Inspection·January 13, 2025

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few -Resident #2's Transfer/Discharge Report, dated [DATE]. The report included his name, date of birth , admission information, Medicaid number, Medicare Beneficiary ID number, Social Security number, insurance policy name and number, diagnoses, and a partial list of medications. - Resident #2's Order Summary Report, dated [DATE], containing his name, diagnoses, date of birth , admission information, and all of his physician's orders. An interview on [DATE] at 1:53 PM with the DON revealed one of Resident #1's family members had called them (her and the Administrator) and informed them they had sent the wrong resident's paperwork with Resident #1, and provided the name of the resident whose paperwork was sent, but she could not recall who the other resident was at the moment. She said they had talked with the discharging nurse, who knew she had sent the correct paperwork, because she went over the medications with the family member who came to pick the resident up, one-by-one, and went over the cards holding the medications and made sure everything matched. She said the nurse had told her she believed Resident #2's information must have been on the copier, and she also inadvertently picked it up and gave it to Resident #1's family member. The DON said they immediately did in-service training about privacy of records, which included looking at all pages of records that were released to anyone, to make sure they were the correct records. She said they thoroughly addressed it. An interview on [DATE] at 3:23 PM with RN A revealed Resident #1 did not speak very good English, so she had also gone over his medications and the orders with the family member who came to take him home. She said she picked the papers up from the printer and did not realize another resident's papers were there too. She said the DON spoke to her about it, and they did another HIPAA training with everyone, where they talked about who was authorized, and told them to make sure they checked all the pages to be sure it was the correct paperwork, and to never leave resident information or medications where someone unauthorized could see them. She said the residents had a right to have their information be private, and she knew they were not supposed to share information with anyone who was not approved to have it, but it was an accident that she sent the wrong paperwork. An interview on [DATE] at 6:21 PM with the Administrator revealed she could not remember all the details, but she did remember one of Resident #1's family members calling after his discharge, in part because of the other resident's document (Resident #2) that was sent home with Resident #1. She said the DON had investigated what happened, and in-serviced the staff as part of them addressing the issue. Review of an Orientation Documentation Checklist reflected RN A signed as having received information and training which included HIPAA, on [DATE]. Review of a confidentiality statement, signed by RN A on [DATE], reflected The collection or acquiring of any resident data, whether by interview, observation or by the reviewing of documents, shall be conducted in a setting which provides maximum privacy and protection of information from unauthorized persons. All persons engaged in the collection and/ or processing of resident information will have documented instruction regarding their responsibilities to protect the privacy of the resident and the resident's data; such documentation will include their understanding that this trust must not be violated. Confidentiality Statement: I understand and agree that in the performance of my duties as an employee of the Company, I must hold confidential any and all medical and other resident specific information in confidence. Review of a HIPAA Confidentiality Agreement, signed by RN A on [DATE], reflected I understand that (continued on next page) FORM CMS-2567 (02/99) Previous Versions Obsolete Event ID: Facility ID: 455457 If continuation sheet Page 2 of 3 Printed: 05/15/2026 Form Approved OMB No. 0938-0391 Department of Health & Human Services Centers for Medicare & Medicaid Services STATEMENT OF DEFICIENCIES AND PLAN OF CORRECTION (X1) PROVIDER/SUPPLIER/CLIA IDENTIFICATION NUMBER: (X2) MULTIPLE CONSTRUCTION 455457 B. Wing A. Building (X3) DATE SURVEY COMPLETED 01/13/2025 NAME OF PROVIDER OR SUPPLIER STREET ADDRESS, CITY, STATE, ZIP CODE Fort Worth Wellness & Rehabilitation 2129 Skyline Dr Fort Worth, TX 76114 For information on the nursing home's plan to correct this deficiency, please contact the nursing home or the state survey agency. (X4) ID PREFIX TAG SUMMARY STATEMENT OF DEFICIENCIES (Each deficiency must be preceded by full regulatory or LSC identifying information)

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few it is essential that Protected Health Information (PHI) be maintained in a confidential manner, whether such information is oral, written, electronic, or in another format. This includes all information about our residents, including the fact that they are or have ever been a resident of the Facility. I understand that the information remains confidential whether the resident is alive or deceased . I understand that as a workforce member, I may be gjven access to such confidential information, and it is my responsibility to protect this sensitive and personal data. I understand that I may have access to confidential and personal data of residents and that I may only view, use, discuss, release, and disclose this data only when it is required by my job duties, and then only to the minimum amount necessary to accomplish the task to be performed. ( .) I also understand that if I do need to access information to perform my job, the information should not be divulged to anyone except as authorized by the Facility in accordance with Facility's policies and procedures. Review of the facility policy Disclosure of PHI: Medical Records Manual - HIPAA, revised 08/2020, reflected Purpose: To limit the access, use and disclosure of Protected Health Information (PHI) to the minimum necessary needed to accomplish the intended purpose of the use, disclosure or request for PHI. Policy: I. Minimum Necessary Standard; A. When using, disclosing, or requesting PHI the Facility will make reasonable efforts to use, disclose and request only the information that is minimally necessary to accomplish the intended purpose of the use, disclosure, or request.( .) Procedure: II. Using the Minimum Necessary Standard in Responding to Requests for Disclosure of PHI A. The Facility will presume that the resident or entity requesting the PHI is asking for the minimum necessary information to achieve the purpose of the release when: i. Such reliance appears to be reasonable under the circumstances; ( .) B. For uses, disclosures or requests that occur on a routine or recurring basis, the HIPAA Privacy Officer will implement a standard protocol that limits the PHI disclosed to the minimum amount reasonably necessary to achieve the purpose of the disclosure. The policy did not specifically address accidental sharing of PHI with unauthorized parties. Review of in-service documentation, dated [DATE], reflected all direct care staff, department heads, and the facility van driver were in-serviced on the HIPAA Glossary: Medical Records Manual - HIPAA. The in-service document refers to a HIPAA p/p (performance improvement plan.) Review of the facility policy HIPAA Glossary: Medical Records Manual - HIPAA., revised 02/2019, reflected Definitions: I. Breach A. Breach means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an authorized person to whom such information is disclosed would not reasonably have been able to retain such information. FORM CMS-2567 (02/99) Previous Versions Obsolete Event ID: Facility ID: 455457 If continuation sheet Page 3 of 3