Failure to maintain privacy during personal care. A resident who was cognitively intact and dependent on staff for toileting received peri care in a semi-private room while privacy curtains were not pulled, door window coverings were open, and the outside window was open with cars passing by. Two CNAs confirmed the curtains and coverings should have been closed, and the ADON stated CNAs should close privacy curtains and window coverings during personal care.
Confidentiality of medical records was not maintained for two residents. An emergency contact for a discharged resident reported receiving copies of another resident’s records, including physician names, NOK information, contact details, guardian and POA information, religious preferences, funeral home and cemetery information, flu shot date, admission date, marital status, and Medicaid ID number. The Administrator and DON confirmed only the resident and POA should have access to the records.
Resident privacy was not maintained during medication administration when an LPN prepared meds inside the building, took them to a smoking tent, and handed a resident her medication in front of four other residents without asking permission. The resident questioned why meds could not wait until she returned inside, and the LPN also handled a potassium chloride tablet with bare hands, broke it in half, and gave it back to the resident.
Improper Release of PHI: A staff member released a resident’s requested medical records to the resident’s son, but the packet also included skilled progress notes and other PHI for 12 unrelated residents. The error occurred when the staff member printed records from the EMR using only the first few letters of the resident’s name and did not recognize that multiple residents’ documents had been selected before sending the scanned records by secure email.
Failure to maintain privacy during wound care. An RN left the blinds open to a window facing the parking lot while completing a sacral dressing change for a resident with intact cognition and significant ADL dependence. The resident’s partially naked body was visible from outside, and the resident stated she wanted the blinds closed during treatment. Facility policy required a closed door, a drawn curtain, or both during personal care and treatment procedures.
Failure to maintain privacy during incontinence care: A resident with multiple diagnoses, including dementia and psychiatric conditions, was incontinent and required transfer to bed for care. Two CNAs removed soiled clothing and provided care with the bed near an exterior window and the curtains left open, exposing the resident’s perinium and buttock while an LPN applied barrier cream; the CNAs confirmed the resident was not given sufficient privacy.
Unsecured Resident Medical Records Found in Open Rooms: Surveyors observed resident medical records stored on surfaces in an open, unlocked room and in another room with the door wide open, including an open binder with medical records and COVID vaccination information. An LPN stated the former memory care unit doors were never locked after closure, and the administrator confirmed that two rooms contained resident medical records and were left unlocked and open despite the facility having a dedicated medical records room.
Failure to Maintain Resident Privacy During Assessments, Insulin Administration, and Record Access: A NP assessed three residents in a public dining area with other residents and staff nearby, and an RN performed blood glucose testing and gave insulin to a resident at a dining table while the resident was eating. In a separate event, an open eMAR on a med cart exposed residents' names, photos, and room numbers until the DON closed it; staff confirmed the privacy breaches.
Surveyors found that during a morning med pass on one hall, RNs repeatedly left a medication cart laptop open with the electronic charting system visible and accessible while walking away to administer meds in resident rooms. A staff member confirmed the laptop remained open and unsecured even as a resident ambulated nearby. In interviews, an RN acknowledged not following the expected practice of minimizing the charting system and closing the laptop screen, and facility leadership confirmed there was no formal written policy on securing laptops when staff left the med cart, despite an expectation that screens be closed to prevent visibility.
A resident with moderate cognitive impairment and multiple medical conditions had a designated healthcare and financial POA, but the facility provided the resident’s face sheet to an outside contractor without obtaining written authorization from the POA, contrary to its HIPAA policy. The POA reported she did not consent to the disclosure and that the contractor contacted the resident’s bank and insurance company without her approval. The resident, who reported significant memory issues, was unaware her information had been shared and later expressed feeling unhappy and uneasy about the unauthorized access, while the contractor confirmed receiving the face sheet from the facility.
Self-audit
Pick a level of detail and, optionally, what to focus on — then generate a survey-ready checklist distilled from the most recent citations.
Beta · AI-generated — for reference only, not professional advice. Verify against current CMS guidance before relying on it. Assisto accepts no responsibility for how this checklist is used.
Citations used to create this checklist
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release August 26, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.