Failure to Conduct Annual Security Vulnerability Assessment
Summary
The facility failed to maintain its security management plan in accordance with NFPA 99 standards. During a record review conducted on April 30, 2025, it was found that the facility did not provide documentation of an annual security vulnerability assessment. The last assessment available was dated January 25, 2023, indicating that the required annual review had not been conducted. This deficiency was identified during a review with the Director of Plant Operations, who acknowledged the findings. The issue was also discussed with the Administrator and the Director of Plant Operations during the exit conference on the same day.
Plan Of Correction
No residents were affected by this alleged deficient practice as of 05/16/2025 and none can be identified as of 05/16/2025. The maintenance director and assistants were educated by the Executive Director on 05/16/2025 on K1150. The annual security vulnerability assessment was completed on 05/15/25 by the Executive Director. The assessment was brought to QAPI on 05/21/25 for review. The security vulnerability assessment will be reviewed annually per K1150 by the Executive Director and QAPI Committee.
Penalty
Surveyors found that the facility did not comply with NFPA 99 (2021) requirements for security management because it lacked documentation showing that its Security Vulnerability Assessment (SVA) was updated and reviewed on an annual basis. During record review with the Maintenance Director and the Administrator, no current or yearly SVA documentation could be produced, and both leaders acknowledged that the assessment had not been updated and reviewed each year, resulting in a cited Class III deficiency affecting all occupants in the event of a fire or other emergency.
Failure to Annually Update and Review Security Vulnerability Assessment
Penalty
Summary
The facility failed to comply with NFPA 99 (2021 Edition) security management requirements by not maintaining an annually updated and reviewed Security Vulnerability Assessment (SVA). During record review between 9:15 AM and 1:30 PM with the Maintenance Director and the Administrator, surveyors requested documentation showing that the SVA had been updated and reviewed each year, as required by Section 13.3 of NFPA 99. The facility was unable to provide such documentation, and both the Maintenance Director and the Administrator acknowledged that the Security Vulnerability Assessment had not been updated and reviewed annually. This deficiency was cited as a Class III violation and was noted as having the potential to affect all occupants in the facility in case of a fire or other emergency. No specific residents, medical histories, or clinical conditions were mentioned in the report, and the deficiency pertained to facility-wide security and emergency preparedness documentation rather than to individual patient care events.
Plan Of Correction
Security vulnerability assessment was reviewed and a signature page was placed in the binder. The facility has determined that all residents have the potential to be affected. An in-service education program will be conducted by the administrator. The administrator will conduct a three month check to verify completion of documentation.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release June 24, 2026) and official state health department websites — never guesswork.
Trusted by long-term care providers and associations.
