Resident PHI Shared via Staff Personal Cell Phones
Penalty
Summary
Facility staff failed to maintain the privacy and confidentiality of residents' personal and medical records by transmitting protected health information (PHI) through text messages sent to personal cell phones. Interviews revealed that a restorative nursing assistant (RNA), a certified nursing assistant (CNA), and a physical therapist (PT) all received or sent group text messages containing residents' names, room numbers, and specific care or rehabilitation program details. These messages were sent among various staff members, including the director of rehabilitation, occupational therapist, director of staff development, and others, using their personal devices. The director of nursing (DON) confirmed that transmitting resident information to personal phones is not permitted, as it includes identifiable information such as names and room numbers, which is protected under HIPAA regulations. Review of facility policies indicated that employee cell phones are only to be used for personal calls and texts during breaks, and that the facility is committed to complying with privacy and security laws regarding PHI. Despite these policies, staff continued to use personal devices to communicate resident information, leading to a breach in confidentiality.