Unauthorized Disclosure of Resident PHI in Discharge Paperwork
Penalty
Summary
The deficiency involves the facility’s failure to protect a resident’s confidential personal and medical information when discharge documents for one resident were mistakenly given to another resident. The affected resident had been admitted and later readmitted with diagnoses including sepsis, Non-Hodgkin lymphoma, and hypotension. An admitting evaluation documented fluctuating capacity to understand and make decisions, and an MDS assessment showed severely impaired cognition. The resident’s Discharge Summary and Post-Discharge Plan of Care contained extensive protected health information, including full name, date of birth, admission and discharge dates, diagnoses, cognitive and physical status, nutritional status, height, weight, home address and phone number, physician and home health agency contact information, and medical equipment orders. The incident came to light when the husband of another resident who was being discharged contacted the facility’s Patient Concierge to report that the first resident’s discharge papers had been included with his spouse’s discharge paperwork. The Patient Concierge reported this to the medical records department. Review of a facility letter to the affected resident confirmed that the information disclosed included the resident’s full name, date of birth, admission date, address, discharge date, diagnosis, phone number, reason for admission, physician order for home health, height, weight, and reason for discharge. This disclosure occurred despite a facility policy stating that all resident health information is confidential, protected by HIPAA, and must not be disclosed in any form without legal authorization. Interviews with staff clarified how the error occurred. The Medical Records Assistant stated that nurses, not medical records, print discharge paperwork. The Infection Prevention Nurse, who was acting as the RN supervisor on the day in question, reported that night shift typically prepares and prints discharge paperwork and places it in residents’ physical charts. While discharging the second resident, the Infection Prevention Nurse pulled the discharge papers from that resident’s chart, checked only the first few pages to verify that the face sheet and medication list matched the correct name, and did not review all pages. As a result, the first resident’s Discharge Summary and Post-Discharge Plan of Care were inadvertently included in the second resident’s discharge packet. The Infection Prevention Nurse and the DON both acknowledged that all documents should have been checked to ensure they belonged to the correct resident and that providing these documents to another resident constituted a HIPAA violation and a breach of confidentiality.
We Help Long-Term Care Teams Stay Survey-Ready
We process and analyze inspection reports and plan of correction using AI to extract insights and trends so providers can improve care quality and stay ahead of compliance risks.