Health inspection·May 31, 2023

F 0573 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few Let each resident or the resident's legal representative access or purchase copies of all the resident's records. **NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on record review, staff interview, and family interview, the facility failed to provide a requested medical record for one Resident (#2) reviewed for access to medical records. Findings included: Resident #2 was originally admitted on [DATE], hospitalized on [DATE], and discharged home on [DATE] according to the clinical record. During an interview with the facility Medical Records Coordinator on [DATE] at 3:21 PM, she was asked to explain the procedure for a resident or family requesting a copy of their medical record. The Medical Records Coordinator stated she gives the resident or family an authorization for release form, she will scan the paper record, and send it up to Corporate. The facility medical records consists of both electronic information and paper information. The Medical Records Coordinator would wait for the response from corporate and then would forward the medical record to corporate. Corporate sends the medical record from their headquarters with a letter of approval. The Medical Records Coordinator stated it normally takes about 3 days. The Medical Records Coordinator said that the facility would charge for copies of the medical record. The resident or family would have to pay up front before receiving the medical records. After payment, the resident or family would receive a paper copy of their medical record. The facility Medical Records Coordinator provided a copy of the Authorization for Release of Health Care Information signed by Resident #2's family member on [DATE] to request Resident #2's medical records and billing records for continued medical care and insurance. Additionally, the Medical Records Coordinator provided a copy of a letter dated [DATE] from the facility's attorneys that was sent via email to the Medical Records Coordinator regarding the Authorization for Release of Health Care Information. The letter documented that the request for the medical records was determined to be HIPAA (Health Insurance and Portability and Accountability Act (federal health care privacy of information rule)) and the facility attorneys would send further correspondence and an invoice for copy reproduction and postage charges. The Medical Records Coordinator showed a copy of a letter sent via email to the facility Risk Manager on the same date to authorize the facility to send the resident's paper record to attorneys. The facility Medical Records Coordinator was asked for documentation that Resident #2's family member received the medical record that they requested. The Medical Records Coordinator could not find any proof that the medical record was sent to the resident's family. The Medical Records Coordinator tried to call the attorney group several times, but did not ask to speak to anyone. The surveyor asked the Medical Records Coordinator if the family paid the facility for the copy reproduction and postage charges for the medical record. The Medical Records Coordinator stated the Business Office would have documentation of payment by the family. Page 1 of 5 106112 106112 05/31/2023 Tampa Lakes Health and Rehabilitation Center 750 Hayes Rd Lutz, FL 33549

F 0573 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few On [DATE] at 3:25 PM, an interview was conducted with the Business Office Manager (BOM). The BOM was asked if they have a receipt or documentation of Resident #2's payment for copies of their medical record. She looked through several receipt books, but could not find it. She said she would have to look for the information. At 4:20 PM, on [DATE], the Medical Records Coordinator provided a copy of the receipt for $20.22, dated [DATE] for payment by Resident #2's family for copies of the requested medical records. At that time, the Medical Records Coordinator stated that they are still looking for documentation to show that the family of Resident #2 received the requested medical record from corporate. During an interview with the Director of Nursing (DON), on [DATE] at 4:23 PM, the DON was asked if she knew if Resident #2's family received a copy of the medical record they requested. She said she would try to find out. At the exit on [DATE] at 4:50 PM, the facility Administrator stated that they could not find any proof that the family of Resident #2 received a copy of the medical record they requested. During an interview with Resident #2's daughter on [DATE] at 9:24 AM, the day after the investigation survey, she stated that they still have not received a copy of the medical record they requested. Resident #2's wife stated during a telephone interview on [DATE] at 10:50 AM, that she has not received the copy of the medical record and that she went in person to the facility to pay for a copy of the medical record in [DATE]. In an email from the Administrator to the surveyor on [DATE] at 11:58 AM, documented the following: The Administrator did not hear back from the attorney group. They did not have proof that they had sent records to the requestor. The Administrator requested they do so and the firm [attorneys] confirmed with the Administrator that they have sent the records. Unfortunately the Administrator was unable to prove otherwise, The facility policy for Medical Records - Access and Release (not dated and no facility name) included the following: AUTHORIZED ACCESS . . 2. All requests for medical records shall be directed to the Medical Records Department. The facility Administrator and/or Risk Manager shall be notified of any attorney request for records. 3. Release of information from the medical record shall be carried out in accordance with all applicable legal, accrediting and regulatory agency rules and requirements. . 6. Patients and their legal representatives shall have access to their medical records in accordance with state law. RELEASE OF RECORDS (General) . 1. All requests for information contained in the medical record shall be directed to the Medical Records Department for processing. 2. The Medical Records Department shall review each request and verify the following: 106112 Page 2 of 5 106112 05/31/2023 Tampa Lakes Health and Rehabilitation Center 750 Hayes Rd Lutz, FL 33549

F 0573 Level of Harm - Minimal harm or potential for actual harm -The legitimacy of the request. The purpose for the request must be described in the request along with the part(s) of the record to be released and to whom. - The authenticity of the signature. The signature on the request should be compared with the patient or responsible party. Residents Affected - Few - Return inappropriate request to the requesting party with a cover letter explaining the reason the request was rejected. Include with the letter a blank authorization form (a sample is attached) if appropriate. 3. Review the medical record for completeness and any documentation of drug/alcohol abuse, psychiatric care and HIV information. 4. Photocopy the part(s) of the record to be released. 5 Calculate the fee for copying, if appropriate. 6. Forward the copied record and the bill for copying to the requesting party. 7. The request for record and signed authorization shall be placed, under a separate tab in the patient's medical record. RELEASE OF RECORDS (By Requesting Party) . .9. Patient/Family Member/Responsible Party - Request must be in writing and accompanied by written authorization if the requesting party is someone other than the patient. - Release information as requested according to State regulation. - Charge for copies according to current schedule. The facility policy for Medical Records - Response to Request for Medical Records (not dated and no facility name) included the following: POLICY . Any request for medical records should be made in writing and directed to the facility Administrator or Designee. The Administrator or Designee will ensure that a copy of the request is forward to the facility attorney for review. The facility is required by state and federal law to protect the confidentiality of every resident's private health information. No record shall be released to any party until advised to do so by facility attorney. PROCEDURE . Prior to sending the request for medical records to the facility attorney for review, the Administrator or Designee will ensure the request includes: 106112 Page 3 of 5 106112 05/31/2023 Tampa Lakes Health and Rehabilitation Center 750 Hayes Rd Lutz, FL 33549

F 0573 1. Completed Authorization for Release of Medical Information form Level of Harm - Minimal harm or potential for actual harm 2. Resident face sheet 3. Evidence of authority to receive private health information (if request is not made by the resident): Residents Affected - Few a. Power of Attorney (for living resident) b. Health Care Surrogate or Health Care Proxy (with statement of incapacity) c. Guardianship documents d. Letter of Administration (for a deceased resident) The Administrator or Designee will send the request to the facility attorney in a secure format. NO FURTHER ACTION SHOULD BE TAKEN AT THIS TIME UNTIL DIRECTED TO DO SO BY FACILITY ATTORNEY. The facility attorney will review the request to determine whether it complies with all applicable Federal and State regulations regarding the release of medical records. If the request does not comply with the applicable regulations, the attorney will inform the requesting party, in writing, advising of the reason(s) why the record cannot be released. A copy of that email will be forwarded to the facility. If the request complies with the applicable regulations, the facility attorney will advise the facility in writing the request is HIPAA compliant and instruct the facility on how to proceed. Upon receipt of written instruction from the attorney to release the record, the Administrator or Designee will coordinate the preparation of the record. Any record that is in paper form at the facility should scanned into an electronic format. The facility should report the time spent to produce the record in electronic form to the attorney. The facility attorney will use this to generate an invoice. If records are requested in paper form, copy work will be completed at the facility for records of 100 pages or less. If the number of pages exceeds 100 the record may be taken to a copy service for copying. A facility employee will remain with the record at all times. After copying, the original record and one copy of the record will be stored in a secure location in the facility. The second copy of the record will be sent to the facility attorney that can be tracked. The facility should keep a copy of the record that was sent to the facility attorney regardless of the format it was produces as. The facility attorney will generate an invoice and send it to the requesting part and copy the facility. The facility attorney will release records to the requestor only after payment has been made. It is the facilities [sic] responsibility to notify the facility attorney when payment has been made for the requested records. The facility attorney will notify the facility administrator or Designee when the record has been 106112 Page 4 of 5 106112 05/31/2023 Tampa Lakes Health and Rehabilitation Center 750 Hayes Rd Lutz, FL 33549

F 0573 sent to the requestor. Level of Harm - Minimal harm or potential for actual harm The facility Administrator or Designee is responsible for maintaining a log of all record request and a file for each request. The log should contain the following information: Residents Affected - Few 1. Resident name 2. Date request was received 3. Name of requesting party 4. Date request was sent to the facility attorney 5. Disposition of request (e.g. record released on [DATE] or record not released at discretion of facility attorney). 106112 Page 5 of 5