death record listed the date of death, and the MDS assessment indicated death in facility, but the progress notes did not document the resident’s death or what occurred. The encounter note stated that a call was received that R29 had passed away that morning, CPR was started, and 911 was called. When the state agency requested the incident report and medical record items related to the day of death, the facility did not have an incident report or progress note documenting what occurred that morning. During interview, the administrator and VPS-A and VPS-B verified the facility did not have documents of what occurred the morning of R29’s death.
Incomplete Documentation of Controlled Substance Administration
Penalty
Summary
The facility failed to ensure that Resident #1’s medical record was accurately documented and complete when controlled substance administration was signed out on the narcotic accountability record but not documented on the MAR. Resident #1 was admitted with diagnoses including depression, chronic pain, and COPD, and had a BIM'S score of 15 indicating intact cognition. The care plan included administering medications as ordered, and the June 2026 physician orders included Oxycodone 10 mg every 6 hours as needed for pain. Record review showed that Oxycodone 10 mg was signed out on the controlled substance administration log on 6/15/2026 at 4:30 AM, 10:30 AM, and 4:30 PM, but there was no corresponding documentation on the MAR for those administrations. During interview, the resident stated he was not 100% sure whether he received the medication at those times. The LVN staff assigned to those shifts stated they administered the Oxycodone as recorded on the controlled substance log but did not document it on the MAR due to human error, and the DON confirmed that nursing staff had not been recording controlled substances on the MAR after signing them out on the narcotic count record.
Incomplete Documentation of Care Conference Participation
Penalty
Summary
The facility failed to maintain medical records that were complete and accurately documented for 2 residents reviewed for documentation. For both residents, the electronic medical record did not show whether the resident or the responsible party had been informed of, attended, declined, or otherwise participated in the quarterly care conference meetings. The deficiency was identified through record review and interviews, and the Care Conference & DC Case Management Evaluation forms did not reflect resident or responsible party attendance status. Resident #9 was a female with diagnoses including COPD, seizures, dysphagia, hypotension, and major depressive disorder. Her MDS showed unclear speech, moderate cognitive impairment with a BIMS score of 8, wheelchair use, and varying levels of assistance with eating, dressing, transfers, bed mobility, and toileting. Her care plan included impaired cognitive function and psychosocial well-being focus areas with interventions to provide opportunities for the resident and family to participate in care. The care conference evaluations reviewed for this resident showed that conferences were held in person with staff attendance, but the section for resident or responsible party participation was not completed, and no evaluation was available for two of the expected quarterly conferences. Resident #24 was a female with diagnoses including atrial fibrillation, heart failure, hypertension, hypothyroidism, hyperlipidemia, dementia, and major depressive disorder. Her MDS showed intact cognition with a BIMS score of 15 and no vision, hearing, or communication deficits, along with dependence in several activities of daily living. Her care plan included falls, altered cardiovascular status, discharge planning, and activity involvement, with interventions involving the resident or family. The care conference evaluations reviewed for this resident showed in-person conferences attended by facility staff, but the form did not document whether the resident or responsible party attended, refused, or were invited and absent. During interview, the resident stated she was aware of care plan meetings but could not recall being invited every 90 days and said she chose not to attend because little changed. An LVN acknowledged she invited the resident and sent invitations to the responsible party but did not document that information in the EMR, and the DON stated the form was expected to be completed in its entirety.
Incomplete Documentation of Chronic Scalp Wound
Penalty
Summary
The facility failed to maintain complete and accurate medical records for a resident with a chronic scalp lesion/wound. Weekly skin assessments from 6/2/25-6/29/25 and 11/2/25-11/16/25 contained no documentation of the resident’s scalp lesion/wound, while assessments from 7/6/25-9/28/25 and 12/14/25-6/14/26 documented the presence of the lesion/wound but did not include complete details such as size, shape, color, or drainage characteristics. The resident’s electronic medical record also showed no documentation that a comprehensive assessment of the chronic scalp lesion/wound was completed after maggots were identified and removed from the lesion/wound on 6/12/26. During interviews, staff stated that weekly skin assessments were completed, that nursing staff were expected to document skin and wound assessments, and that documentation should include at minimum a description of the skin concern, wound description or measurements, shape, color, drainage, and odor. Staff acknowledged the record did not contain all information needed to provide a complete picture of the resident’s wound status and related care provided.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release August 26, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.