Health inspection·September 2, 2025

F 0583 Keep residents' personal and medical records private and confidential. Level of Harm - Minimal harm or potential for actual harm Based on the review of clinical records, facility documentation, and staff interviews, it was determined that the facility failed to protect the confidentiality of medical records for one of three records reviewed. (Resident R1) This was cited as past non-compliance.Findings Include:Review of an undated facility policy Medical Records Policy revealed that Wyncote Care Center maintains accurate and confidential medical records for all residents in compliance with federal and state regulations. The facility ensures secure storage, proper retention, and lawful release of medical records in accordance with CMS (Centers for Medicare & Medicaid Services).3. Release of Information:- Medical records will be released only in accordance with applicable federal and state privacy laws (e.g., HIPAA).- Records may be released to:- The resident.- The resident's legally authorized representative (e.g., Power of Attorney, legal guardian).Healthcare providers involved in the resident's care.- Regulatory agencies and authorities as required by law.- Other parties only with a valid, signed authorization from the resident or their legalrepresentative.- All requests for records must be submitted in writing and will be processed in a timelymanner.-A fee may be charged for record copies in accordance with facility policy and state law.- Documentation of all record releases will be maintained, including the request,authorization (if applicable), date of release, and recipient details. Review of facility reported incident dated August 1, 2025, revealed that Facility made aware that another family received the wrong medical records, causing a HIPAA breach.Further review of the facility reported incident revealed that NHA notified POA of the HIPAA breach, and assistance was extended for any identification protection measures. In addition, the family member who was accidentally given wrong record is scheduled to return the document for proper management.Interview with the Administrator on September 2, 2025, at 12:30 p.m. revealed that the staff provided the wrong record, record of Resident R1, to Resident R2's representative. Facility could not find out what information was provided; however, it was informed by Resident R2's representative that information such as social security number and date of birth was part of the privacy breach. The administrator also confirmed that the facility medical record request process was not followed. This deficiency was cited as past non-compliance. Review of facility Action plan/Follow up documentation revealed the following information. 1. Facility administrator notified the affected resident's (R1) POA(power of attorney) of the possible HIPAA breach, and extended assistance or resources as a result of the breach. In addition, R2 POA (the family who received R1's medical information) was asked to return the documents back to the facility, so it can be properly discarded.2. The Concierge program was utilized in order to monitor other potential breaches of medical information. Since the facility was unable to determine who provided the record, facility administration had to ensure that facility is quick to identify anyone else, if effected. Facility did not identify others effected, and this was an isolated incident. 3. Training was provided for staff on proper Medical Record Request policy and process. Forms were made available for future medical records requests.4. Monthly QAPI and weekly concierge discussions review any medical records requests. Residents Affected - Few Page 1 of 2 396120 396120 09/02/2025 Wyncote Care Center 208 Fernbrook Avenue Wyncote, PA 19095

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few NHA is made aware of all medical record requests, in order to prevent future breaches. Facility date of compliance was August 29, 2025.A review was conducted of clinical records, facility documentation, staff education, and documentation of audits conducted by the facility. Interview with staff revealed that the staff was knowledgeable about facility medical record request practices and HIPAA compliance. It was determined that the plan of correction was implemented, and identified as past non-compliance. 28. Pa Code: 201.29(a) Resident Rights28 Pa. Code 211.5(b) Medical Records 396120 Page 2 of 2