Failure to Protect Resident Privacy and Confidentiality of Medical Records
Penalty
Summary
Facility staff failed to maintain personal privacy and confidentiality of residents' medical records on two of four halls reviewed. Observations revealed that computer monitors at the nurse's station, which were positioned facing outward toward walkways, were left unattended and displayed confidential health information, including medication administration records (MARs) with resident names, pictures, room numbers, and medication details. On multiple occasions, these screens were left visible to residents, visitors, and staff, including during a community event when guests and children were present in the building. Additionally, a medication cart laptop was left open and unattended in a public area, exposing resident information to passersby. Interviews with staff, including LVNs and the DON, confirmed that the facility's practice was to lock computer screens when unattended to comply with HIPAA requirements. However, staff admitted to sometimes leaving screens unlocked and visible, and the facility was unable to provide a written HIPAA policy when requested. The DON acknowledged that the physical barriers at the nurse's station were insufficient to prevent exposure of private information, and staff recognized the risk of leaving screens visible to unauthorized individuals.