Health inspection·May 6, 2025

F 0842 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Many Safeguard resident-identifiable information and/or maintain medical records on each resident that are in accordance with accepted professional standards. Based on observation, interview, and record review, the facility failed to protect and secure protected health information (PHI) for residents and private information for staff when two of seven sheds (a simple roofed structure used as storage space) were broken into on 4/29/25 and was not secured until 5/6/25. This failure had the potential to result in loss, destruction, or unauthorized use of resident PHI and staff private information. Findings: During a concurrent observation and interview on 5/6/25 at 9:58 a.m. with the Environmental Service Director (ESD) outside behind the facility, two of seven sheds approximately 10 feet x 15 feet made of wood did not have locks and one shed did not have a door. The door to the first shed was missing and wide open with one 8 feet x 10 feet board made of wood standing at a 45 degree angle in front of the shed. The ESD stated the board was used to cover the entrance. Inside the first shed were two four feet high standard filing cabinets (specialized storage unit designed to organize and secure records, charts, and other sensitive information) with four drawers filled with resident medical records containing names, date of birth , social security number, and medical diagnosis (the patient ' s identified diseases and conditions) and one four feet high filing cabinet with four drawers four feet wide filled with employee files containing names, license and certification numbers, vaccination information, and salary (the amount of money a person is paid for working). The filing cabinets did not have a lock. There were over 200 files dated between 2017 and 2019. The second shed had a door but no lock and contained physical therapy equipment (devices and tools used to help patients recover from injuries, disabilities, or chronic conditions to improve mobility, strength, and overall physical function). The ESD stated the sheds were broken into during the night on 4/29/25. The ESD stated the sheds have remained unlocked since 4/29/25 and the facility planned to replace the sheds. The ESD stated he was unaware the sheds contained resident PHI and staff private information. The ESD stated the PHI and private information should be secured immediately and there was room in a metal shed with a lock located next to the wooden sheds where the filing cabinets can be stored. During a concurrent observation and interview on 5/6/25 at 10:38 a.m. with the Medical Records Director (MRD) inside the first shed, the filing cabinets were accessed with no lock. The MRD stated the files contained resident PHI and staff private information and should be kept confidential. The MRD stated it was unacceptable to store PHI and private information in an unsecured location. During an interview on 5/6/25 at 12:15 p.m. with the Assistant Director of Nursing (ADON), the ADON stated she was not aware the filing cabinets in the shed contained resident PHI and staff private Page 1 of 2 055869 055869 05/06/2025 Valley Skilled Nursing Center 515 East Orangeburg Avenue Modesto, CA 95350

F 0842 Level of Harm - Minimal harm or potential for actual harm information. The ADON stated the facility was required to keep resident PHI and staff private information protected and secure because of HIPAA (Health Insurance Portability and Accountability Act - a federal law enacted in 1996 that establishes national standards for protecting the privacy of individuals' identifiable health information). The ADON stated it was unacceptable to store PHI and private information in an unprotected and unsecured location. Residents Affected - Many During an interview on 5/6/25 at 12:17 p.m. with the Director of Nursing (DON), the DON stated the sheds were broken into on 4/29/25 and she was not aware the filing cabinets contained resident PHI and staff private information. The DON stated the sheds should have been secured immediately after it was discovered that the sheds were broken into. The DON stated anyone could have access to the files and it was unknown if files were stolen. The DON stated it was unacceptable to store PHI and private information in an unsecured location. During an interview on 5/6/25 at 11:52 a.m. with the Administrator (ADM), the ADM stated the sheds were broken into on 4/29/25 and the facility planned to replace the sheds. The ADM stated he was not aware the filing cabinets in the first shed contained resident PHI and staff private information. The ADM stated the previous Human Resources Manager informed him the sheds did not contain PHI and private information on 4/29/25. The ADM stated staff should have inspected the filing cabinets to ensure that all PHI and private information were protected and secure. The ADM stated PHI was regulated by HIPAA and the facility was required to protect and secure it. The ADM stated it was unacceptable not to secure the sheds and the filing cabinets immediately after the break in. During a concurrent observation and interview on 5/6/25 at 12:20 p.m. with the DON and ESD inside the metal shed located next to the wooden sheds, the filing cabinets with resident PHI and staff private information were relocated and stored. The metal shed was secured with a lock on the door. The DON stated the filing cabinets will remain in the metal shed to protect resident PHI and staff private information. The ESD stated the filing cabinets will remain in the metal shed until the facility replaced the broken sheds. During a review of the facility ' s policy and procedure (P&P) titled, Protected Health Information (PHI), Management and Protection of, dated 4/2014, the P&P indicated, Policy Statement: Protected Health Information (PHI) shall not be used or disclosed except as permitted by current federal and state law. Policy Interpretation and Implementation: 1. It is the responsibility of all personnel who have access to resident and facility information to ensure that such information is managed and protected to prevent unauthorized release or disclosure . During a professional reference review retrieved from https://www.hhs.gov/hipaa/for-professionals/privacy/index.html#:~:text=The%20HIPAA%20Privacy%20Rule%20establishe The HIPAA Privacy Rule, dated 9/27/24, the professional reference indicated, The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as protected health information) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual ' s authorization . 055869 Page 2 of 2