Health inspection·September 1, 2024

F 0838 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Many Conduct and document a facility-wide assessment to determine what resources are necessary to care for residents competently during both day-to-day operations (including nights and weekends) and emergencies. **NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on interviews and record review, the facility failed to conduct and document a facility-wide assessment to determine what resources were necessary to care for its residents competently during both day-to-day operations and emergencies for 1 of 1 facility reviewed for facility assessment. The facility did not have a completed Facility Assessment specific to cyber-attacks. This failure could place all residents at a risk for a lack of necessary resources and services. Findings Included: During an observation on 08/31/2024 at 11:00AM the facility had multiple resident's MARs and TARs on the conference table, and additionally upon further observation the clinical staff were using paper charting without any use of internet capable devices including computers and/or laptops. During the entrance conference and interview on 08/31/2024 at 11:07AM The administrator stated the facility was experiencing a facility wide technology black out. The administrator stated on Wednesday 08/28/2024, roughly around mid-day, noon time, he received a notification from his corporate company that nationally, the corporation was experiencing a viral cyber-attack. The administrator stated his immediate directive from corporate was to remove ethernet cables from all internets capable devices, which included computers and laptops. The administrator stated once the ethernet cables were removed the facility did not have access to the residents' electronic health records and were in a technology black out. The administrator stated later that day on 08/28/2024, the corporate administration gave permission to the clinical staff to use their own personal hot spots as an attempt to maintain internet continuity of care, and to check if the electronic health records were available. The administrator stated he himself, experienced difficulty with utilizing his own hot spot on his personal device. The administrator stated he could not confirm with certainty that all clinical members had any success with using their hot spots to be able to chart on the residents' electronic health records. The administrator stated on 08/29/2024, his clinical staff including his ADON A notified him the electronic health records online portal withdrew all access to the electronic health records, and the clinical staff did not have accessibility to physician orders, MARs, and TARs. The administrator reiterated multiple times the facility was not prepared for a viral cyber-attack and experienced a black-out from 08/28/2024 thru 08/30/2024. The administrator stated the contracted pharmacy were notified of the lack of physician's order for all residents on 08/28/2024, and those MARs and TARs were finally delivered on Friday 08/30/2024. The administrator stated when the MARs and TARs arrived, ADON A and other clinical members worked together to organize the orders and disperse them to the Page 1 of 8 675030 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0838 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Many nurses. The administrator stated the disbursement happened on 08/30/2024 around noon time. The administrator stated he recalled during a specific event on either 08/28/2024 or 08/29/2024, a new unnamed LVN consistently requested orders for her residents, and ADON A could not provide the requested information as the facility did not have the information readily available. The administrator stated the corporation is attempting to rectify the situation as soon as possible and is hopeful on Tuesday 09/03/2024 an on-site IT technician will fix the cyber-attack problem that affected the facility's computer systems. The administrator stated he has been with the company for two weeks, and stated the facility had no idea that this type of event (cyber-attack) would ever happen to them. The administrator did not reply when questioned about the potential negative events that could have happen as a result of not being emergently prepared for a cyber-attack. The administrator stated going forward the facility will task the medical record personnel to print out all resident's MARs and TARs at the beginning of each month as an effort to mitigate any future cyber-attacks. The administrator stated the facility does conduct facility assessments for natural disasters annually, however had no preparation for this viral cyber-attack as it was the first of its' kind. The administrator stated due to the lack of internet connectivity and accessibility, all online electronic health records are inaccessible. The administrator stated no resident was sent to the emergency room for any ailment during 08/28/2024 thru 08/30/2024. During an interview on 09/01/2024 at 1:23PM the Interim DON and ADON A both stated cyber-attacks was not something they were prepared for. Both stated the facility was usually given ample warning when storms will affect their facility, and as a preparatory effort, both will instruct the medical records personnel to print out all residents MARs and TARs to have readily available for their clinical staff to maintain continuity of care. Both stated their plan was to implement a backup system for cyber-attacks as they would both direct the medical record employee to print out all residents' MARs and TARs first of the month every month. Both stated potentially, residents could have received inappropriate care or treatment/medication orders as a result for not having physician's orders, MARs and TARs readily available during 08/28/2024 thru 08/30/2024.ADON A stated when the cyber-attack was initially discovered on 08/28/2024, she reviewed the emergency facility binder that housed all the residents MARs and TARs from a natural disaster scare earlier this year, and saw the printed date was April 2024 and was not current. Both reiterated multiple times the facility was unprepared for the disastrous viral cyber-attack. Record review of the facility's records revealed they did not have a facility assessment specifically for cyber-attacks. Record review of the facility's Continuity of Operations Planning ([NAME]) policy revised dated August 2018 documented, Continuity of Operations Planning ([NAME]) is considered a critical component of overall disaster and emergency preparedness. 1. This facility recognizes the importance of continuing operations following a crisis or disaster situation. 2. As part of the [NAME], the Disaster Preparedness Planning team shall review and identify crucial/essential functions, personnel and other factors that must remain operational immediately following a crisis or disaster. 3. Continuity of Operations Planning helps ensure that the facility can sustain operations that are absolutely vial including administrative and business components of the facility (records, payroll, finance, funding, insurance etc.). 675030 Page 2 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0838 4. The intent of the [NAME] is to maintain the safety of facility occupants (residents, staff and visitors) as well as allow the facility to provide services immediately following a critical event. Level of Harm - Minimal harm or potential for actual harm Residents Affected - Many 675030 Page 3 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0842 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some Safeguard resident-identifiable information and/or maintain medical records on each resident that are in accordance with accepted professional standards. Based on observation, interview and record review the facility failed to maintain medical records in accordance with accepted professional standards and practices that were complete, accurately documented, readily accessible and systematically organized for 5 residents (Resident #1, Resident #2, Resident #3, Resident #4, and Resident #5) who were reviewed for medical records. The facility failed to maintain accurate, thorough, complete and readily accessible medical records including physician orders, daily documented progress notes, blood pressure readings for residents that take blood pressure medications, glucose reading results for residents that have orders for glucose checks, MARs, and TARs for residents within the facility from 08/28/2024 thru 08/30/2024. This failure could have negatively affected the well-being of all residents as there was no documentation of services provided, if/when medications were administered appropriately in accordance with physician orders, and the residents current medical status. Findings included: Record review of minimally 5 residents was unsuccessful as the facility did not provide electronic health record access upon request on 08/31/2024. Unable to review care plans, MDS', thorough progress notes, thorough MARs and TARs, physician orders, vital signs, face sheets, and glucose reading results. The facility did provide written paper MARs/TARs that were backdated upon confirmation of managerial clinical staff. The facility was still amid a technological viral cyber-attack, and the electronic health record software portal removed all access to patient information pending cyber-attack resolution/rectification by the facility corporation. Record review of the facility's collective written nursing notes, entitled Nurse's Notes, dated 08/29/2024 2-10PM shift Lila/Rosa hall detailed no specific room numbers nor nursing signatures/names, revealed 12 residents were documented on out of 81 residents that resided within the facility. Record review of the facility's collective written nursing notes, entitled Nurse's Notes, dated 08/30/2024 2-10PM shift, hall unknown, resident room numbers unknown, documenter unknown, revealed 6 residents documented on out of 81 residents that resided within the facility. On 08/31/2024 at 3:22PM requested ADON A to present all daily documented nursing notes from 08/28/2024-08/30/2024 for all residents within the facility. On 09/01/2024 at 1:23PM LVN A's written nursing notes were presented and revealed: On 08/28/2024 LVN A 2PM-10PM shift, documented internet down, as well as check marks for various medications including psychotropic medications, for residents in rooms 101a thru 116, however there is no definitive indication if medications were given or held for 27 residents out of 81. No nursing documentation were noted for rooms 117-230. On 08/29/2024 LVN A 2PM-10PM shift, documented internet down, as well as check marks for various medications including psychotropic medications, for residents in rooms 101a thru 116, however there is no definitive indication if medications given or were held for 27 residents out of 81. No nursing documentation were noted for rooms 117-230. 675030 Page 4 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0842 Level of Harm - Minimal harm or potential for actual harm On 08/30/2024 LVN A 6AM-2PM shift medication aid documented internet down and 29 resident blood pressures. The document had rooms 117A-131B Verde hall, Rosa hall (unknown room numbers), followed by an additional document with rooms 201A-216B with blood pressure results. No blood pressures were documented for 08/28/2024 (for 2-10PMshift, or 10PM-6AM shift) as well as on 08/29/2024 (for 6AM-2PM shift, 2PM-10PM shift, and 10PM-6AM shift) Residents Affected - Some On 08/30/2024 LVN A 2PM-10PM shift, documented internet down, as well as check marks for various medications including psychotropic medications, for residents in rooms 101a thru 116, however there is no definitive indication if medications were given or held for 27 residents out of 81. No nursing documentation were noted for rooms 117-230. Record review of Resident #1's TAR, with a written date of August 2024 revealed, written order date 08/14/2024, written instructions, cleanse stage 4 PU to sacrum with wound cleanser, dab dry apply collagen dressing followed by alginate dressing and cover with absorbent dressing and secure with tape daily and PRN if dressing falls off or it becomes soiled. Within the document, shift 2 (2PM-10PM) to complete wound care. Documented wound care was completed on 08/29/2024, however on 08/28/2024, and 08/30/2024 there was no documented wound care performed. Record review of Resident #2's TAR, with a written date of August 2024 revealed, written order date 08/20/2024, written instructions, cleanse unstageable PU to sacrum with wound cleanser, dab dry, apply Santyl to wound bed and cover with gauze dressing, daily and PRN if dressing falls off or it becomes soiled. Within the document, shift 1 (6AM-2PM) to complete. Additionally, a check mark is written within the 08/29/2024 box indicating wound care was completed, however on 08/30/2024, and 08/31/2024 no check mark was in the box, indicating wound care was not completed. Record review of Resident #3's TAR, with written date of August 2024 revealed, order date 06/11/2024, written instructions, cleanse diabetic ulcer to plantar as of left foot with wound cleanser, dab dry, apply Santyl and (no frequency noted i.e., daily, as needed, every other day etc.). Additionally, written was shift 2 (2PM-10PM) to perform care. Check mark was documented on 08/29/2024, however no check mark was within 08/28/2024 or 08/30/2024 box indicating wound care was not completed. Record review of Resident #4's MAR, order date 08/10/2024 revealed, Mirtazapine (antidepressant) 15MG Tablet for: Remeron, give 15MG by mouth at bedtime for depression, documented within the 08/30/2024 box was a check mark, however on 08/28/2024 and 08/29/2024 there was no documented check mark within the respective boxes indicating medications were not given. Additionally, order date:03/13/2024, within the same MAR, Resident #4 to receive Lisinopril 5MG tablet: Administer 0.5 tablet by mouth 8:00 in the morning every day. If BP is less than 90/60 administer med and call MD, take and record pulse 0.5tablet=2.5MG. Documented administration on 08/31/2024, however on 08/29/2024 and 08/30/2024 no medication administration is recorded, nor any blood pressure reading within their respective designated boxes, indicating Lisinopril was not administered according to physician orders. Record review of Resident #5's MAR, order date 01/13/2024 revealed, Resident #5 to receive Carbidopa/Levodopa (treat Parkinson's disease) 25-100MG tablet: take 1 tablet by mouth three times daily (8A,12P,4P). Documented within the MAR, Resident #5 received medication on 08/30/2024 at 4PM, and on 08/31/2024 at 8AM,12PM, and 4PM. On 08/28/2024 the 12PM, AND 4PM boxes had no check marks indicating medication was not administered per physician orders. On 08/29/2024 the 8AM, 12PM, 4PM boxes had no check marks indicating medication was not administered per physician orders. On 08/30/2024 the 8AM and 12PM boxes had no check marks indicating medication was not administered per physician orders 675030 Page 5 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0842 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some During an observation on 08/31/2024 at 11:30AM multiple MARs/TARs for various residents were observed in the conference room indicating paper charting was in affect within the facility. During an observation on 09/01/2024 at 1:23PM observed multiple staff members including the Interim DON, and ADON A, in an activities room surrounded by at least 7-9 resident's paper MARs/TARs. Each member had a writing utensil in hand and were inscribing within the MAR/TAR pages. During an interview on 08/31/2024 at 12:11PM TN A stated on Wednesday 08/28/2024 she was notified by ADON A that the facility was experiencing a viral cyber-attack which impacted all electronic health records. TN A stated on Wednesday 08/28/2024 she verbally instructed all nurses that wound care was to be done by the nurses as she was directed to help with another facility task. TN A stated she verbally instructed each nurse on how to perform the wound care as she did not have access to orders, MARs or TARs. TN A stated from 08/28/2024-08/30/2024 she did not document on any paper chart or write within any nurse's paper notes, and reiterated she did not have access to document. TN A stated on 08/30/2024 MARs and TARs arrived and she attempted to back document on the affected dates of 08/28/2024-08/30/2024.TN A gave no definitive answer when asked how she accurately ensured wound care was being carried out appropriately not only by her but also the nurses on 08/28/2024-08/30/2024. TN A stated wounds could potentially get worse if not appropriately documented on, as it a tool that physicians use to monitor the care a resident receives, and some physicians may increase or change the frequency of care. TN A stated documentation, either in MARs or TARs, is essential to each resident's care. TN A reiterated the reason she did not document precisely when she provided wound care to her residents, was that she did not have access to chart. During an interview on 08/31/2024 at 1:30PM RN B stated she was new to the facility. RN B stated on 08/28/2024 she was notified by ADON A that the facility was experiencing a technological viral cyber-attack and would not have access to the online electronic health record of her residents. RN B stated she pleaded with the clinical administration for paper orders, MARs, or TARs for her residents to appropriately document and care for her residents. RN B stated she requested these items multiple times on 08/28/2024, 08/29/2024, and 08/30/2024. RN B stated each time she requested the essential documents her administration clinical staff members told her they did not have any orders, MARs/TARs to give. RN B stated from 08/28/2024 to 08/30/2024 she administered care/medications from memory and did not document the administration/care because she had no resident record to document on. RN B stated she doodled on pieces of paper some random charting, and at times she inquired to other tenured nurses about pain PRN orders, because she did not know exact dosages to administer. RN B stated she feared for the safety of her residents and her license. RN B stated documenting is critical for each resident, as it is a critical way to ensure care and medications are being provided according to physician's orders. RN B stated she wanted to be truthful and continued by stating she was verbally instructed to perform wound care on a resident (could not recall), she stated she had no orders to follow only what was verbalized to her from the wound care treatment nurse, on an unknown day. RN B stated she recalled she performed the wound care but did not document it as she did not have the resident's chart to document on. RN B stated on 08/30/2024 the facility received MARs and TARs for the whole facility but was not given immediately as the administration clinical staff were sorting out the orders. RN B stated, when asked about Resident #4, and Resident #5's medications administration, she could not recall specifically giving or being notified of any non-administration, about the above-mentioned medications. RN B stated, when asked about Resident #2's wound care, she stated she recalled providing wound care on 08/28/2024 but did not document the care as she did not have nurse's notes, or TARs readily available to her. RN B stated she does not know if the wound care treatment nurse performed wound care for Resident #2 on 08/29/2024 or 675030 Page 6 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0842 08/30/2024. Level of Harm - Minimal harm or potential for actual harm During an interview on 08/31/2024 at 3:05PM, RN A stated when he arrived on Wednesday, he did not have access to his residents online electronic health records, nor any paper charts from 08/28/2024-08/30/2024. RN A stated he did chart some notes on nurse's note paper, and when the three nurse's note pages were shown to him, RN A stated the penmanship was entirely his. RN A stated he documented what he could on 08/29/2024 and 08/30/2024 but did not document every specific medication or care provided, no definitive reason given. RN A stated on 08/30/2024 he recalled receiving MARs and TARs for his residents and has attempted to back document for 08/28/2024-08/30/2024. RN A stated, when asked about Resident #4, and Resident #5's medications administration, he could not recall specifically giving or being notified of any non-administration, about the above-mentioned medications. RN A stated when asked about Resident #1, Resident #2, and Resident #3's wound care, RN A stated he does recall performing wound care for Resident #1 and Resident #3, but only documented Resident #1's care on 08/30/2024 but does not recall documenting wound care on 08/28/2024 nor 08/29/2024, additionally does not recall documenting wound care for Resident #3 for days 08/28/2024,08/29/2024, and 08/30/2024. RN A stated accurate documentation is essential to ensure all residents receive the appropriate care. RN A stated there could be a potential negative outcome should medications and care not be documented precisely as it could affect the well-being of every resident. Residents Affected - Some During an interview on 08/31/2024 at 3:22PM MA A stated she did not keep a log of blood pressure readings when she gave blood pressure medications when the cyber-attack occurred from 08/28/2024-08/30/2024. MA A stated she checked blood pressures prior to administering any blood pressure medication. MA A stated she will usually document blood pressure results within the respective resident's electronic health record but did not from 08/28/2024-08/30/2024 because she had no access to online health records nor paper MARs or TARs.MA A stated she could not recall the residents she administered blood pressure medications, but stated she followed the medication blister pack instructions that had printed medication instruction labels with resident's name. MA A stated by not documenting appropriately within a resident's chart either online or on paper, the nurses and clinicians would not have accurate documentation of care and could potentially affect the residents negatively. MA A stated blood pressure medications and diabetic medications are critical to the well-being of those taking them. MA A stated if medications are not documented as being administered, the nurses could give an additional dosage. MA A stated on 08/30/2024 she recalled being notified about MARs and TARs arriving to the facility but did not have the capability of documenting on them as the clinical administration was sorting out the MARs/TARs. MA A stated, when asked about Resident #1, Resident #2, Resident #3, Resident #4, and Resident #5's medications administration, she could not definitively recall specifically giving or notifying any nurse of non-administration, of the above-mentioned medications. During an interview on 09/01/2024 at 1:23PM the Interim DON and ADON A both stated cyber-attacks is not something they were prepared for. Both stated the facility wass usually given ample warning when storms would affect their facility, and as a preparatory effort, both will instruct the medical records personnel to print out all residents MARs and TARs to have readily available for their clinical staff to maintain continuity of care. Both stated their plan was to implement a backup system for cyber-attacks as they would both direct the medical record employee to print out all residents' MARs and TARs first of the month every month. ADON A stated she wanted to remain honest and continued by stating nurses were administering care and medications from memory because the facility did not have any orders, MARs or TARs readily available for the facility residents from 08/28/2024-08/30/2024. ADON A stated on 08/28/2024 when the cyber-attack occurred, she instructed all clinical staff to document on paper nurse's notes, but as she reviewed the documentation, she verbalized only two nurses followed her 675030 Page 7 of 8 675030 09/01/2024 LA Frontera Nursing & Rehabilitation 7001 McPherson Rd Laredo, TX 78041

F 0842 Level of Harm - Minimal harm or potential for actual harm Residents Affected - Some directive, LVN A and RN A, which she continued by stating was unacceptable. Both stated no person was sent to the hospital during the specific time frame. Both stated potentially, residents could have received inappropriate care or treatment/medication orders as a result for not having physician's orders, MARs and TARs readily available during 08/28/2024 thru 08/30/2024. ADON A stated nurses have attempted to back chart on the paper MARs/TARs from 08/28/2024-08/30/2024. ADON A stated when the cyber-attack was initially discovered on 08/28/2024, she reviewed the emergency facility binder that housed all the residents MARs and TARs from a natural disaster scare earlier this year, and saw the printed date was April 2024 and was not current. Both reiterated multiple times the facility was unprepared for the disastrous technological viral cyber-attack. Record review of the facility's Charting and Documentation policy revised dated December 2006 documented, 1. Signification observations, medications administered, services performed, etc., will be documented in the resident's clinical records. 675030 Page 8 of 8