Failure to Follow Medical Record Request Policy and Timely Release of Records
Penalty
Summary
The facility failed to follow its own policy regarding the handling of medical record requests and the safeguarding of resident-identifiable information. Staff members reported printing and providing copies of electronic medical records to residents and their representatives without obtaining a formal written request, as required by facility policy. The policy specified that all requests for access to protected health information (PHI) must be in writing and directed to the HIPAA Privacy Officer, with a specific form to be completed. However, interviews revealed that LPNs would print and hand over records directly to residents or their representatives, bypassing the required process. The Medical Records Director was unaware that nursing staff were distributing records in this manner and confirmed this was not the correct procedure. Additionally, the facility failed to provide requested medical records in a timely manner for a previous resident. The resident's representative made multiple written and verbal requests for records over several months, but the records were not provided within the state-specified time period. The Medical Records Director acknowledged delays in receiving and processing requests, citing that some requests were found at nurses' stations months after submission and that approval from the corporate office was required before releasing records. There was no documentation of the required request form being completed for the resident in question, and the records had still not been sent at the time of the surveyor's review.