Health inspection·July 16, 2025

F 0583 Keep residents' personal and medical records private and confidential. Level of Harm - Minimal harm or potential for actual harm **NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on interview and record review, the facility failed to ensure the confidentiality of residents' personal and medical information was protected when binders containing sensitive resident data was left unsecured at the nursing station, resulting in the unauthorized removal of the binders by unauthorized personnel.As a result, all residents at the facility were at risk for unauthorized access to their personal and medical information, in violation of their right to privacy and confidentiality. Findings: A review of the facility census on 6/25/25 indicated the total in house occupancy was 42 residents. Resident 1 was admitted to the facility on [DATE] with a diagnosis of cardiac arrest per the admission record. The record identified a resident family member as the resident representative (RR). The record indicated Resident 1 left the faciity on 6/16/25 against medical advice. During an observation and record review on 6/25/25 at 10:35 A.M., the facility nursing station was unattended, with no staff present near or at the desk. Multiple binders were observed sitting unsecured on an open cart located behind the nursing desk, against the wall. The nursing desk was unobstructed on either side and the binders were accessible within a few steps. The binders were clearly labeled, and included binders titled, Vital Signs, Treatment Audit, Controlled Drug Record, and Monthly Appointments. A review of the records inside the Monthly Appointment binder indicated the binder contained resident face sheets with identifying information such as name, date of birth , insurance identification number, diagnosis and social security number, along with other personal information. The nursing station remained unattended for five minutes. During an interview on 6/25/25 at 11:01 A.M., certified nursing assistant (CNA) 1 stated she was working on 6/15/25 when she witnessed a woman at the nursing station flipping through a binder on the top of the nursing desk. CNA 1 identified the woman as resident 1's resident representative (RR). CNA 1 stated RR said the phrase this is illegal, each time she flipped a page in the binder. CNA 1 stated after a few seconds RR walked away from the nursing desk with two binders and out of the facility. CNA 1 stated she heard licensed nurse (LN) 1 call out for RR to return to the nursing desk with the binders but RR did not comply. CNA 1 stated she did not know what was in the two binders. During an observation and interview on 6/25/25 at 11:17 A.M., LN 1 stated on 6/15/25 he witnessed Resident 1's RR remove two facility binders containing resident information from the top counter of the nursing station and leave the facility. LN 1 pointed to the area of the nursing countertop where the binders had been located and stated that they should have been stored behind the nursing station but had been left out for the phlebotomist (contracted staff who drew blood samples for testing). LN 1 reported that he attempted to stop RR and asked her to return the binders, but she refused. LN1 stated the binders contained resident face sheets, physician orders and requisitions for laboratory and radiology services for multiple residents. During an interview and record review with the Director of Nursing (DON) on 5/25/25 at 11:42 A.M., video footage of the incident on 6/15/25 showed a woman walked down the hallway towards the nursing station, stopped at the nursing desk and flipped through one of Residents Affected - Some Page 1 of 2 555871 555871 07/16/2025 Somerset Subacute and Care 151 Claydelle Ave El Cajon, CA 92020

F 0583 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some the two binders on the top of the desk. The footage indicated two staff members, identified by DON as CNA 1 and LN 1, were standing at the nursing station at the time of the incident. The footage indicated the woman, identified by DON as Resident 1's RR, removed the binder from the desk and walked towards the main exit of the facility. The DON stated RR refused to return the binders upon request. The DON stated RR returned to the facility the following day, 6/16/25, and discharged Resident 1 from the facility's care against medical advice. The DON stated the RR reported she was going to use the information in the binder to bring a malpractice lawsuit against the facility. The DON stated the RR was asked again to return the binders because they contained confidential resident information and RR refused to comply with the second request. DON stated approximately 50 residents were affected by the breach of information. The DON acknowledged that binders containing resident identifiers and personal health information should not be accessible to the public or facility visitors and should be stored in a secure location. The [NAME] stated that the information in the binders included resident names, dates of birth, and Social Security numbers which could be used for identity theft or financial fraud. The DON confirmed, as of the interview, the binders and resident information had not been recovered. A review of a blank facility form the facility stored in the laboratory and x-ray binders that were stolen, titled, Mobile X-ray and EKG Request Form Dispatch, indicated, fields for the resident full name, date of birth , Social Security number, imaging requested, physician name, and billing information, including Medicare or Medicaid number, other insurance details, and the reason for the exam. A review of another blank facility form, provided by the DON and confirmed to be stored in the stolen binders, titled, Comprehensive Test Requisition, indicated fields for the resident's full name, date of birth , social security number, email address, billing address, race, ethnicity, insurance policy number, and laboratory tests requested. A review of the undated facility document titled, NOTICE OF PRIVACY PRACTICES, indicated, . 4. Our legal duty. We are required by law to protect the privacy of your health information, provide this Notice about our privacy practices, follow the privacy practices that are described in this Notice. II. WE HAVE A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI). We are legally required to protect the privacy of your health information. We call this information Protected Health Information, or PHI for short, and it includes information that can be used to identify you that we have created or received about your past, present, or future health or condition; the provision of health care to you; or the payment for this health care. Statement of Resident Rights and Responsibilities: Under federal and state laws, you have the following rights and responsibilities. 11.The resident has the right to personal privacy and confidentiality of his or her personal and clinical records. Rights and Responsibilities under State Law. H. The right to have privacy in treatment and in caring for personal needs, confidentiality in the treatment of personal and medical records, and security in storing and using personal possessions. 555871 Page 2 of 2