Health inspection·August 8, 2023

F 0583 Keep residents' personal and medical records private and confidential. Level of Harm - Minimal harm or potential for actual harm **NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on observation, interview, and record review, the facility failed to maintain the privacy of one of 86 residents (Resident 1) who resided within the facility when a staff member recorded a video of Resident 1 (while inside the facility's dining room) and posted the video on a personal social media platform without Resident 1's approval or consent. Residents Affected - Few This failure resulted in a violation of Resident 1's right to privacy and confidentiality as well as a breach of the Health Insurance Portability and Accountability Act law (HIPPA -a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge). Findings: During a review of Resident 1's admission Record (contains Resident 1's medical and demographic information), undated, indicated, Resident 1 was admitted to the facility on [DATE], with diagnoses that included Unspecified Dementia (a brain disease that causes memory disorders, personality changes, and impaired reasoning); Schizoaffective disorder, depressive type (a mental health disorder that is marked by a combination of schizophrenia symptoms, such as hallucinations or delusions, and mood disorder symptoms, such as depression); Anxiety disorder (mental illnesses that causes constant and overwhelming anxiety and fear); restlessness and agitation. During an interview on May 31, 2023, at 3:26 PM, with the Case Manager 1 (CM 1), CM 1 stated on May 22, 2023, she received a call from a former employee (Licensed Vocational Nurse 1 - LVN 1) who wanted to notify her that there was a video of Resident 1 recorded from within the facility's dining room and posted on the social media platform [name of social media]. CM 1 stated LVN 1 sent her the video and she (CM 1) was able to identify Resident 1, and Certified Nursing Assistant 1 in the video because she could see their faces. CM 1 stated the video recording showed Resident 1 and CNA 1 while in the facility's dining room and the video showed Resident 1 flipping someone off across the room. CM 1 then stated she could see from the video that it was from the social media platform [name of social media] and that it was posted to the social media account of Certified Nursing Assistant 2 (CNA 2). CM 1 stated she forwarded the video to the facility's Administrator (ADMIN). During an interview on June 27, 2023, at 10:50 AM, with ADMIN, the ADMIN stated CM 1 brought to his attention that employee CNA 2 had posted a video of Resident 1 to her (CNA 2's) social media account and that the video was taken from within the facility. The ADMIN further stated when he reviewed the video he could see Resident 1 and CNA 1 in the video who were both flipping off someone while in the facility's dining room. The ADMIN stated the video was approximately 5 seconds long, was sent to him via a text, and you could see that the video was posted to the social media account of CNA 2. Page 1 of 2 056365 056365 08/08/2023 Yucaipa Hills Post Acute 13542 2nd St. Yucaipa, CA 92399

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few The admin further stated CNA 2 violated the facilities policy and procedure regarding confidentiality and HIPPA (Health Insurance Portability and Protection Act) when she recorded and posted the video of the resident on social media without his consent. During an interview on June 27, 2023, at 1:20 PM, with CNA 2, CNA 2 stated while she was working at [name of facility] in May of 2023, Resident 1 was flipping someone off while in the facility's dining room. CNA 2 stated she used her personal cell phone to record Resident 1 and posted the video on her [name of social media platform] to show what kind of day she was having at work. CNA 2 stated the story was available to be viewed for 24 hours on her webpage. CNA 2 further stated she did not receive verbal or written approval from Resident 1 to record him or post a video of him on her social media account. A review of the facility's policy and procedure (P&P) titled, Videotaping, Photographing, and other Imaging of Residents, undated, the policy indicated, Residents will be protected from invasion of privacy and/or abuse that might occur from photographs, videotapes, digital images, and recordings during resident care or other facility activities .2. Staff may not take or release images or recordings of any resident without explicit written consent. Written consent must be obtained from the resident or representative prior to obtaining images or recordings of the resident for any purposes other than investigation of abuse, neglect or emergencies .3. Transmitting unauthorized images of any resident through email, internet or social media is considered a violation of resident rights .4. Resident photographs are considered health care records and will be retained and released in accordance with current applicable regulations and statuses governing the release of protected health information . A review of the facility's P&P titled, Protected Health Information (PHI), Authorization for Use or Disclosure of, undated, the policy indicated, Policy Statement. All uses and disclosures of protected health information (PHI) beyond those otherwise permitted by current HIPAA law require a signed authorization. Policy Interpretation and Implementation. 1. The facility and its business associates have a limited right to use and/or disclose PHI health information for purposes of treatment, payment, or for the operations of the organization. 2. For other uses, there must be written authorization to release protected health information unless the law permits or requires the facility to use or disclose this information without authorization .A written or electronic copy of the authorization will be retained in the business office (or other designated location) for a period of six (6) years from the later of the date of execution or the last effective date. A review of P&P titled, Resident rights, undated, indicated, Employees shall treat all residents with kindness, respect, and dignity. Policy Interpretation and Implementation. 1. Federal and state laws guarantee certain basic rights to all residents of this facility. These rights include the resident's right to: a. a dignified existence; b. be treated with respect, kindness, and dignity; c. be free from abuse, neglect, misappropriation of property, and exploitation . e. Self-determination; .g. exercise his or her rights as a resident of the facility and as a resident or citizen of the United States; h. be supported by the facility in exercising his or her rights; .t. Privacy and confidentiality; .3. the unauthorized release, access, or disclosure of resident information is prohibited. All release, access, or disclosure of resident information must be in accordance with current laws governing privacy of information issues. All inquiries concerning the release of resident information should be directed to the HIPAA compliance officer .4. Orientation and in-service training programs are conducted quarterly to assist our employees in understanding our residents' rights. 5. Inquiries concerning residents' rights should be referred to the social services director. 056365 Page 2 of 2