Health inspection·October 12, 2024

F 0550 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few Honor the resident's right to a dignified existence, self-determination, communication, and to exercise his or her rights. Based on observation, interview, and record review the facility failed to ensure each resident had a right to a dignified existence in a manner and in an environment that promotes enhancement of his or her quality of life, recognizing each resident's individuality for 1 of 4 Residents (Resident #1) reviewed for dignity, in that: The facility failed to ensure a visitor, not related to Resident #1, did not record, and publish a video to social media, that could be taken out of context and in a manner than was distressing for family. This deficient practice could affect dependent residents and their families and contribute to feelings of shame and loss of dignity. The findings included: Record review of Resident #1's face sheet (undated) revealed an admission date of 3/25/2020 and readmission date of 3/14/2023 with diagnosis which included: unspecified dementia, epilepsy, and hallucinations. Record review of Resident #1's quarterly MDS dated 8/12/2024 revealed a BIMS SCORE that could not be assessed because the resident was unable to complete the interview. The assessment indicated Resident #1 had both long- and short-term memory problems and was severely cognitively impaired. Record review of Resident #1's Care Plan dated 8/04/2023 revealed the resident had cognitive loss and dementia or alteration in thought processes as evidence by impaired decision making and short- and long-term memory loss with interventions which included promote dignity. Record review of Resident #1's Care Plan dated 8/23/2022 revealed the resident had cognitive loss and dementia with impaired safety awareness with interventions which included keep environment free from possible hazards. During an observation on 10/11/2024 at approximately 10:35 a.m., Resident #1's RP had an emotional outburst in the hallway near the nurses' station with multiple staff and Administrator present. She was waving her cell phone in her hand and demanding to know who the staff member was who called her and upset her discussing personal information and had a video about her family member (Resident #1) who had just passed away a couple hours ago. During an observation of the video (undated) which was sent by the Administrator to Resident #1's Page 1 of 8 455724 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0550 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few RP on 10/11/2024 revealed a younger (older teen to young adult age) male seated in a chair with Resident #1 positioned to his right side. The video shows the young man just sitting and looking at the camera while a woman could be heard laughing in the background. The video shows Resident #1 touching the young mans shirt collar, brushing his chest over his shirt, touching his right leg, and then placing her head on his right leg. Resident #1 was smiling and looking at the young man and the camera. She did not appear in any distress. Resident #1 was the one touching the young man. The young man did not respond, encourage, or touch Resident #1 while she was touching him. The video was observed to have been on the social media account with a picture that looked like the same person (young man) that was observed in the video. Upon observation of the social media account (on 10/11/2024) the video was no longer visible. During an interview on 10/11/2024 at 10:55 a.m., the Administrator stated Resident #1 passed away early this morning (10/11/2024). She stated the resident had been on hospice and the death was expected. The Administrator expressed frustration that an anonymous person would stir up commotion on a day where the family should be allowed to grieve. The Administrator stated an anonymous person who used a pseudonym to identify herself, had called the family and told them there was a video that had been posted on social media of Resident #1 and alleged sexual assault had occurred in the video. The Administrator stated she had known about the video prior to this encounter, had investigated it and had determined no abuse had occurred. She stated the video showed Resident #1 being flirtatious with a visitor. The Administrator stated she had informed the family of the visitor that he (visitor) could not return to the facility because he had uploaded the video of Resident #1 to social media. She stated she had not notified Resident #1's RP because there was no abuse. She stated since she had arrived at the facility as the Administrator there had been several disgruntled former staff members who had continued to create problems for the facility. During an interview on 10/11/2024 at 11:17 p.m. Resident #1's RP stated Resident #1 lived in the secured unit because she had extreme dementia. She stated Resident #1 could not talk, she did know who family was and did not even know who she was. She stated Resident #1 no longer even responded to her own name. She stated the only thing should do was walk up until about 2-3 weeks prior to her death. The RP stated she was distressed by the anonymous call and the video of her mother on social media. She stated she was not aware of it until today. She stated she did not like the way Resident #1 was portrayed in the video. During an interview on 10/12/2024 at 2:15 p.m., the Social Services Director (SSD) stated there had been a video of Resident #1 reported to the facility. She stated she could not recall the date. She stated the Corporation worked with the Administrator to have it removed from social media. The SSD stated they were able to identify a visitor in the video with Resident #1 and had banned him from the facility. She stated he was banned from the facility because he recorded someone who had dementia. She stated she had conducted safe survey rounds on 10/11/2024 with residents and no one expressed concerns and all residents in the secured unit were at baseline with no concerns for abuse. During an interview on 10/12/2024 at 3:06 pm the ADON stated she was present on 10/11/2024 when Resident #1's RP had a meltdown, and she was upset. The ADON stated before this she was not aware of any video. She stated she still had not seen the video. The ADON stated they protect residents by having visitors check in and sign in before visiting. She stated should know where the visitor is going and what area the visitor was located. She stated any misconduct or concerns should be reported to the Administrator so it could be addressed appropriately. During an interview on 10/12/2024 at 4:02 p.m., the DON stated Resident #1 had severe dementia and 455724 Page 2 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0550 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Few had been declining and had been on hospice care. The DON stated due to Resident #1's dementia, she was flirty and lovey dovey with everyone, including females and staff. The DON stated she would pet people and then lay her head against them. She stated there was nothing sexual about this behavior. The DON stated she was not aware of the video before 10/11/2024 and was out on PTO when the video was first discussed on an unknown date. She stated when she returned to the facility the visitor was on a do not visit list. The DON stated she had observed the video yesterday. She stated it was clearly taken in the common area of the secured unit by the background. The DON stated she had no knowledge if any staff was present when the video was recorded. She stated she would expect staff to redirect any resident who was being touchy feely which was common in people with dementia. She stated a simple redirection, take them to look out a window, or have them color, just redirect. The DON stated in her opinion the video had the appearance of a young man who was making fun of someone who was unaware of what she (Resident #1) was doing. She stated visitors should engage with residents respectfully and Resident #1 was unaware of what she was doing because of the dementia. The DON stated the facility did not have a policy or agreement with visitors that would prohibit them taking pictures or videos of other residents (not related). The DON stated it just seemed like basic common sense that people should already know. She stated staff should know who the visitors are and why they were at the facility and who they were there to see. She stated they had spoken to the family member of the visitor and informed them a line was crossed and that he could not return to the facility, and they had been understanding. The DON stated it was important to prevent visitors from recording residents who were not related because it was a violation of resident privacy. She stated if the resident had dementia, then they could not give consent. During a interview on 10/12/2024 at 4:49 p.m., the Administrator stated she first became aware of the video of Resident #1 on social media on 8/14/2024. She stated a staff member had brought her the video and showed her on social media. The Administrator stated she was absolutely disgusted. She stated she consulted with her team and regulations. She stated she determined there were no signs of abuse. She stated it was more that Resident #1 was a demented resident. The Administrator stated Resident #1 was acting her baseline in the video. She stated she had investigated and asked staff if they had seen the visitor, who he was there visiting and who had seen this person (visitor). She stated she talked to the family of the young man and told them there was no video or cameras allowed of other residents and the family had been understanding. She stated every staff member knows not to video or record and should instruct family not to allow video. The Administrator now that it has become an allegation from the anonymous caller, he has been put on a no visit list. The Administrator stated the video was a short (a video that was posted for a short time and then automatically disappears after a predetermined length of time, usually 24 hours or less) and was only available to view for a short time. The Administrator stated the staff member who brought it to her attention was friends on social media with the visitor as they were both young and in the same age group. The Administrator stated because of the new allegation of abuse from the anonymous caller, she had staff complete safe surveys on all residents in the secured unit and no changes were noted. The Administrator stated she truly believed the anonymous caller was a malicious attempt to malign and retaliate from an ex-agency nurse who no longer worked at the facility and had become disgruntled. The Administrator stated she had made a police report of the events on 10/11/2024 and self-reported the allegation. The Administrator stated it was important for residents with dementia to not be shown on social media because it had to do with their mentation and mental status and the residents were pleasantly confused. During an interview on 10/12/2024 the Administrator stated the facility did not have a policy for visitors or recording residents. Record review 455724 Page 3 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0550 Level of Harm - Minimal harm or potential for actual harm of a facility policy titled Resident Rights last revised December 2016 revealed: Federal and state laws guarantee certain basic rights to all residents of this facility. These rights include the resident's right to a. a dignified existence t. privacy and confidentiality 3. The unauthorized release, access or disclosure of resident information is prohibited. All release, access, or disclosure of resident information must be in accordance with current laws governing privacy of information issues. Residents Affected - Few 455724 Page 4 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0583 Keep residents' personal and medical records private and confidential. Level of Harm - Minimal harm or potential for actual harm **NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on observation, interview and record review, the facility failed to ensure the residents' right to personal privacy and confidentiality of his or her personal and medical records for 3 of 3 (Resident #1, #2 and #3) residents reviewed for privacy and confidentiality, in that: Residents Affected - Some The facility failed to prevent LVN A from having access and reviewing electronic medical records for Resident #1, #2, and #3's on [DATE] after she was removed from working from the facility on [DATE]. These failures placed residents at risk for having personal medical information disclosed and placed them at risk for misuse of the information. The findings included: Record review of Resident #1's face sheet (undated) revealed an admission date of [DATE] and readmission date of [DATE] with diagnosis which included: unspecified dementia, epilepsy, and hallucinations. Record review of Resident #2's face sheet (undated) revealed an admission date of [DATE] and a readmission date of [DATE] and a discharge date of [DATE] (expired) with diagnoses which included: cardiomegaly, unspecified dementia, and anxiety disorder. Record review of Resident #2's quarterly MDS assessment dated [DATE] revealed a BIMS of 4 which indicated a severe cognitive impairment. Record review of Resident #3's face sheet dated [DATE] revealed an admission date of [DATE] with readmission date of [DATE] with diagnoses which included: Alzheimer's disease, anxiety disorder due to known physiological condition, and depression. Record review of Resident #3's MDS BIMS assessment dated [DATE] revealed a BIMS score of 99 which indicated the resident could not complete the assessment and had a severe cognitive impairment. Record review of a screen shot of LVN A's electronic agency employee file dated [DATE] revealed the last date worked at the facility was Tuesday, [DATE]. Record review of a text message from LVN A to the Administrator on [DATE] revealed LVN A wrote Hi [Administrator] .Did I get DNR'd (do not return)? .Did I do something wrong? I am very confused about what is going on and I would really appreciate it if someone told me what I did that caused me to get DNR'd? During an observation on [DATE] at approximately 10:35 a.m., Resident #1's RP had an emotional outburst in the hallway near the nurses station with multiple staff and Administrator present. She was waving her cell phone in her hand and demanding to know who the anonymous staff member was who called her and upset her discussing personal information about her family member (Resident #1) who had just passed away a couple hours ago. During an interview on [DATE] at 10:55 a.m., the Administrator stated Resident #1 passed away early 455724 Page 5 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some this morning. She stated the resident had been on hospice and the death was expected. The Administrator expressed frustration that an anonymous person would stir up commotion on a day where the family should be allowed to grieve. She stated she notified the police of the incident and alleged allegations by the anonymous person and self-reported to HHSC. She stated she had also spoke at length to the family of Resident #1. The Administrator stated she would conduct a full investigation of the event. She stated since she had arrived at the facility as the Administrator there had been several disgruntled former staff members. During an interview on [DATE] at 10:58 a.m. with Resident #1's RP and two additional family members revealed they were upset because an anonymous female had texted and called her on the phone moments after her mother (Resident #1) had passed away telling per personal information and events that allegedly occurred at the facility. The RP stated the anonymous female then sent her several text messages that included a picture of a bruise to a leg that was presumably Resident #1. The RP stated she immediately informed the Administrator about the call and text on [DATE] at approximately 8:30 a.m. and had spoken to the police. Resident #1's RP expressed that she had communicated well with the nursing staff at the facility all through her family members disease process and death and she had no concerns for the care Resident #1 had received. During an interview on [DATE] at 12:31 p.m., anonymous stated she called Resident #1's RP this morning and informed her of several concerns she had about Resident #1, the Administrator and the facility. She stated she had received information from a former employee of the facility identified as LVN A and had no firsthand knowledge of events. She stated LVN A gave her personal information about several residents at the facility. Anonymous stated the information concerned her so she called and told Resident #1's RP about the concerns today ([DATE]). Anonymous stated although she was also a former employee of the facility, she did not notify the Administrator about the information. During an interview on [DATE] at 1:01 p.m., LVN A answered the phone, when this surveyor identified the nature of the call, LVN A hung up the phone. She declined to answer on a second attempt to reach her. During an interview on [DATE] at 2:42 p.m., the Administrator stated CNA's do not have access to resident information or family phone numbers. She stated the only way a staff could access this information was from a licensed nurse who had access. The Administrator stated she expected staff to have professional boundaries and protect HIPAA related information. She stated she was still working on identifying how someone (presumabably a former staff member), had access to this information. During an interview on [DATE] at 3:16 p.m., the Administrator stated LVN A was not a current employee. She stated LVN A had worked at the facility several months ago as an agency nurse. The Administrator stated she made LVN A Do Not Return (DNR) and did not want her to return to the facility. The Administrator stated Resident #1 had been a resident on the secured unit where LVN A had worked. She stated she had been going through her mind, all the staff that had worked on the secured unit. The Administrator stated LVN A had become disgruntled and began a smear campaign against the facility since she was DNR'd. She stated she had blocked LVN A from her phone because LVN A had been calling her multiple times a day. She stated she had informed LVN A's agency not to send her back to the facility. During an interview on [DATE] at 4:18 p.m., the Administrator stated she had run a PHI report on who had accessed electronic medical records of Resident #1 and determined there had been a HIPAA violation by LVN A. The Administrator stated she was still gathering information, but the PHI report 455724 Page 6 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some indicated LVN A accessed the medical records of Resident #1 in [DATE] after she was DNR'd from the facility. The Administrator stated the PHI report also indicated LVN A had access Resident #2 and Resident #3's medical record at about the same time. She stated the report did not indicate when LVN A's computer access had been deactivated but she could tell LVN A did not currently have access. During an interview on [DATE] at 3:06 p.m., ADON B stated her job duties included giving access to staff including agency to the electronic medical records. ADON B stated the ADON's are responsible for discontinuing access when staff no longer work in the facility although the duty is not assigned to any specific ADON. She stated they just knew who no longer worked there and took off their access by unassigning their username and password. ADON B stated LVN A had not worked in the facility for a while (date unknown) and was on the DNR list which meant she was not to return to the facility. She stated the facility did not have a specific profess of removal of staff from medical records, just when they are DNR'd they were to unassign. ADON B stated she did not know who had access to medical records. She stated the Administrator would have the ability to look to see who had access. During an interview on [DATE] at 4:02 p.m., the DON stated on [DATE] she found out that a nurse, identified as LVN A, who the facility was no longer utilizing, had accessed medical records outside of when she should have been accessing them. The DON stated LVN A accessed multiple electronic charts that were outside of her work duties and after she had been DNR'd from the facility. The DON stated it was the ADONs or the person putting that person on the schedule who was responsible for removing access to medical records. The DON stated in this case she was unsure why the process of removing LVN A access had been delayed and she does not know when her access was finally cut. The DON stated all she knew was that LVN A did not have current access. The DON stated LVN A's last shift was [DATE] and she accessed into the system for the last time on [DATE]. The DON stated last night ([DATE]) they had completed a full audit of their electronic medical records including pharmacy records, narcotic records, and physician orders and to ensure LVN A had not made any changes, which she had not. The DON stated it was important for staff who no longer worked at the facility to have no access to medical records because they were no longer providing care to the residents, it was a huge liability, it was unethical, and it was a violation of HIPAA. During an interview on [DATE] at 4:49 p.m., the Administrator stated she held staff to a high standard. She stated the staff may not always agree with her, but it was her job/duty to keep the residents safe. The Administrator stated after Resident #1's RP received the anonymous call, her wheels started turning on who had access to the information. She stated it was something she wanted to investigate. The Administrator stated LVN A was DNR'd on [DATE]. She stated on [DATE], LVN A sent her (administrator) a text asking why she was DNR'd. The Administrator stated after a review, she determined LVN A accessed medical records one time on [DATE] which impacted 11 residents, all on the secured unit. The Administrator stated the facility used a SSO management (single sign on user) module/portal to provide usernames and security profiles. She stated sometimes agency staff go to multiple facilities and their usernames are tied to multiple facilities. The Administrator stated the administrative team would terminate access by telling the SSO module to cut contact. The Administrator stated LVN A access had already been terminated when she ran the audit on [DATE]. She stated there had been a small lapse of time before it was shut off from LVN A's last date working until [DATE]. The Administrator stated the ADON's provided and terminated that access. She stated the ADON's would know someone had been DNR'd by a conversation with the management team or a document. The Administrator stated she believes this happened because the facility was in transition with ADON's and there was a lapse of time between. The Administrator stated HIPAA compliance was important so that the correct person employed by the facility had the correct 455724 Page 7 of 8 455724 10/12/2024 Arbor View Nursing & Rehabilitation 1213 Water St Kerrville, TX 78028

F 0583 information. Level of Harm - Minimal harm or potential for actual harm Record review of a PHI Audit log dated [DATE] revealed LVN A accessed the following medical records. Resident #1: face sheet, contact page, progress notes. Residents Affected - Some Resident #4, face sheet, POC (point of care), MDS responses page, message history page, medication administration page. Resident #2, #3, #4, #5, #6, #7. #8, #9, #10, and #11: face sheet and progress notes. And a global search of medication administration history. Record review of a facility policy, titled Electronic Medical Records last revised [DATE] revealed; 3. Only authorized persons who have been issued a password and user ID code will be permitted access to the electronic medical records system. 4. The facility will make reasonable efforts to limit the use or disclosure of protected health information to only the minimum necessary to accomplish the intended purpose of the use or disclosure. 6. When personnel changes occur, or there is reason to believe that unauthorized access to protect information has occurred, the HIPAA Compliance Office, Administrator and Director of Nursing Services shall review the security of the information and change user ID codes if necessary. 455724 Page 8 of 8