Unauthorized Resident Recording and Disclosure Violating Privacy and Confidentiality
Summary
The deficiency involves a failure to protect residents’ privacy and confidentiality when a CNA used a personal cell phone to record and photograph two residents without their knowledge or consent, and then shared that content with another CNA. One resident had paraplegia, depression, muscle weakness, dorsalgia, and polyneuropathy, was cognitively intact, and dependent on staff for ADLs. The other resident had diagnoses including seizures, dysphagia, acute kidney dysfunction, and muscle weakness, was able to make needs known but could not make medical decisions, had severely impaired decision-making, and was also dependent on staff for ADLs. Both residents were therefore in a position of dependence on staff for care at the time of the incident. According to CNA 2, on a specific date she recorded a video of the two residents because one resident started an altercation with the other. She stated she recorded the incident for “evidence” and to show CNA 1, acknowledging that recording residents was not part of facility policy and that she should not have recorded or taken photographs of them. CNA 1 confirmed that she received the video on her personal cell phone from CNA 2 and stated that the recording was made for “safety purposes” due to a situation that was perceived as potentially escalating to physical aggression. CNA 1 reported that she did not share or post the video on social media or distribute it to others, but that a family member took her phone without permission and accessed its contents. CNA 1 further stated that this family member sent the video and pictures of the two residents to the facility, and that she notified the facility that her phone had been taken but did not disclose that it contained videos or photographs of the residents because she was unaware that the family member had accessed or distributed them. The DSD reported receiving a text message from an unknown number containing approximately two videos and an undetermined number of photographs of the two residents, along with the names of CNA 1 and CNA 2. The DSD, LVN 2, and the Administrator each stated that staff were required to follow HIPAA regulations, that staff were not permitted to record or possess videos or photographs of residents on personal devices, and that any photographs of residents required consent and had to be for medical purposes as part of the medical record. Facility policies on confidentiality, residents’ rights, and dignity stated that unauthorized release, access, or disclosure of resident information, including video or audio, was prohibited and that staff must protect resident privacy and treat residents with dignity and respect. The videos received by the DSD did not show an altercation between the residents, and staff interviews confirmed that filming residents was not part of the facility’s “Stop and Watch” process, which instead required observation, intervention, and reporting of changes in condition or behaviors to nursing staff.
Plan Of Correction
This Plan of Correction is the facility's credible allegation of compliance. Preparation and/or execution of this plan of correction does not constitute admission or agreement by the provider of the truth or facts alleged, or conclusions set forth in the statement of deficiencies. The plan of correction is prepared and/or executed solely because it is required by the provisions of federal and state law. F0583 Personal Privacy/Confidentiality of Records How corrective action(s) will be accomplished for those residents found to have been affected by the deficient practice: Corrective actions were immediately implemented for Resident 1 and Resident 2 upon identification of the deficient practice. The facility initiated an investigation on 03/23/2026 and conducted immediate interviews with staff and residents utilizing structured interview tools to assess scope, impact, and additional potential concerns. Interviews confirmed the incident was isolated and no additional residents reported privacy violations or concerns. The staff members involved were removed from duty immediately. Following completion of the investigation, both employees were terminated in accordance with facility policy due to violation of resident rights, HIPAA, and facility confidentiality policies. Both employees completed formal Declarations and Attestations of Deletion of Unauthorized Recordings, confirming removal of all recordings and non-distribution of content. Documentation includes: Ashley Zelaya, CNA – Declaration executed 03/30/2026 at 9:21 AM, attesting deletion of all recordings and acknowledgment of policy violation Leslie Bram Reyes, CNA – Declaration executed 03/26/2026 at 10:42 AM, attesting deletion of all recordings and acknowledgment of policy violation Residents and/or responsible parties were notified. Social Services completed assessments with no identified psychosocial harm. All corrective actions were completed by 03/26/2026. How the facility identifies other residents having the potential to be affected by the same deficient practice and what corrective action will be taken. A facility-wide audit was initiated on 03/25/2026 using the Briarcrest Comprehensive Privacy, Recording, and Resident Rights Audit Tool. The audit included direct observation, staff interviews, and resident interviews to evaluate compliance with privacy practices, personal device use, and HIPAA requirements. Interviews were conducted using standardized staff and resident interview tools to ensure consistency and thoroughness in data collection. Findings from the audit confirmed that no additional residents were affected by the deficient practice and no additional incidents of unauthorized recording or disclosure were identified. Staff were immediately re-educated by Director and staff development on HIPAA Privacy Rule requirements, the facility's prohibition on personal device recordings, and the appropriate use of the Stop and Watch process for reporting changes in resident conditions. This corrective action was completed by 03/27/2026. What measures will be put into place or what systemic changes will the facility make to ensure that the deficient practice does not recur. The facility implemented systemic changes to prevent recurrence of the deficient practice by reinforcing a zero-tolerance policy for unauthorized recordings and strengthening staff accountability related to resident privacy and confidentiality. Staff completed mandatory re-training by the Director of Staff Development on Resident Rights, HIPAA, and Privacy/Confidentiality requirements. Staff were required to re-acknowledge facility policies related to confidentiality and personal device use. The facility implemented routine supervisory rounding to monitor compliance with personal device restrictions. In addition, the facility installed visible signage at the receptionist area clearly articulates that video recording is strictly prohibited inside resident rooms and in any facility areas where residents are present. The facility also posted signage throughout the entire facility, in both English and Spanish, indicating that video recording is not allowed to ensure clear communication to staff, visitors, and all individuals entering the facility. Privacy and HIPAA compliance were further integrated into new employee orientation, annual competencies, and ongoing in-service education. The Director of Staff Development completed initial re-education by 03/27/2026, and staff completed required training by 04/05/2026. How the facility plans to monitor its performance to make sure that solutions are sustained. To ensure sustained compliance, the facility incorporated privacy and confidentiality monitoring into its Quality Assurance and Performance Improvement (QAPI) program. The facility implemented an ongoing monitoring system beginning on 03/25/2026 utilizing the established audit tool, which confirmed that no additional residents were affected, and no further incidents occurred during the initial audit period. The facility will continue monitoring through weekly audits for four consecutive weeks, followed by monthly audits for three months. These audits will include direct observation of staff practices, verification of compliance with personal device policies, and evaluation of adherence to HIPAA and privacy requirements. Audit findings will be documented using standardized tools and reviewed by the Director of Nursing, with results reported to the Quality Assurance and Performance Improvement (QAPI) Committee for analysis and trending. If any issues are identified, immediate corrective action will be implemented, including re-education and progressive discipline as appropriate. If no trends or repeat deficiencies are identified after the monitoring period, the facility will discontinue routine auditing and remove the issue from active QAPI monitoring. Dates when corrective action will be completed. 4/17/2026
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
An LVN left a medication cart computer monitor active and unsecured during med pass, visibly displaying a resident’s eMAR and private clinical details in a hallway near resident rooms. The screen was left open a second time while the LVN stepped away to retrieve keys, and the LVN later acknowledged the exposure was an unauthorized sharing of PHI and a HIPAA violation. The DON, ADM, and CCN stated that leaving the terminal open allowed others to view private resident information.
Failure to Provide Privacy During Incontinent Care: A resident with severe cognitive impairment, an indwelling catheter, and assistance needs for ADLs was observed receiving perineal/incontinent care by two CNAs without the privacy curtain being drawn, leaving him exposed from the waist down while his roommate was in the room. The resident stated he felt uncomfortable and wanted the curtain closed every time. Staff acknowledged that privacy during care was required for dignity, but one CNA said he did not pull the curtain because he thought it was not working.
A CMA left a locked med cart unattended with the laptop screen unlocked, allowing A resident's personal medical information and medications to be visible. The CMA said she was not sure whether the screen needed to be locked or hidden when away from the cart, and later interviews confirmed the cart and laptop screen should be locked whenever staff step away.
Failure to provide privacy during wound care. An LPN assessed and applied a dressing to a resident while the resident was eating lunch, with the room door open and the privacy curtain not pulled. The interaction was visible from the hallway, and the LPN and Unit Manager confirmed privacy should have been provided and that dressing care should not occur during mealtime.
A resident’s pharmacy slip containing his name and medication information was left on the ledge of the nurse’s station and remained visible during repeated observations when no staff were present. The LVN said the slip should have been secured inside the nurse’s station, and the ADON, DON, and Administrator all identified the information as confidential and not meant to be left in view of others.
Improper Release of PHI: A staff member released a resident’s requested medical records to the resident’s son, but the packet also included skilled progress notes and other PHI for 12 unrelated residents. The error occurred when the staff member printed records from the EMR using only the first few letters of the resident’s name and did not recognize that multiple residents’ documents had been selected before sending the scanned records by secure email.
Unsecured eMAR Screen Exposed Resident Information
Penalty
Summary
The facility failed to ensure the privacy and confidentiality of a resident’s personal and medical records for 1 of 13 residents reviewed. During an observation on 06/04/2026 at 8:39 AM during medication pass on Hall B, an LVN was observed walking away from the medication cart to administer medications while the cart’s computer monitor remained active and unsecured, visibly displaying the eMAR and private clinical details of a resident. The cart was positioned in the hallway near resident rooms, exposing the screen to residents passing through the corridor. During a second observation on 06/04/2026 at 8:42 AM, the same LVN again walked away from the Hall B medication cart to retrieve keys from another nurse, and the computer screen was again left fully open and active with residents’ private eMAR information displayed. In interviews later that morning, the LVN acknowledged that leaving a resident’s personal health information visible on an open monitor was an unauthorized sharing of patient information and a HIPAA violation. The DON, ADM, and CCN each stated that leaving a computer terminal open with resident information allows others to see private information that is not supposed to be shared, and that screen security is the responsibility of the nurse assigned to that cart and unit.
Failure to Provide Privacy During Incontinent Care
Penalty
Summary
The facility failed to ensure privacy during incontinent care for one resident. During an observation of perineal care with an indwelling catheter, CNA D and CNA E provided care to the resident without pulling the privacy curtain, leaving the resident nude from the waist down while care was being performed. The resident’s roommate was present in the room and was looking at his cell phone during the care. The resident was a male with diagnoses including heart failure, obstructive and reflux uropathy, unspecified dementia, and age-related physical debility. His MDS assessment reflected a BIMS score of 7, indicating severe cognitive impairment. He had an indwelling catheter, including a suprapubic catheter and nephrostomy tube, and required partial/moderate assistance with toileting hygiene, showering/bathing, personal hygiene, and dressing. His care plan stated that he required incontinent care promptly when found wet or soiled and that clothes and linens were to be kept clean, dry, and wrinkle free. During interview, the resident stated he did not feel okay when the privacy curtain was not closed while staff were cleaning his private parts because someone could enter the room, and his roommate could see him being exposed. He stated staff rarely pulled the privacy curtain when changing him or his roommate and that he wanted the curtain pulled every time he received incontinent care. Staff interviews reflected that privacy during incontinent care was expected and related to resident dignity, but CNA D stated he did not pull the curtain because he thought it was not working, and later said it did work when he checked it. The DON stated the facility policy was to have the curtain pulled during incontinent care and that staff were responsible for providing privacy.
Failure to Protect Resident Medical Record Privacy
Penalty
Summary
The facility failed to ensure staff secured and protected the privacy and confidentiality of Resident 8's medical record. On 06/02/26 at 07:55 AM, a CMA left a locked medication cart unattended with the laptop screen unlocked, and Resident 8's personal medical information and medications were visible on the screen. When the CMA returned at 07:57 AM, she confirmed she was assigned to that medication cart and stated she was not positive whether the screen needed to be locked or hidden when she was away from the cart. Later interviews confirmed that medication carts and laptop screens should be locked whenever a medication aide or nurse walks away from the cart. The facility's Confidentiality of Personal and Medical Records policy stated that residents have the right to secure and confidential personal and medical records, including confidentiality of all information contained in a resident's records regardless of the form of storage or location.
Failure to Provide Privacy During Wound Care
Penalty
Summary
Privacy during wound care was not provided for one sampled resident. During observation on 6/1/26 at 12:16 PM on the Dogwood unit, an LPN was preparing supplies from a wound care cart outside Resident #93's room while the resident sat on the side of the bed eating lunch. The LPN rolled up the resident's right shirt sleeve and began assessing the area where a bandage would be applied while the resident continued eating salad and the LPN documented and labeled the dressing. When ready to apply the dressing, the LPN asked the resident to put the salad down. The interaction was observed from the hallway with the door open and no privacy curtain pulled, and five people were seen walking by the room. The LPN later confirmed the door and privacy curtain were open and should have been closed for privacy during wound care. The Unit Manager also confirmed that it is never appropriate for a dressing to be applied or removed during mealtime and that privacy should always be provided for wound care.
Confidential resident medication slip left visible at nurse’s station
Penalty
Summary
Keep residents' personal and medical records private and confidential was not maintained when a pharmacy slip with Resident #1’s name and medication information was left on the ledge of the nurse’s station and remained there during two observations. Resident #1 was an [AGE] year-old male admitted to the facility with peripheral vascular disease and a non-pressure ulcer to the left calf. His MDS reflected that he was cognitively intact with a BIMS score of 13, and his care plan included treatment for an actual skin impairment related to a venous wound of the left calf. The pharmacy slip was observed on top of the nurse’s station ledge at 7:30 a.m. and again at 7:58 a.m., with no staff inside the nurse’s station during either observation. The slip contained the resident’s name and medication information. During interviews, an LVN stated the slip was the facility’s copy for the medication delivered for the resident and should have been secured inside the nurse’s station. The ADON and DON both stated the information should have been protected and kept confidential, and the Administrator stated the slip should not have been visible to others and noted the facility was correcting the same non-compliance from a prior visit.
Improper Release of Protected Health Information
Penalty
Summary
The facility failed to ensure the confidentiality of residents’ protected health information when it released medical records for one resident to that resident’s son and included records belonging to 12 other residents. An email from the resident’s son notified the facility that the scanned packet contained a total of 786 pages and included information from other residents. Facility leadership later verified that the breach occurred when staff scanned requested medical information and sent it by secured email, resulting in protected health information for 12 unrelated residents being disclosed. During interview, the Managed Care Coordinator stated she printed a report from the EMR by entering the first few letters of the resident’s name, saw the resident’s name on the top page, and then scanned the information to the son without recognizing that multiple residents’ records had been selected. The report identified that skilled progress notes containing protected health information for 12 residents were included in the release. The facility policy required PHI to be handled, stored, and communicated in accordance with regulations and required that release of PHI be limited to authorized staff and logged.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release July 29, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.