Unauthorized Disclosure of Multiple Residents’ PHI via Email
Penalty
Summary
The facility failed to maintain the confidentiality of protected health information (PHI) for multiple residents when responding to a medical record request. The facility’s HIPAA Privacy and Security Policy, dated March 20, 2025, states that all workforce members are responsible for safeguarding PHI in any form and defines PHI as information that identifies or can reasonably be used to identify a resident and relates to the resident’s health condition, care, or payment for care. Despite this policy, an administrative employee (Employee 1) sent an email to the responsible party of Resident 1 in response to a request for that resident’s medical record. During an interview and concurrent review of the email, it was determined that Employee 1 erroneously attached and transmitted PHI belonging to multiple other residents, including Residents 3, 5, and 8, in addition to the requested information for Resident 1. The extra attachment contained progress notes from the clinical records of these additional residents, whose responsible party had not authorized this individual to receive their records. The email, sent on February 10, 2026, at 3:01 PM, therefore disclosed confidential medical record information for Residents 3, 5, and 8 to an unauthorized recipient. In a subsequent phone meeting, the Nursing Home Administrator confirmed that sending the PHI for these residents was a mistake.
We Help Long-Term Care Teams Stay Survey-Ready
We process and analyze inspection reports and plan of correction using AI to extract insights and trends so providers can improve care quality and stay ahead of compliance risks.