Failure to Protect Resident Privacy Due to Use of Personal Electronic Devices
Penalty
Summary
Staff at the facility failed to ensure the privacy and confidentiality of resident medical records by allowing the use of personal electronic devices to access and document resident information. During medication administration, an LPN was observed using her own personal device to access a resident's medical record, citing a lack of available facility-supplied devices as the reason. The LPN confirmed that she brought her own device from home to ensure timely access to resident records for medication administration and documentation. Further observations and staff interviews revealed that other staff members, including nurse aides, also brought personal electronic devices into the facility for the purpose of accessing and documenting in resident records. At the time of the survey, there were not enough facility-supplied laptops and iPads available for the number of staff on duty, leading to the use of personal devices. Facility documentation confirmed that staff had received training on HIPAA, confidentiality, and resident rights, which included the requirement to keep resident information private. Despite this training, the facility was unable to ensure the security of resident personal and private information due to the use of personal devices for accessing clinical records. The lack of sufficient facility-supplied electronic devices directly contributed to this deficiency, as staff resorted to using their own devices to fulfill their duties. The facility's inability to provide adequate equipment resulted in a failure to protect resident privacy and confidentiality as required by federal and state regulations.
Plan Of Correction
1. Facility is unable to retroactively correct staff members using personal computers for documentation purposes. 2. Staff were provided additional facility-issued laptops/POC documentation devices. 3. Administrator checked the status of laptops previously ordered and expected delivery date. Additional laptops were also purchased; unused facility laptops/desktops were provided to nursing units. All nursing staff will be re-educated on HIPAA/only using facility-provided computer equipment. 4. Random audits will be conducted to ensure only facility-issued computers are being used, 2x a day, 3x a week, then weekly for 4 weeks. Administrator/designee to ensure compliance. Results of the audits will be presented at the QAPI meetings for review and to ensure ongoing compliance. F 0583