F0550

J

Unauthorized Video Recording and Social Media Posting of Resident by CNA

Santa Monica, California Survey Completed on 06-09-2025

Penalty

No penalty information released

Summary

A Certified Nursing Assistant (CNA) recorded a video of a resident without obtaining consent from the resident or the resident's responsible party. The CNA subsequently posted the video on her personal social media account, specifically Instagram, which was confirmed through interviews and review of the complaint submitted to the District Office. The resident involved had severe cognitive impairment, as documented in the Minimum Data Set, and required moderate to maximal assistance with activities of daily living. The resident was not aware that a video had been taken or posted and expressed distress upon learning about the incident, stating a desire for privacy regarding his stay and condition.

The facility's Director of Nursing (DON) reviewed the complaint and confirmed that the images in question were of the CNA and the resident. The DON acknowledged that the CNA did not follow facility policies and procedures regarding the prohibition of taking or releasing images or recordings of residents without explicit written consent. The facility's policies clearly state that staff may not take or release images or recordings of any resident without explicit written consent, and that unauthorized disclosure of resident information is prohibited. The CNA initially denied taking or sharing photos but later admitted to posting a video of the resident on social media without informing the resident or obtaining consent.

Interviews with the resident's responsible party revealed that the resident was a private individual who would not have consented to being photographed or having his image shared, especially in his current condition. The responsible party expressed concern about the violation of the resident's privacy, dignity, and respect, and questioned how many people had access to the unauthorized images. Additional interviews with facility staff confirmed that taking photos or videos of residents without consent is not allowed and is considered a violation of residents' rights and privacy.

Plan Of Correction

Immediate corrective action(s) for those Resident(s) affected by the deficient practice:

• HIPAA Privacy Consultant was notified by the Administrator via email of the incident on 6/5/25 at 5:38 PM and an investigation was initiated.

• CNA 1 was interviewed by the Administrator and Director of Nursing (DON) on 6/5/25 at 3:30 PM, and the nature of the video clip was assessed at approximately 7:00 PM. The Administrator witnessed CNA 1 delete the video from her private Instagram account and trash bin; and verified that it was not stored in the cloud. CNA 1 received verbal 1:1 counseling regarding policy violations at this time.

The 5 facility employees who had potential to view the video clip were interviewed on 6/7/25 by the Administrator and QA Nurse at approximately between 1:00-1:30 PM and 4:18 PM. MR 1, CNA 3, and CNA 5 stated they did not view the video, and CNA 2 and CNA 4 stated they viewed the video but did not screenshot, forward, or share it.

CNA 1's employee file was reviewed by the Administrator on 6/5/25 at 4:30 PM. Her background and reference checks were completed. No previous disciplinary actions were noted. CNA 1 received written counseling for her HIPAA violation and 1:1 re-training with the facility Administrator on 6/5/25 at approximately 6:00 PM. The topics covered included responsibilities in protecting personal health information (including patient images) and the facility policy prohibiting unauthorized audio/visual recordings of Residents and/or posting PHI to social media. CNA 1 signed for HIPAA Retraining Inservice.

CNA 1 was suspended on 6/6/25 at approximately 12:45 PM as a provision for immediate jeopardy abatement plan acceptance. The HIPAA Privacy Consultant provided an additional re-education on HIPAA with CNA 1, and she signed her Corrective Action Form on 6/6/25 at approximately 8:00 PM. The HIPAA Privacy Consultant determined that HIPAA Sanctions Policy will be followed for corrective action and remediation for CNA 1. At the direction of CDPH, CNA 1 was to remain suspended until CMS-2567 Form is received.

On 6/18/25, the facility received notice from CDPH that it opened an investigation into the CNA involved in this incident.

Resident 1's wife was notified of the incident on 6/5/25 by the Social Services Director (SSD) at 5:04 PM. The wife verbalized that she was satisfied with the steps the facility took, and she feels no harm was done.

Resident 1's Physician was notified by the Administrator on 6/5/25 at 9:30 PM. No new orders were noted. Beginning on 6/7/25, Resident 1 was monitored and observed for any changes in mood, behavior, or exhibiting any distress by the SSD; and beginning on 6/8/25 by nursing staff.

On 6/6/25, the SSD referred Resident 1 for a third-party psychological evaluation and determination of any residual effects related to this social media incident. The psychiatrist is scheduled to visit on 6/9/25 at approximately 3:00 PM.

Plan/Process to identify other Resident(s) potentially affected by the same deficient practice:

From 6/6/25 through 6/7/25, our SSD or designee conducted interviews with 115 facility Residents to determine if any had experienced privacy violations, including being videotaped or having their picture taken without written consent. No issues or concerns were identified and noted in their clinical record progress notes. The 115 residents were interviewed by the social services staff on 6/7/25 to assess if they are aware of or have experienced any privacy violations, including being videotaped or having their picture taken. No issues or concerns were identified and noted in their clinical record progress notes.

On 6/6/25, facility grievances and Resident Council minutes were reviewed by the Administrator at approximately 2:00 PM for the past 3 months, and no other instances of unauthorized images, recordings, or PHI disclosures were reported.

Facility measures and systemic changes to ensure the deficient practice does not recur:

By 6/9/25, Department Managers will be in-serviced by the Clinical Resource Consultant regarding Resident Rights to Privacy and Dignity, and HIPAA policies prohibiting disclosure of photographs or audio/visual recordings of Residents without explicit written consent. Facility policies prohibiting the use of personal cell phones or other handheld computer devices while working will also be reviewed, and a HIPAA Competency Test will be completed.

By 6/30/25, facility staff will receive in-service training with the DON and/or designee on Resident Rights to Privacy and Dignity, and HIPAA policies prohibiting disclosure of photographs or audio/visual recordings of Residents without explicit written consent. Facility policies prohibiting the use of personal cell phones or other handheld computer devices while working will be reviewed, and a HIPAA Competency Test will be completed.

Upon hire, facility staff will receive training on Resident Rights policies and HIPAA policies prohibiting audio or visual recordings of Residents without explicit written consent. Employees will acknowledge receipt and understanding of the employee handbook, which includes policies for Resident Rights and prohibiting the use of personal cell phones or other handheld computer devices while working.

On 6/7/2025, the facility provided postings in common areas to remind staff and/or visitors regarding common HIPAA violations and no personal cellphone use while working in residents' care areas. The DON advised RN supervisors and/or Licensed Nurses on duty to remind staff during nursing huddles that personal cellphones are prohibited in residents' care areas.

Department Managers were also advised to remind staff that personal cellphones are prohibited in resident care areas.

Monitor performance to ensure solutions are sustained:

Beginning 6/7/25, interdisciplinary team members will conduct random quality monitoring rounds three times per week to monitor staff compliance in maintaining a cell phone-free environment in resident rooms and other areas where residents gather. DSD and/or designee will conduct random observation rounds and resident interviews three times per week to monitor staff compliance with personal cell phone use. Identified non-compliance will be addressed immediately through counseling and re-education.

The Administrator or designee will conduct a weekly QAPI subcommittee, including the DON, DSD, HR, Social Services Director, Activity Director, or designees, to review quality rounds results for any instances of non-compliance requiring additional follow-up or remedial planning. The Activities Director or designee will conduct targeted queries during monthly Resident Council meetings to monitor compliance with cell phone use and maintaining residents' rights to privacy and dignity.

Results of quality rounds, Resident Council feedback, and grievance reports will be reviewed by the facility QAPI Committee to monitor compliance with maintaining residents' rights, privacy, and dignity each month, or until substantial compliance is maintained for a minimum of three months. Compliance trends will be evaluated for additional remedial planning and monitoring needs as indicated.

Responsible Person: Administrator

Date of Completion: 6/30/2025

Removal Plan

• CNA 1 was interviewed by the ADM and DON, and the nature of video clip was assessed. The ADM witnessed CNA 1 deleted the video from her private Instagram account and trash bin; and verified it was not stored in the cloud.
• CNA 1's employee file was reviewed by ADM. Her background and reference checks were completed. No previous disciplinary actions noted.
• RP 1 was notified of incident by the Social Services Director (SSD). RP 1 verbalized that she was satisfied with the steps the facility took, and she feels no harm was done.
• Health Insurance Portability and Accountability Act (HIPAA) Privacy Consultant was notified by the ADM via email of the incident and an investigation was initiated.
• CNA 1 received immediate counseling for her HIPAA violation and 1:1 re-training with the facility ADM. The topics covered included responsibilities in protecting personal health information (including patient images); and facility policy prohibiting unauthorized audio/visual recordings of residents and/or posting PHI to social media. CNA 1 signed the HIPAA Retraining Inservice.
• Resident 1's Physician was notified by the ADM. No new orders were noted. The Primary Physician and MDR was informed of the incident. The ADM will monitor for compliance and report findings or trends to the QAA/QAPI Committee. A weekly QAA/QAPI Meeting will be conducted to review for compliance and any further recommendations for improvement as needed until substantial compliance is achieved.
• CNA 1 was suspended. The HIPAA Privacy Consultant provided an additional re-education on HIPAA with CNA 1, and she signed her Corrective Action Form. The HIPAA Privacy Consultant determined that the HIPAA Sanctions Policy will be followed for corrective action and remediation for CNA 1. CNA 1 remains on suspension until CMS-2567 form is received. The facility will report CNA 1 to the certification board.
• The SSD referred Resident 1 for a 3rd party psychological evaluation and determination of any residual effects related to this social media incident. The psychiatrist is scheduled to visit.
• Facility grievances and Resident Council Minutes were reviewed by the ADM for the past 3 months, and no other instances of unauthorized images, recordings, or PHI disclosures were reported.
• Resident 1 was monitored and observed for any changes in mood, behavior, or exhibiting any distress by the SSD; and by nursing staff.
• Facility provided postings in common areas to remind staffs and/or any visitors regarding common HIPAA violations and no personal cellphone use while working in residents care areas.
• The five facility employees who had potential to view the video clip were interviewed by the ADM and Quality Assurance Nurse (QAN). Medical Record Assistant 1 (MRA 1), Certified Nursing Assistant 3 (CNA 3) and Certified Nursing Assistant 5 (CNA 5) stated they did not view the video and Certified Nursing Assistant 2 (CNA 2) and Certified Nursing Assistant 4 (CNA 4) stated they viewed the video, but did not screenshot the video or forwarded or shared the video.
• The SSD and/or Designee conducted interviews with the 11 residents CNA 1 was assigned to to determine if any had been photographed or recorded without their written consent. No issues or concerns were identified and noted in their clinical record progress notes. The 115 residents were interviewed by the social services staff if they are aware of or have experienced any privacy violations including being videotaped or having their picture taken. No issues or concerns were identified and noted in their clinical record progress notes.
• The ADM, DON, ADON, Director of Staff and Development (DSD), SSD, Minimum Data Set Nurse (MDSN), Rehabilitation and Maintenance/Housekeeping Directors were in-serviced by the CRC regarding Resident Rights to Privacy and Dignity; and HIPAA policies prohibiting disclosure of photographs or audio/visual recordings of residents without explicit written consent. Facility policies prohibiting use of personal cell phones or other handheld computer devices while working was also reviewed. The additional Department Heads will be in-serviced by the CRC and a HIPAA Competency Test completed prior to their next scheduled shift.
• The DON and/or Designee began in-serving facility staff regarding Resident Rights to Privacy and Dignity; and HIPAA policies prohibiting disclosure of photographs or audio/visual recordings of Residents without explicit written consent. Facility policies prohibiting use of personal cell phones or other handheld computer devices while working was also reviewed and a HIPAA Competency Test completed. Education and training for staff on leave, vacation, per diem or registry status will be completed prior to their next scheduled shift, until substantial training compliance is achieved.
• During huddles, Registered Nurse (RN) supervisor's and/or Licensed Vocational Nurses (LVN) on duty; and Department Managers will remind staff that personal cellphones are prohibited in residents care areas. Department managers will assist on monitoring compliance during random rounds utilizing the Compliance Monitoring Quality Assurance (QA) Checklist. The HIPAA Sanctions Policy will be followed if any staff are found not in compliance. The ADM will monitor for compliance.
• The Quality Assurance Quality Assurance and Assessment/Quality Assurance Performance Improvement (QAA/QAPI) Meeting, (attendees: Medical Director (MDR), ADM, DON, DSD, Infection Preventionist (IP), SSD, Director of Community Relations, Dietary Manager, Activities Director (AD), Medical Records, Customer Service, Business Office Manager (BOM), Staffing Coordinator (SC) led by the ADM, addressed Root Cause Analysis and a QAPI for HIPAA, Privacy and Resident Rights.