Failure to Safeguard Resident Privacy and Confidential Health Records
Summary
The facility failed to protect the privacy and confidentiality of residents' electronic health records (EHR) and personal information. During a survey, it was observed that a note containing information about a resident's authorized visitors and instructions for staff was posted on the computer screens of two medication carts. This note was visible to anyone passing by, thereby exposing confidential resident information. Additionally, during medication administration, the electronic medication administration record (EMAR) for a resident was left open and unattended on a computer screen, making the resident's medical information accessible to unauthorized individuals. Staff interviews confirmed these lapses in privacy. A registered nurse admitted to forgetting to lock the computer screen before leaving the medication cart to administer medications, acknowledging awareness of the requirement to secure the screen when not present. The Director of Nursing (DON) explained that the notes regarding visitor restrictions were intended to inform all staff, including PRN nursing staff, about specific instructions for a resident with challenging family dynamics. However, the notes were supposed to be flipped to the blank side when not in use, but this protocol was not followed, resulting in the exposure of resident information. The facility's own policy on resident rights and confidentiality was reviewed and found to require the protection of personal privacy and confidentiality of records. Despite this policy, the observed actions and inactions by staff led to a failure to safeguard residents' confidential information, as evidenced by the visible notes and unlocked EMAR screens on medication carts. At the time of the survey, there were 44 residents in the facility.
Plan Of Correction
1. Resident #23 posted information was immediately removed on , and a search of the common facility areas was conducted to ensure that no other resident information was visible to outside sources, no other issues were found. 2. Medication carts and computer were checked for identifiable resident information and no other issues were found. 3. The DON or designee will educate current staff to ensure that personal and/or confidential information is safeguarded. 4. HR will be responsible for training new hires on measures to safeguard information and HIPAA compliance. 5. On all departments were re-educated by the DON on the importance of residents' rights to privacy to ensure that residents' names are kept confidential and not posted. 6. The nurse on cart B who left the computer screen open unattended was re-educated by DON on the importance of locking his screen when moving away from the cart. 7. On an in-service was held by the DON with all the nurses on confidentiality and privacy of residents' information related to safeguarding personal and confidential information. 8. Nursing supervisor will monitor for compliance daily and Director of Nursing or designee will make random checks weekly to ensure that residents' rights to confidentiality and privacy are not being violated for the next 3 months. 9. Findings will be reported monthly in the QA meeting until substantial compliance has been determined, to ensure compliance has been achieved.
Penalty
The facility failed to protect residents' privacy by leaving computer screens unlocked and unattended, displaying resident information. An RN and an LPN were involved in separate incidents where computer screens were left open, violating the facility's privacy policy. The policy requires all patient information to be confidential and stored securely, with access restricted to authorized personnel.
The facility failed to protect residents' privacy, with observations of unattended paperwork containing resident information left visible in public areas. An LPN and the ADON acknowledged the breaches, confirming that such information should not be visible or unattended. The DON stated that measures are in place to safeguard residents' information.
Privacy Breach Due to Unattended Computer Screens
Penalty
Summary
The facility failed to ensure the privacy of residents' information, as evidenced by observations of unlocked and unattended computer screens displaying resident information. On two separate occasions, surveyors observed computer screens left unlocked and unattended, with resident information visible. The first incident occurred at the East side medication cart, where a Registered Nurse (RN) left the screen unlocked while attending to other duties. The RN acknowledged the oversight, attributing it to being preoccupied with finding a supervisor for the surveyor. The second incident was observed at the East side nursing station, where another computer screen was left unlocked and unattended, displaying resident information. A Licensed Practical Nurse (LPN) was informed of the situation by the surveyor and promptly locked the screen, indicating that another staff member had left it open. These observations highlight a breach in the facility's policy to protect patient privacy and confidentiality, as outlined in their Patient Privacy Policy. The facility's policy mandates that all patient information be treated as confidential and that unauthorized access, use, or disclosure is prohibited. It requires that electronic records be stored in password-protected systems with encryption to prevent unauthorized access. The policy applies to all employees, contractors, volunteers, and other personnel working in the nursing home, emphasizing the importance of safeguarding personal, medical, and financial information of residents.
Plan Of Correction
This Plan of Correction does not constitute admission or agreement by Miami Shores Nursing & Rehabilitation Center of the truth of the facts alleged, or conclusions set forth in the statement of deficiencies. This Plan of Correction is prepared solely because it is required by State and Federal Laws. N202 Right to Privacy Identify patients that were at risk and what did: Immediately, once identified by the surveyor, all Department managers were notified and asked to meet with their staff and go over HIPAA and protection of patient privacy. A facility-wide in-service was held on through /2025 that reviewed HIPAA privacy and all staff were started on individual HIPAA training. The assessment completed included the issue, Root Cause Analysis, and Performance Improvement Plan. Staff were trained on specific education related to HIPAA with acknowledgement forms. Regarding the Nurse that left the computer unattended at the med cart, they were counseled on the importance of HIPAA and protecting privacy; counseling was completed on. How will you identify other patients that are at risk? A full house audit was completed on , to determine that no other privacy screens were being left unattended by not only nurses but staff that use the tablets for documentation as well. Staff and Managers were reminded of HIPAA Policy, and Department managers were tasked to keep vigilant about any screens with patient information being left unattended. Thereafter, the DON created the Audit checklist to spot check for computer security during use. Measure put in place: A facility-wide in-service was held on and /2025 that reviewed HIPAA privacy and all staff were started on individual HIPAA training. The assessment completed included the issue, Root Cause Analysis, and Performance Improvement Plan. Staff were trained on specific education related to HIPAA with acknowledgement forms. Training will continue upon hire and annual review. A new system tool has been created whereby the Nurse manager that covers 24 hours per day has a form that was developed and included the surveillance of HIPAA Compliance with all electronics including computers and tablets. The DON created an audit checklist which will be located at the Nurses' desk and is a daily spot check for computer security during use. All department heads are also required to monitor for the same on their daily rounds and when finding any non-compliant staff, to report to managers and provide ongoing education and progressive discipline if rules are not adhered to. We posted a sign at the nurses' station and on med carts as a reminder to lock screens before leaving long-term prevention through inclusion and annual training and orientation. How will you monitor? The DON and all department heads are also required to use the form to track compliance. The DON and/or designee will be responsible for bringing the findings and summary to the QAPI Committee. This will occur daily for 30 days, then monthly for 3 months, then quarterly and/or if any variances are reported ongoing.
Privacy Breach of Resident Information
Penalty
Summary
The facility failed to uphold residents' right to privacy of personal information, as evidenced by multiple observations of unattended paperwork containing residents' information left visible in public areas. During a morning observation at the North Nursing station, a demographic sheet with a resident's information was found unattended on the counter. Staff I, an LPN, acknowledged the breach, explaining that the paperwork was left by someone who came to pick up a deceased resident. The LPN confirmed that no resident information should be visible and stated that they usually keep all residents' information with them. Later, during a dining observation, paperwork with visible resident information was found unattended on a chair in the dining room. The ADON, who was present in the room, was informed and retrieved the paperwork, confirming it contained residents' information and should not have been left unattended. The DON was interviewed and reiterated that the facility has measures in place to safeguard residents' information, emphasizing that no resident information should be visible or left unattended. A review of the facility's HIPAA Security Measure policy indicated that reasonable and appropriate measures should be implemented to protect residents' identifiable information.
Plan Of Correction
1. The resident demographic sheet was removed from the counter and secured in the resident's chart. The unattended paperwork ("activities haircut list") was removed from the dining room chair and secured. 2. A facility-wide audit was conducted to ensure no other resident's information was inappropriately placed and visible. No other information was found visible. 3. All staff training/education was provided by the DON/Designee on ensuring resident privacy and confidentiality. *Resident privacy and confidentiality training will be included in new hire and annual education. 4. The DON/Designee will conduct daily (for 5 weeks) facility observation rounds audit to ensure that no resident information is visible. The results of this audit will be reviewed at the monthly QA meeting until compliance has been determined.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release July 29, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.