Unauthorized Access and Disclosure of Resident Medical Records
Penalty
Summary
A deficiency occurred when an independent liaison, who was not an employee of the facility or the hospice company, obtained and retained medical records for a resident without proper authorization or consent. The liaison stated she did not meet with the resident or the resident's sister prior to arranging the discharge and did not receive the resident's consent to access or review the medical records. The liaison acquired the records from the hospice company and used information from them to facilitate the resident's discharge, despite not having a medical background or a direct relationship with the facility or hospice. The resident involved had a history of paraplegia, essential hypertension, and recurrent urinary tract infections with sepsis, and was readmitted to the facility with a terminal prognosis. The resident's medical records indicated intact cognition and the capacity to make medical decisions. The discharge summary and care plan noted the resident's terminal condition and the plan for a safe transition home, but there was no documentation that the physician spoke to the resident's family about the terminal prognosis. The discharge planning review form was also found to be incomplete. Facility policy required that access to protected health information (PHI) be limited to the minimum necessary and that the entire medical record should not be disclosed unless specifically justified, particularly for non-treatment purposes. The liaison's access and retention of the resident's medical records, without proper consent or justification, constituted a violation of the Health Insurance Portability and Accountability Act (HIPAA) and the facility's own policies regarding the disclosure of PHI.