Failure to Protect Resident Health Information Confidentiality
Penalty
Summary
The deficiency involves the facility’s failure to maintain the privacy and confidentiality of a resident’s protected health information (PHI) by sharing medical and care information with an individual who was not documented as an authorized contact. The resident had been admitted for post-surgical care with difficulty walking and a need for personal care assistance, and an MDS assessment showed intact cognition. The resident’s demographic sheet listed the resident as their own responsible party, with only a sister documented as the emergency contact and no other contacts listed. Despite this, a nurse documented a phone call with the resident’s daughter in which the nurse discussed the resident’s pain medications, pain level, and use of PRN pain medication, and encouraged the daughter to call daily for updates. A subsequent progress note by social services documented that a care conference was held in the resident’s room with the daughter present, during which medications, orders, therapy goals, and discharge plans were discussed. Further documentation showed that the facility administrator later noted the resident’s daughter had called requesting a return call from the DON, and the resident stated he would update his daughter himself and preferred that the facility not call her at that time. Communication records in the form of text messages between social services and a family member of the resident showed additional disclosures of PHI, including information about the therapy appeal process, an upcoming appointment, discharge plans, and home health care. During interview, the social services staff member stated that at the time of the care conference the resident had allowed his daughter to receive information, but later asked that she not receive any more information, and that the resident had given permission to share information with his family member. The social services staff member confirmed there was no documentation of the resident’s permission to share information. Review of the facility’s HIPAA privacy policy showed that PHI may not be disclosed except as specifically permitted, indicating the documented disclosures were not supported by documented authorization.
We Help Long-Term Care Teams Stay Survey-Ready
We process and analyze inspection reports and plan of correction using AI to extract insights and trends so providers can improve care quality and stay ahead of compliance risks.