Health inspection·September 20, 2023

F 0583 Keep residents' personal and medical records private and confidential. Level of Harm - Minimal harm or potential for actual harm Based on interview and record review the facility failed to maintain privacy and confidentiality of personal and health information for two residents (R8 and R9) of 4 residents reviewed for medical records in the sample of 10. Residents Affected - Few Findings include: R8's Assessment signed by V13 (Nurse Practitioner) dated 7/1/22 at 1:52 PM, documents R8's personal information was uploaded into R1's electronic medical record. The information included the following: R8's date of birth , address, and phone number. It included that R8 has dementia due to Parkinson's Disease without behavioral disturbance, Anxiety, Chronic Diastolic Congestive Heart Failure, Diabetes Mellitus Type 2, and a Urinary Tract Infection. The record also went on to state that R1 was a new resident and included additional information concerning R8's plan of care, active problems, and physical exam. (This information was included with R1's electronic records that were to be sent to a facility R1 requested to transfer to.) On 9/19/23 at 11:23 AM, V2 (Director of Nursing) and V12 (Regional Support Nurse) came in with a laptop computer and showed that there was information about R8 in R1's electronic medical records. On 9/19/23 at 11:23 AM, V1 (Regional Director of Operations) stated that the uploaded progress notes that were in the history for R1 included documents in the file that were for R8. This is the file that the corporate office could have sent to V9 (R1's Power of Attorney). V1 also stated, We cannot prove or disprove it was sent to V9 (R1's Power of Attorney), but there is the possibility. On 9/19/23 at 12:58 PM, V9 (R1's Power of Attorney) stated that in with R1's paperwork that V9 received from the facility was information about a catheter for (R9) and it was signed by a doctor. V9 emailed the above-mentioned records that were included in R1's records and review indicted the paperwork was a Physician Notification Form that was sent to V10 (R9's Primary Care Physician) dated 8/05/22, which documented (R9) requests SP (Super Pubic) catheter be changed on routine basis. Need orders please for SP cath (catheter) change and how often. On 9/19/23 at 1:12 PM, V2 (Director of Nursing) stated Evidently we do have an issue with confidentiality of resident's medical records that we need to figure out. On 9/20/23 at 12:12 PM, V2 (Director of Nursing) stated that each resident is given a copy of their rights upon admission, and they are told in Resident Council Meetings about their rights. They are aware their information is to be confidential. On 9/20/23 at 1:41 PM, V2 (Director of Nursing) stated that she assumes the mix up (with R9's Page 1 of 2 145820 145820 09/20/2023 Mount Sterling Health and Rehab Center 435 Camden Rd Mount Sterling, IL 62353

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few records) happened on the fax/printer machine. The paperwork for R9 was probably on the machine when R1's papers were printed for V9 (R1's Power of Attorney). As far as how R8's medical records were in with R1's electronic record is unknown. V2 also stated We all agree there is a problem. The Resident Rights Booklet dated 11/18, documents You have a right to privacy and confidentiality of your personal and medical records. Your medical and personal care are private. Your facility may not give information about you or your care to unauthorized persons without your permission unless you are being transferred to a hospital or to another health care facility. The Electronic Medical Records policy dated 7/1/23, documents Purpose: To provide guidance to the facility regarding the use and storage of electronic medical records. Responsibility: It is the responsibility of the Administrator, or designee, to understand and ensure compliance of the facility of the electronic medical records policy. Policy: Electronic medical records may be used in lieu of paper records when approved by the Administrator and stored/maintained as required. Policy Interpretation and Implementation 2. the administrator, in conjunction with the quality assessment and assurance committee, shall review requests for and the implementation of our electronic medical records system. 8. Our electronic medical records system has safeguards to prevent unauthorized access of electronic protected health information (e-PHI). These safeguards include administrative, technical and physical safeguards that are appropriate for: a. the probability and criticality of risks to e-PHI based on a thorough risk analysis conducted by this facility; b. the size, complexity and capabilities of this organization; and c. the technical infrastructure, hardware, software and security capabilities. The Employee Handbook on page 45, documents, Section 5-21 Patient [NAME] of Rights, We firmly believe that each resident should expect and receive the highest quality of personal and professional care. In keeping with our philosophy, we are committed to supporting and adhering to the Patient's [NAME] of Rights. The Patient's [NAME] of Rights, in part, states that a resident: Will be assured confidential treatment of his/her personal and medical records. We expect the actions and conduct of our employees to be in compliance with the Patient's [NAME] of Rights. Section 5-22 Health Insurance Portability and Accountability Act (HIPAA) We are committed to complying with all applicable laws and regulations pertaining to Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a broad law that governs whom we give access to patient data as well as how we transmit, retain and safeguard residents and employees Protected Health Information (PHI). 145820 Page 2 of 2