Unencrypted USB With Resident PHI Lost in Mail
Penalty
Summary
The facility failed to protect the confidential personal and medical information of one resident by copying the resident's complete facility records onto an unencrypted USB drive and mailing it to the resident's family member. The resident had been admitted with diagnoses including malignant neoplasm of the ribs, chronic obstructive respiratory failure, and autistic disorder, and a History and Physical documented that the resident did not have the capacity to understand and make decisions. The resident's authorized representative requested copies of the complete medical record, including medical charts, nursing notes, MARs, physician orders, care plans, incident reports, therapy notes, vital signs, admission/transfer/discharge records, and internal communications related to care. The Medical Records Director attempted to send the requested records via email, but the files were too large, so she saved all requested documents to a USB flash drive that was not password protected or encrypted and mailed it via certified mail to the address provided by the family member. The envelope containing the USB drive was later returned to the facility marked "Return to Sender; Attempted - Not Known Unable to Forward" and was torn open, with the USB drive missing. The Administrator confirmed that the USB drive with the resident's medical records was lost in the mail and that it was not encrypted or password protected, resulting in an unauthorized exposure of the resident's PHI. The information on the USB drive included the resident's Level 1 PASSR screening, insurance eligibility, History and Physical, MD/NP progress notes, all electronic health records (including admission record, MD orders, MAR, nursing progress notes, social services notes, dietary notes, change of condition documentation, IDT meeting notes, and care plans), rehabilitation notes, NOMNC, and copies of the physical paper chart such as consent forms and hospital records. The facility's Privacy Notice policy required the facility by law to maintain the privacy of PHI.
We Help Long-Term Care Teams Stay Survey-Ready
We process and analyze inspection reports and plan of correction using AI to extract insights and trends so providers can improve care quality and stay ahead of compliance risks.