Failure to Protect Resident Health Information Privacy
Penalty
Summary
Facility staff failed to maintain the privacy and confidentiality of residents' medical information as required by facility policy and state regulations. Multiple observations revealed that appointment arrangement forms and medical information for several residents were left in plain view on nurse's station counters and in upright document stands, making them easily readable to anyone passing by. These documents included residents' names and details about their medical appointments, such as visits to oncology, hematology, orthopedic, urology, pulmonary, sleep, and radiology clinics, as well as information about blood draws. Additionally, a list of resident weights was left out in a public area, and the names of the residents could be matched to their weights using signage outside their rooms. In one instance, a family member of a resident reported receiving an email from the facility that contained insurance information for another resident, rather than for their own family member. The email included the other resident's name, admission status, co-pay amount, and supplemental insurance company. This error was acknowledged by the facility, and a corrected email was sent the following day. Interviews with facility staff, including the Director of Nursing, confirmed that the expectation was for all staff to maintain the privacy and confidentiality of resident information at all times. Staff were instructed to ensure that computer screens were not visible to others, carts were locked, and that report sheets and other information were not left visible in public areas. Despite these expectations, the observed actions and inactions led to the exposure of protected health information for multiple residents.