Unauthorized Resident Recording and Disclosure Violating Privacy and Confidentiality
Summary
The deficiency involves a failure to protect residents’ privacy and confidentiality when a CNA used a personal cell phone to record and photograph two residents without their knowledge or consent, and then shared that content with another CNA. One resident had paraplegia, depression, muscle weakness, dorsalgia, and polyneuropathy, was cognitively intact, and dependent on staff for ADLs. The other resident had diagnoses including seizures, dysphagia, acute kidney dysfunction, and muscle weakness, was able to make needs known but could not make medical decisions, had severely impaired decision-making, and was also dependent on staff for ADLs. Both residents were therefore in a position of dependence on staff for care at the time of the incident. According to CNA 2, on a specific date she recorded a video of the two residents because one resident started an altercation with the other. She stated she recorded the incident for “evidence” and to show CNA 1, acknowledging that recording residents was not part of facility policy and that she should not have recorded or taken photographs of them. CNA 1 confirmed that she received the video on her personal cell phone from CNA 2 and stated that the recording was made for “safety purposes” due to a situation that was perceived as potentially escalating to physical aggression. CNA 1 reported that she did not share or post the video on social media or distribute it to others, but that a family member took her phone without permission and accessed its contents. CNA 1 further stated that this family member sent the video and pictures of the two residents to the facility, and that she notified the facility that her phone had been taken but did not disclose that it contained videos or photographs of the residents because she was unaware that the family member had accessed or distributed them. The DSD reported receiving a text message from an unknown number containing approximately two videos and an undetermined number of photographs of the two residents, along with the names of CNA 1 and CNA 2. The DSD, LVN 2, and the Administrator each stated that staff were required to follow HIPAA regulations, that staff were not permitted to record or possess videos or photographs of residents on personal devices, and that any photographs of residents required consent and had to be for medical purposes as part of the medical record. Facility policies on confidentiality, residents’ rights, and dignity stated that unauthorized release, access, or disclosure of resident information, including video or audio, was prohibited and that staff must protect resident privacy and treat residents with dignity and respect. The videos received by the DSD did not show an altercation between the residents, and staff interviews confirmed that filming residents was not part of the facility’s “Stop and Watch” process, which instead required observation, intervention, and reporting of changes in condition or behaviors to nursing staff.
Plan Of Correction
This Plan of Correction is the facility's credible allegation of compliance. Preparation and/or execution of this plan of correction does not constitute admission or agreement by the provider of the truth or facts alleged, or conclusions set forth in the statement of deficiencies. The plan of correction is prepared and/or executed solely because it is required by the provisions of federal and state law. F0583 Personal Privacy/Confidentiality of Records How corrective action(s) will be accomplished for those residents found to have been affected by the deficient practice: Corrective actions were immediately implemented for Resident 1 and Resident 2 upon identification of the deficient practice. The facility initiated an investigation on 03/23/2026 and conducted immediate interviews with staff and residents utilizing structured interview tools to assess scope, impact, and additional potential concerns. Interviews confirmed the incident was isolated and no additional residents reported privacy violations or concerns. The staff members involved were removed from duty immediately. Following completion of the investigation, both employees were terminated in accordance with facility policy due to violation of resident rights, HIPAA, and facility confidentiality policies. Both employees completed formal Declarations and Attestations of Deletion of Unauthorized Recordings, confirming removal of all recordings and non-distribution of content. Documentation includes: Ashley Zelaya, CNA – Declaration executed 03/30/2026 at 9:21 AM, attesting deletion of all recordings and acknowledgment of policy violation Leslie Bram Reyes, CNA – Declaration executed 03/26/2026 at 10:42 AM, attesting deletion of all recordings and acknowledgment of policy violation Residents and/or responsible parties were notified. Social Services completed assessments with no identified psychosocial harm. All corrective actions were completed by 03/26/2026. How the facility identifies other residents having the potential to be affected by the same deficient practice and what corrective action will be taken. A facility-wide audit was initiated on 03/25/2026 using the Briarcrest Comprehensive Privacy, Recording, and Resident Rights Audit Tool. The audit included direct observation, staff interviews, and resident interviews to evaluate compliance with privacy practices, personal device use, and HIPAA requirements. Interviews were conducted using standardized staff and resident interview tools to ensure consistency and thoroughness in data collection. Findings from the audit confirmed that no additional residents were affected by the deficient practice and no additional incidents of unauthorized recording or disclosure were identified. Staff were immediately re-educated by Director and staff development on HIPAA Privacy Rule requirements, the facility's prohibition on personal device recordings, and the appropriate use of the Stop and Watch process for reporting changes in resident conditions. This corrective action was completed by 03/27/2026. What measures will be put into place or what systemic changes will the facility make to ensure that the deficient practice does not recur. The facility implemented systemic changes to prevent recurrence of the deficient practice by reinforcing a zero-tolerance policy for unauthorized recordings and strengthening staff accountability related to resident privacy and confidentiality. Staff completed mandatory re-training by the Director of Staff Development on Resident Rights, HIPAA, and Privacy/Confidentiality requirements. Staff were required to re-acknowledge facility policies related to confidentiality and personal device use. The facility implemented routine supervisory rounding to monitor compliance with personal device restrictions. In addition, the facility installed visible signage at the receptionist area clearly articulates that video recording is strictly prohibited inside resident rooms and in any facility areas where residents are present. The facility also posted signage throughout the entire facility, in both English and Spanish, indicating that video recording is not allowed to ensure clear communication to staff, visitors, and all individuals entering the facility. Privacy and HIPAA compliance were further integrated into new employee orientation, annual competencies, and ongoing in-service education. The Director of Staff Development completed initial re-education by 03/27/2026, and staff completed required training by 04/05/2026. How the facility plans to monitor its performance to make sure that solutions are sustained. To ensure sustained compliance, the facility incorporated privacy and confidentiality monitoring into its Quality Assurance and Performance Improvement (QAPI) program. The facility implemented an ongoing monitoring system beginning on 03/25/2026 utilizing the established audit tool, which confirmed that no additional residents were affected, and no further incidents occurred during the initial audit period. The facility will continue monitoring through weekly audits for four consecutive weeks, followed by monthly audits for three months. These audits will include direct observation of staff practices, verification of compliance with personal device policies, and evaluation of adherence to HIPAA and privacy requirements. Audit findings will be documented using standardized tools and reviewed by the Director of Nursing, with results reported to the Quality Assurance and Performance Improvement (QAPI) Committee for analysis and trending. If any issues are identified, immediate corrective action will be implemented, including re-education and progressive discipline as appropriate. If no trends or repeat deficiencies are identified after the monitoring period, the facility will discontinue routine auditing and remove the issue from active QAPI monitoring. Dates when corrective action will be completed. 4/17/2026
Penalty
Resources
Below are regulatory guidelines relevant to this citation:
Electronic Medical Records Left Visible on Unattended Computers: Two residents' EMRs were left open and visible on unattended computers during wound care and med pass. One resident had HTN, DM, and malnutrition with moderate cognitive impairment, and another resident had acute respiratory failure with hypoxia, HTN, DM2, and Afib with intact cognition. Staff confirmed the screens were left open and available for public view.
A resident's confidential medical information was left visible on the East med cart computer screen at the nurses station when the cart was unattended. An RN confirmed the observation and acknowledged that resident personal and clinical information was exposed to anyone passing by.
A facility failed to keep residents’ personal and medical records secure and confidential. Medical record review showed hospice notes were entered directly into the EMR for three residents, and the regional clinical director stated the hospice previously used was given full access to the EMR for all residents. The Resident Rights policy stated residents have a right to secure and confidential personal and medical records.
Failure to Deliver Resident Mail Promptly: The facility failed to ensure residents could send and receive mail and other materials in a timely manner. In a group interview, multiple residents stated they never received mail or that mail was not distributed on Saturdays because the AD did not work weekends. The AD said she passed mail Monday through Friday and was unsure who handled Saturday delivery, while the Administrator said weekend nursing staff were expected to pass mail. The facility policy required mail delivery within 24 hours of receipt.
A cognitively intact female resident with Guillain-Barre Syndrome, depression, muscle weakness, and dependence on staff for toileting received incontinent care from two CNAs while her roommate was present in the room, and the privacy curtain was not pulled at any time. The resident’s care plan documented a self-care deficit and need for assisted incontinent care, and facility policies on perineal care and resident rights required staff to provide privacy, including use of doors, curtains, and blinds. In post-incident interviews, both CNAs acknowledged that privacy should have been provided during the care and recognized that doing so is part of respecting resident rights and dignity, while the DON and Administrator confirmed their expectation that staff follow these privacy practices.
Two cognitively intact male residents with diabetes, one with additional psychiatric diagnoses, received blood glucose checks and, for one resident, an insulin injection in an open area near the nurse’s station rather than in a private setting, exposing their medical treatment to others. Facility leadership, including the DON and Administrator, acknowledged that facility policy and practice required such medical treatments to be performed in residents’ rooms to protect privacy and confidentiality of personal and medical records, and that providing these services in public areas was inconsistent with resident rights and privacy standards.
Electronic Medical Records Left Visible on Unattended Computers
Penalty
Summary
Keep residents' personal and medical records private and confidential was not maintained when electronic medical records were left open and visible to others. Facility policy stated resident health information must remain private and that the MAR must remain closed or covered when not in direct use. Resident #76, who was admitted with diagnoses including hypertension, diabetes, and malnutrition and had a BIMS score of 8 indicating moderate impairment, was observed on 5/11/2026 at 2:37 PM with the wound care cart unattended and the computer on top of the cart open to the resident's electronic medical record and available for public view. The wound care nurse later returned and confirmed the screen had been left open to Resident #76's record. Resident #41, who was admitted with diagnoses including acute respiratory failure with hypoxia, essential hypertension, type 2 diabetes mellitus, and paroxysmal atrial fibrillation and had a BIMS score of 13 indicating cognitive intactness, was observed during medication administration on Cart 700 on 5/12/2026 at 7:40 AM when RN A walked away from the medication cart leaving the computer open and the resident's electronic medical record available for public view. A later observation at 8:01 AM showed RN A entering a room while the computer remained open with Resident #41's electronic medical information still visible. RN A confirmed the screen was open and available for public view, and the President of Clinical Operations later confirmed the electronic medical record should not be unattended and left open for public view.
Failure to Protect Confidential Resident Information
Penalty
Summary
The facility failed to maintain the confidentiality of a resident's medical information on the East Medication Cart. Facility policy titled Quality of Life - Dignity, dated 1/6/26, stated that staff shall maintain an environment in which confidential clinical information is protected. During an observation on 5/4/26 at 11:38 a.m., the East Medication Cart at the nurses station was left unattended with the computer screen open, and identifiable resident personal and confidential information was visible to anyone passing by. During an interview at the same time, RN Employee E9 confirmed the observation and acknowledged that the facility failed to maintain the confidentiality of residents' medical information.
Failure to Protect Confidential Medical Records
Penalty
Summary
The facility failed to ensure residents’ personal and medical records remained secure and confidential. Medical record review showed that resident #26 received hospice services beginning on 1/2/26, resident #83 received hospice services beginning on 1/21/26, and resident #84 received hospice services beginning on 2/5/26, and the hospice provided documented notes directly into the electronic medical record system. During interview on 5/6/26 at 12:44 PM, the regional clinical director stated the only hospice used prior to a change in operator was given full access to the electronic medical record for all residents. Review of the facility’s Resident Rights policy stated residents have a right to privacy and confidentiality of personal and medical records and the right to secure and confidential records.
Failure to Deliver Resident Mail Promptly
Penalty
Summary
The facility failed to ensure residents had the right to send and receive mail, and to receive letters, packages, and other materials delivered to the facility through means other than the postal service, for 6 confidential residents reviewed for communication privacy rights. During a confidential group interview, 6 of 9 members stated they never received mail, and 3 of 9 residents stated mail was not distributed at the facility on Saturdays because the Activity Director did not work on Saturdays. During interviews, the Activity Director stated she was responsible for delivering mail and that she passed residents' mail Monday through Friday, but was not present on weekends and was not sure whether any staff were assigned to pass mail on Saturdays. She also stated that when she arrived on Monday, mail was in her box to pass out. The Administrator stated her expectation was for mail to be passed on Saturday by weekend staff, and that there was not one specific person assigned to pass mail on the weekend, only nursing staff in general. Record review of the facility policy titled Resident Right to Privacy in Communication stated that mail or other materials should be delivered to the resident within 24 hours of delivery by the postal service, including a post office box, and outgoing mail should be delivered to the post office within 24 hours except when there is no regularly scheduled postal delivery and pick-up service.
Failure to Provide Privacy During Incontinent Care
Penalty
Summary
Surveyors identified a failure to provide personal privacy during incontinent care for 1 of 7 residents reviewed. The resident was an adult female with Guillain-Barre Syndrome, anxiety, major depressive disorder, muscle weakness, and a need for assistance with personal care. Her MDS showed she was cognitively intact with a BIMS score of 15, usually understood and was understood by others, and was dependent on staff for toileting. Her care plan, revised 1/3/26, documented a self-care deficit related to impaired physical mobility and called for incontinent care with one-person staff assist. On 4/29/26 at 1:16 p.m., CNA A, with assistance from CNA B, provided incontinent care to the resident while her roommate was lying in bed with eyes closed. During this care, the CNAs did not pull the privacy curtain at any time. In interviews, CNA B acknowledged that the privacy curtain should have been pulled and admitted the resident had not been provided privacy, stating she forgot to ensure the curtain was pulled and recognizing privacy was needed so no one could watch and so the resident was covered. CNA A stated that during incontinent care the door should be shut or the privacy curtain pulled and believed the curtain had been shut during this care, and identified resident rights as the reason for providing privacy. The DON and Administrator both stated their expectation that staff provide privacy during personal care by closing the door, pulling the privacy curtain, and closing the blinds, consistent with the facility’s Perineal Care procedure and Resident Rights policy, which require providing privacy and treating residents with dignity and respect, including privacy and confidentiality.
Failure to Protect Resident Privacy During Glucose Monitoring and Insulin Administration
Penalty
Summary
The facility failed to ensure residents' rights to personal privacy during medical treatment and personal care for two residents who received glucose monitoring and insulin administration in public areas. On a specified date, staff obtained blood glucose readings for both residents and administered an insulin injection to one resident in an open setting rather than in a private location. These actions occurred despite facility expectations that such care be provided in residents' rooms to protect personal and medical information. Resident #1 was an adult male, initially admitted in January 2025, with a diagnosis of Type 2 diabetes mellitus and prescription orders for multiple diabetic medications, including Insulin Aspart, Tresiba, metformin, and glucagon. His Quarterly MDS showed a BIMS score of 13, indicating he was cognitively intact, and he required insulin injections six days per week. Physician orders directed Insulin Aspart administration three times daily at set times. On the cited date, his glucose reading and insulin injection were provided in a non-private setting, contrary to his care plan focus on diabetes management and the facility’s stated practice. Resident #2 was an adult male with an initial admission in 2019 and readmission in 2024, with diagnoses including diabetes mellitus, dementia, bipolar disorder, and schizophrenia. His Comprehensive MDS documented a BIMS score of 15, indicating he was cognitively intact, and he required insulin injections seven days per week. He also had orders for Insulin Aspart three times daily. On the same date, his glucose reading was obtained in an open area rather than in his room. Interviews with the DON and Administrator confirmed that facility practice and policy required treatments such as glucose checks and insulin injections to be completed in residents’ rooms to maintain privacy and confidentiality of medical information, and that providing such care in open areas was inconsistent with the facility’s resident rights and privacy policy. Record review of the facility’s undated Resident Rights policy stated that residents have the right to personal privacy and confidentiality of personal and medical records, and that personal privacy includes accommodations, medical treatment, and personal care. The DON stated that privacy protections included administering orders in a private setting and that care needed to be completed in residents’ rooms, describing provision of such care in open areas as a HIPAA violation because it could share diagnosis information with others nearby. The Administrator similarly stated that glucose readings and insulin injections should be completed in residents’ rooms due to privacy concerns and that performing these treatments at the nurse’s station exposed residents’ diagnoses and treatments. Documentation from the HR coordinator showed the last facility-wide in-service on resident rights occurred in November 2025.
Trusted data from CMS and state health departments
Every citation, penalty and Plan of Correction is sourced from public CMS records (latest release August 26, 2026) and official state health department websites — never guesswork.
In your survey window? See what surveyors are citing.
The Survey-Prep Report maps your facility's risk from 12 months of CMS and state citation data — what's being cited around you and what to check first. $129 one-time.