Loss of Unencrypted PHI on USB Drive Due to Lack of Policy
Summary
The deficiency involves the facility’s failure to develop and implement a policy and procedure governing the use of USB drives for transmitting Protected Health Information (PHI). The governing body was responsible for establishing and implementing policies for managing and operating the facility and for appointing an administrator to manage the facility. The Medical Records Director (MRD) received an email request from a resident’s authorized representative for copies of the resident’s complete medical record. The MRD initially attempted to send the requested records via email, but the files were too large to transmit. The MRD then saved all requested medical record documents onto a USB flash drive and mailed it via certified mail to the address provided by the authorized representative. The USB drive contained the resident’s medical records, medical record number, payor/insurance provider and eligibility information, residency dates at the facility, and share of cost. The facility later received the envelope back marked “Return to Sender; Attempted – Not Known Unable to Forward,” and the envelope was torn open with the USB drive missing. The MRD stated the USB drive was not password protected and confirmed there was no policy or procedure addressing the use of USB drives to send PHI. The Administrator reported that, after learning of the lost unencrypted USB drive, he reviewed the facility’s PHI-related policies and found they were outdated and did not address the use of USB drives or current technology, and acknowledged that if USB drives were being used to send PHI, there should have been a policy requiring password protection.
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
The governing body failed to ensure an effective QAPI program and overall management systems, resulting in multiple unresolved deficiencies in environmental services, sanitation, infection control, and medication storage and administration that affected all residents’ quality of life. Resident Council minutes and grievance logs documented ongoing complaints about inadequate linens and delayed laundering of personal clothing, while surveyors observed large amounts of unfolded clean laundry and other unsatisfactory conditions in the laundry area. Significant turnover in key leadership roles, including a new DON, Social Services Director, HR Director, and Maintenance Director, coincided with persistent maintenance and pest control issues. The facility also failed to notify the State agency when a fire watch was initiated after fire panel trouble alarms, and surveyors found the facility lacked an effective staff training program on required topics such as QAPI, effective communication, and behavioral health.
The governing body failed to ensure effective oversight and implementation of policies related to the fire alarm system and Fire Watch, resulting in prolonged Fire Watch across all units without clear documentation or monitoring. The Administrator, who was newly appointed, could not initially explain the exact fire panel issue, provide vendor service reports, or show evidence of fire alarm testing, inspections, or maintenance records, and the fire alarm panel was observed in trouble mode for multiple units. The facility lacked a full‑time maintenance director, and the ongoing fire alarm and smoke detector problems, as well as the extended Fire Watch status, were not brought to the QAPI committee despite maintenance and life safety items being listed on the QAPI agenda. There was no documented process or evidence of communication between the Administrator and the governing body regarding these life safety issues or of the governing body’s involvement in QAPI oversight as required by facility policy.
A facility failed to maintain a clear controlled substance policy because its P&P did not specify when to sign the CDR or complete the MAR. During review of a resident receiving PRN Tramadol for pain, the CDR and MAR showed multiple mismatched and delayed documentation times. Interviews with an LVN, another LVN, an RN, and the DON showed inconsistent understanding of the proper sequence for removing, administering, and documenting controlled meds.
Surveyors found that multiple residents with orders for low air loss mattresses (LALM) for PU/PI prevention and wound healing were using these specialty beds without any facility policy or procedure in place to guide their use. The DON confirmed there was no written P&P for LALM, including no direction on linen use, and that staff relied on manufacturer guidelines, which did not address linen. The administrator acknowledged that a P&P for LALM should exist to guide care for the many residents using these mattresses, despite job descriptions assigning responsibility for developing and implementing such policies.
Governing body oversight was ineffective because meeting minutes showed quality and safety issues were discussed, but staffing concerns and performance improvement progress for wound care compliance, updated care plans, unlabeled oxygen tubing, and pharmacy recommendations were not addressed. The Admin stated the GB was aware of staffing concerns but not these other issues, and confirmed there was a lack of transparency between the facility and the GB. The facility policy stated the GB has ultimate responsibility and legal authority for safety and quality of care.
Surveyors found that the facility lacked a formally appointed, properly licensed Administrator (ADM) serving as the NHA and did not have consistent on-site administrative oversight. Staff reported that the prior ADM had left, the Department Head Directory did not list an ADM, and a regional ADM only visited a few hours several times per week without a formal appointment letter. The receptionist also noted that this temporary ADM had been absent for several days due to a corporate conference, leaving the DON identified only as the Abuse Coordinator and no clearly designated ADM present to manage operations.
Failure of Governing Body to Implement Effective QAPI, Oversight, and Reporting Systems
Penalty
Summary
The governing body failed to ensure an effective QAPI (Quality Assurance Performance Improvement) program and overall management systems, despite being legally responsible for establishing and implementing facility policies and appointing a properly licensed administrator. Surveyors identified multiple deficient practices across environmental services, sanitary and clean building conditions, infection control practices, and medication storage and administration, which affected all residents’ quality of life. The facility had no documentation of a Performance Improvement Plan and had not held QAPI meetings for three of four quarters. Resident Council minutes and grievance logs showed that residents and families had repeatedly raised concerns, including inadequate linens and delays in washing and returning personal clothing, and these issues continued for several months without resolution. During the survey period, the facility was undergoing significant administrative turnover, with a newly hired DON, Social Services Director, Human Resources Director, and Maintenance Director, and several new managers employed for a month or less. Long-term residents complained about facility conditions, and staff interviews confirmed ongoing laundry problems. Observation of the laundry department revealed mounds of clean, dry laundry waiting to be folded and other unsatisfactory conditions. Review of maintenance and pest control logs revealed additional unresolved issues. The facility also failed to notify the State survey and certification agency when a fire watch was initiated after trouble alarms on the fire control panel, even though a fire watch was conducted and later lifted once the system was repaired. Surveyors determined that the facility lacked an effective training program for employees on required topics, including QAPI, effective communication, and behavioral health, and that the governing body should have been made aware of the issues identified during survey debriefings.
Governing Body Failed to Ensure Oversight of Fire Alarm System and Fire Watch
Penalty
Summary
The deficiency involves the governing body’s failure to ensure effective leadership, policy implementation, and operational systems to maintain a safe, hazard‑free environment on all three units while the facility was on Fire Watch. Surveyors found that the facility had been on Fire Watch since 1/30/26 due to issues with the fire alarm system, yet the Administrator, who started on 3/30/26, could not clearly explain the exact problem with the fire panel or provide contemporaneous documentation of the malfunction or its monitoring. During an interview, the Administrator stated that Fire Watch consisted of someone making rounds every 15 minutes, primarily nursing staff, and acknowledged that the facility did not have a full‑time maintenance director. When surveyors requested evidence on 4/24/26 of the fire panel’s functionality, fire alarm system inspections, testing, or maintenance records, the Administrator was unable to produce any such documentation, including vendor service reports or audit records. He also could not initially provide documentation from the fire safety vendor verifying that the panel was functioning, and he did not present any evidence of communication from the local Fire Marshal or Fire and Rescue Department regarding Fire Watch. The fire alarm panel was observed in trouble mode for specific units, and the explanation given by regional leadership later was that the issue related to sensitivity and the age of the system, but this information and supporting documents were not available or presented at the time of the initial surveyor request. The governing body’s policies required it to be legally responsible for establishing and implementing policies for management and operation of the facility, including appointment and oversight of the Administrator and accountability for QAPI. However, there was no evidence that the governing body was involved in QAPI activities related to the ongoing fire panel and smoke detector issues or the prolonged Fire Watch status since January. The Administrator confirmed that the fire alarm and Fire Watch issues had not been brought to the QAPI committee, despite the QAPI agenda format including maintenance items such as fire drills, disaster drills, monthly fire alarm tests, and use of the TELS system. No evidence was provided to show a defined process of communication between the Administrator and the governing body regarding these life safety problems or that the Administrator was being held accountable for reporting and managing these operational issues.
Controlled substance documentation policy lacked clear timing and sequence requirements
Penalty
Summary
The facility failed to establish and implement a clear policy for controlled drug administration because its Controlled Substances policy did not specify the required timeframes for documenting controlled medications, including when to sign the Controlled Drug Record (CDR) and when to complete the Medication Administration Record (MAR). During record review, observation, and interviews, three licensed nurses were unable to identify the proper chronological steps for removing and administering controlled medications. The facility’s policy stated that the nurse administering the medication was responsible for recording the resident name, medication name, strength and dose, time of administration, method of administration, quantity remaining, and nurse signature, but it did not clearly state the order in which the CDR and MAR were to be completed. Resident 35 was admitted with low back pain and was cognitively intact, able to make daily decisions, and independent with eating and oral hygiene. The resident had an order for Tramadol 50 mg every six hours as needed for severe pain. Review of the resident’s CDR from 4/1/2026 through 4/7/2026 and the April 2026 MAR Audit Record showed multiple discrepancies between the times the medication was removed and the times it was documented on the MAR. The CDR reflected Tramadol being removed at scheduled times, while the MAR showed documentation at different times, including entries documented later than the administration times and one entry documented on a different date than the CDR entry. During interviews, LVN 1 stated she removed the controlled pain medication, placed it in a cup, asked the resident to rate pain, and then returned to the cart to sign the CDR and MAR after the resident agreed to take the medication. LVN 3 and RN 1 also stated that both the MAR and CDR were signed after the medication had been given. LVN 5 confirmed delayed documentation on several Tramadol administrations and stated she should have signed the MAR immediately after administering the medication. The DON stated the process should include removing the medication, signing the CDR, locking the cart, explaining the medication to the resident, administering it, and then immediately signing and documenting in the electronic MAR, and also stated the policy did not specify the correct order of steps.
Lack of Policies and Procedures for Low Air Loss Mattress Use
Penalty
Summary
Surveyors identified a deficiency in the facility’s failure to develop and implement policies and procedures for the use of low air loss mattresses (LALM) for all 12 sampled residents who were using these specialty beds for pressure ulcer/injury (PU/PI) prevention and treatment. Record review of the facility’s Order Listing Report showed that each of the 12 residents had active physician orders for LALM, with start dates ranging from the prior year to the current month. During observation, all 12 residents were confirmed to be on LALM, and the treatment nurse stated that the mattresses were being used to prevent pressure ulcers and promote wound healing for residents with existing pressure ulcers. In interviews, the DON acknowledged that the facility did not have any written policy or procedure governing LALM use, including guidance on linen use with the mattresses, and stated that the facility followed the manufacturer’s guidelines. However, the manufacturer’s guidelines provided did not address linen use with LALM. The administrator also stated that the facility should have a policy and procedure for LALM use to guide management of residents on these mattresses and noted that many residents were using them. Review of the DON and administrator job descriptions showed that both positions were responsible for developing, maintaining, and ensuring implementation of facility policies and procedures, including nursing policies that conform to current standards and regulations.
Governing Body Lacked Oversight of Key Facility Issues
Penalty
Summary
The facility failed to ensure its governing body provided effective oversight of facility operations. Review of Governing Board Meeting Minutes from January 26, 2026 through March 16, 2026 showed that quality care outcomes and safety concerns were discussed at QAPI meetings, but there was no mention of staffing concerns or performance improvement progress related to wound care treatment compliance, updated care plans, unlabeled oxygen tubing, or follow-up on pharmacy recommendations. During interviews on March 19, 2026, the Administrator, Assistant Chief Nursing Officer, and Quality Director stated that performance improvement audits and facility updates were discussed in quarterly QAPI meetings, then brought to a quarterly Quality Council meeting, and later presented to the Governing Body in monthly meetings. When survey findings were reviewed with the Governing Body members, the Administrator stated the Governing Body was aware of staffing concerns, but not of wound care treatment compliance, outdated care plans, unlabeled oxygen tubing, or pharmacy recommendations not being followed. The Administrator confirmed there was a lack of transparency between the facility and the Governing Body. The facility policy stated the Governing Board has ultimate responsibility and legal authority for safety and quality of care, treatment, and services rendered in the Hospital.
Lack of Formally Appointed and Consistently Present Administrator
Penalty
Summary
The deficiency involves the facility’s failure to ensure that a licensed Administrator (ADM) was formally appointed and serving in the capacity of a Nursing Home Administrator (NHA), and that an ADM was present for sufficient hours to provide adequate oversight and management of operations. During observation and interview, the DON’s license was posted in the lobby identifying the DON as the Abuse Coordinator, but there was no indication of an appointed ADM. The facility’s Department Head Directory did not list an ADM, and staff interviews confirmed that the previous ADM had left on January 10, 2026. Staff reported that since the prior ADM’s departure, an interim or regional ADM had been coming to the facility only approximately three times per week for a few hours per visit, either in the morning or afternoon. The receptionist stated that the temporary ADM had been absent from the facility for the past three days due to attending a corporate conference. The DON confirmed that the regional ADM providing oversight did not have a formal appointment letter designating them as the Administrator and had been assigned by the corporate office. As a result, the facility was operating without a consistently present, formally appointed, and properly licensed ADM responsible for managing and overseeing facility operations.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release June 24, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.