HIPAA Violation Due to Use of Personal Devices for PHI
Summary
The facility failed to comply with the Health Insurance Portability and Accountability Act (HIPAA) by not safeguarding resident-identifiable information. Clinical and non-clinical staff, including the attending physician, nurses, nursing managers, and administrative personnel, used their personal cell phones to exchange residents' Protected Health Information (PHI) and confidential biographical details. This included using an app called Signal to send group text messages containing sensitive information such as residents' full names, dates of birth, and clinical details. The staff, including the Licensed Vocational Nurse (LVN) and Director of Nursing (DON), admitted to using their personal devices for these communications, even when off duty, without ensuring the app's encryption status. The facility's administration, including the Administrator (ADM) and Clinical Consultant (CC), acknowledged the risk of a potential breach of residents' PHI due to the use of personal devices. The facility's California Employee Handbook allowed the use of personal mobile devices for facility-related business but required strict compliance with confidentiality policies. However, the staff's practice of accessing and exchanging PHI on personal devices, even when not on the clock, posed a significant risk of a privacy breach. The facility's Policy and Procedure on confidentiality, dated 10/2017, emphasized safeguarding residents' personal and medical records, which was not adhered to in this instance.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
The facility failed to keep complete and accurately documented clinical records for two residents. One resident had conflicting MD/NP notification orders for elevated blood glucose, with one order to notify for BS >250 and another sliding-scale insulin order directing a call if BS was >400. Another resident’s facesheet omitted insomnia and anxiety diagnoses even though the care plan and psych services note documented those conditions; the DON confirmed outside-provider diagnoses should have been included in the record and facesheet.
A resident receiving PT had multiple scheduled therapy sessions with no documentation in the service log matrix. The resident said therapy had been inconsistent, and the DON of Therapy acknowledged missed sessions without recorded reasons, stating the therapist should have documented why the sessions were not completed. The resident later said he had missed therapy when he was not feeling well and that the therapist had been sick once.
Failure to Document Ordered Skin Treatments: The facility failed to accurately document ordered skin treatments for a resident with a great toe condition. The MAR and TAR did not show the ordered Epsom salt soaks or triple antibiotic ointment, even though the DON, an LPN, the wound care nurse, and the resident stated the treatments were provided. Facility policy required all medications administered to be documented on the MAR immediately after administration.
Inaccurate Face Sheet Diagnosis Documentation: A resident’s face sheet failed to list pain as a diagnosis even though the H&P, care plan, and physician orders all reflected ongoing pain management, including scheduled morphine. The resident reported chronic pain from an old military back injury, and the MDS nurse acknowledged the diagnosis had not been entered on the face sheet and that diagnoses had not yet been audited against the H&P.
Incomplete influenza vaccination records were found for two residents. The EMR had no evidence that either resident was offered, received, or declined the 2025 influenza vaccine. Interviews showed an RN who had been assigned resident vaccination responsibilities destroyed the vaccine consents/records, and the HIM confirmed the influenza information was not entered into the EMR.
Incomplete documentation of elevated heart rate and medication administration. A resident with cerebral infarction, HTN, atherosclerotic heart disease, and inappropriate sinus tachycardia had a documented HR of 122 bpm, but the record did not show a reassessment or any documentation of symptoms later that day. The MAR also showed evening meds as not given because the resident had died, while an RN stated the meds were actually given earlier and the DON confirmed the record did not match the nurse’s statement.
Incomplete Clinical Records and Missing Diagnoses
Penalty
Summary
The facility failed to maintain complete and accurately documented medical records for 2 residents reviewed. For one resident with diagnoses including unspecified dementia, type 2 diabetes mellitus, and heart failure, the clinical record contained conflicting blood glucose notification orders: one order directed staff to notify the MD/NP if blood sugar was less than 90 or greater than 250, while another order for sliding-scale insulin stated to give 10 units if blood sugar was greater than 400 and call the MD. The resident also had a BIMS score of 6, indicating severe cognitive impairment, and the care plan identified diabetes mellitus. For another resident with vascular dementia, cerebral infarction, and paranoid personality disorder, the facesheet did not include diagnoses of insomnia and anxiety. The resident’s care plan stated the resident used anti-anxiety medications due to anxiety disorder, and a psychological services progress note listed diagnoses of primary insomnia and anxiety disorder. The DON confirmed that the diagnoses from outside providers should have been included in the facility clinical record and on the facesheet, and also confirmed that the facesheet was used to communicate the resident’s status to hospitals and other outside providers.
Missing Documentation for Scheduled Therapy Sessions
Penalty
Summary
The facility failed to document therapy sessions for one resident receiving rehabilitation services. The resident stated during interview that he wanted to know whether he would have therapy that day and reported that the physical therapist had been on vacation and that he had not received therapy in weeks. Review of the physician order showed a PT recertification order for treatment every day, one time per week for 60 days, including therapeutic exercise, therapeutic activity, gait training, and caregiver education for diagnosis R53. The resident’s service log matrix showed no documentation for therapy visits on 4/14/2026, 4/28/2026, and 5/19/2026. During interviews, the Director of Therapy acknowledged that the resident missed the listed dates and stated there was no documentation explaining why the sessions were not completed. The Director of Therapy said the resident was on the assignment board for functional maintenance and that, for whatever reason, if the resident refused or was not feeling well, it was not documented. The Director also stated the therapist was in Thailand and could not communicate about what happened, and that the therapist should have documented the reasons the therapy sessions were not completed. The resident later stated he had missed therapy once or twice because he was not feeling well and that his therapist had been sick once, with someone else sent in that time. The facility policy required resident care documentation to be maintained in a complete, timely, and orderly fashion.
Failure to Document Ordered Skin Treatments
Penalty
Summary
The facility failed to accurately document treatments ordered for Resident #112, who had a physician order dated 4/6/2026 for daily Epsom salt soaks for 14 days and application of triple antibiotic ointment to the great toe. Review of the resident’s Medication Administration Record and Treatment Administration Record for April 2026 did not show documentation of either the Epsom salt soaks or the triple antibiotic ointment to the great toe. During interviews, the DON stated the order existed but was not documented and that she could not find it in the treatment records, although staff said they had provided the care. An LPN stated she saw nursing provide the treatment and that the Epsom salt remained in the medication cart, adding that staff wrote the order but forgot to check off the box so it would appear on the MAR. The wound care nurse stated she was doing the treatments daily for Resident #112, and the resident confirmed staff provided the Epsom salt soaks and triple antibiotic ointment. The facility policy stated that the MAR is used to document all medications administered and that administration is documented immediately after it is given.
Inaccurate Face Sheet Diagnosis Documentation
Penalty
Summary
The facility failed to ensure that Resident #28’s medical record was accurately maintained in accordance with accepted professional standards because the resident’s face sheet did not include a diagnosis of pain. Record review showed the resident was a [AGE]-year-old male admitted on [DATE] and remitted on 7/23/2025 with diagnoses including bipolar disorder, dementia, and diabetes. The face sheet dated 6/3/26 did not list pain as a diagnosis, even though the resident’s history and physical dated 4/23/2025 documented pain, and the care plan had a focus on pain. Additional record review showed the resident’s June 2026 physician orders included Morphine Sulfate 30 mg, one tablet twice daily, and the resident stated he had experienced pain for years due to an old military back injury. The BIMS assessment completed 5/13/26 showed a score of 14, indicating intact cognition. The MDS nurse stated she was responsible for entering diagnoses on face sheets and that the pain diagnosis had not been entered, and she had not yet audited diagnoses against the corresponding histories and physicals. The ADON stated he had been in his role for two months and had not yet audited all prior admissions for face sheet accuracy. The facility policy stated documentation in the medical record would be objective, complete, and accurate.
Incomplete influenza vaccination records
Penalty
Summary
The facility failed to ensure complete clinical records for two residents reviewed for vaccination status. For one resident admitted on 07/29/25 and another admitted on 08/05/21, there was no evidence in the EMR that either resident was offered, received, or declined the 2025 influenza vaccine. The missing documentation was identified during clinical record review and involved the residents' vaccination status in the record. During interviews, the DON stated that RN4 destroyed the 2025 consents and records for the influenza vaccines, and the Administrator stated that RN4 destroyed all records associated with the 2025 influenza vaccination status. The HIM stated that the IP was typically responsible for resident vaccination data and that RN4 should have entered the influenza information into each resident's EMR, but this was not done. The DON also stated she had delegated resident vaccination responsibilities to RN4 when he was hired, and a facility policy on retention of medical records indicated discharged residents' medical records were to be retained for 7 years from the date of service.
Incomplete Documentation of Elevated Heart Rate and Medication Administration
Penalty
Summary
The facility failed to maintain complete and accurate medical records for one resident. Resident #2 was admitted with diagnoses including cerebral infarction, hypertension, atherosclerotic heart disease, and inappropriate sinus tachycardia. The resident’s heart rates from one period in the record ranged from 57 to 89 bpm, but the MAR documented a heart rate of 122 bpm at 9:00 AM on one date. Nursing progress notes, evaluations, and the vital sign section of the electronic medical record did not show that the resident’s heart rate was reassessed between 9:00 AM and 8:00 PM, and there was no documentation about whether the heart rate decreased or whether the resident had symptoms related to the elevated heart rate. The MAR also showed that at 8:00 PM the medications Atorvastatin, Famotidine, Metoprolol, and Acetaminophen were signed off as not given because the resident had passed away suddenly. However, a change in condition note documented that the resident was assessed with no pulse, no BP, and no respiration at 10:00 PM, with a code blue and 911 called, and paramedics continuing CPR until the resident was pronounced deceased at 10:36 PM. RN #12 stated she gave the evening medications at 9:00 PM but did not sign the MAR until later, and the DON confirmed that the medical record did not reflect the medications were given or the resident’s status as described in the nurse’s statement.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release July 29, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.