Inspection visit
Inspection
1 citation recorded
Inspector’s narrative
What the inspector wrote
This survey cited 1 deficiency. The full statement and the facility’s plan of correction follow, verbatim from the federal record.
F 0842
Level of Harm - Minimal harm
or potential for actual harm
Residents Affected - Few
Safeguard resident-identifiable information and/or maintain medical records on each resident that are in
accordance with accepted professional standards.
**NOTE- TERMS IN BRACKETS HAVE BEEN EDITED TO PROTECT CONFIDENTIALITY** Based on
observation, interview, and record review, the facility failed to keep confidential all information contained in
the resident's records, regardless of the form or storage method of the records or safeguard medical record
information against loss, destruction, or unauthorized use for 1 (Hall C) of 2 halls observed for privacy and
failed to keep confidential all information contained in the resident's records, regardless of the form or
storage method of the records, except when release is to the individual, or their resident representative
where permitted by applicable law or required by law for 1 (CR#1) of 1 residents reviewed for medical
records. -CNA B left a computer logged into the medical record system unattended on 1/16/2025 at
10:52am.-The facility failed to respond to CR #1's representative's attempts for medical records requests on
5/21/2025, 6/24/2025, 7/9/2025, 7/22/2025 and 09/12/2025. This failure could place residents at risk of their
personal health information being exposed to unauthorized personnel and could place residents and their
representatives at risk of not being informed about their health status. Findings included:Observation and
interview with OT A on 1/16/2026 at 10:52am, there was an unattended computer screen mounted to the
wall of Hall C on which CNA B's name was shown on the top right of the screen and showed he was logged
into the medical records system. OT A was walking by and was stopped and said CNA B should not have
logged onto the computer and left it unattended because the medical records system contained private
information with resident records and orders. OT A was observed logging out of CNA's account on the
computer. There was no resident information on the screen.Interview with the ADON on 1/16/2026 at
10:58am, she said the computer should not have been left logged in and that she would start on verbal
training for CNA B and then a facility-wide full-blown education later.Interview with the ADON on 1/16/2026
at 12:44pm, the ADON said that CNA B was hired three days ago and underwent all training before
working. The ADON said that an unauthorized person could have gotten resident social security numbers,
home address and diagnoses.Interview with the DON on 1/16/2026 at 12:26pm, she said CNA B should
not have left the computer without logging out of the system, as unauthorized individuals could access
resident information. The DON said staff get initial training and quarterly in-services on privacy.Interview
with CNA B on 1/16/2026 at 1:20pm, CNA B said he left the computer to tell the ADON that his password
worked. CNA B said he should not have done that, and someone could have located residents' home
address or their diagnoses. CNA B said he received training on privacy at the facility.Interview with the
Administrator, DON and ADON on 1/16/2026 at 1:35pm, the Administrator said the home screen CNA B
logged into could not have given access to residents' medical records. The DON and ADON agreed to go
back to the computer on Hall C and have a staff log in.Observation and interview with the DON and ADON
on 1/16/2026 at 1:40pm, CNA M went back to the computer in Hall C and logged in. Once the screen was
in the main screen, DON confirmed that from the home screen, staff did not need an additional password to
access records. CR #1 Record review of letters
(continued on next page)
Any deficiency statement ending with an asterisk (*) denotes a deficiency which the institution may be excused from correcting providing it is determined that other
safeguards provide sufficient protection to the patients. (See instructions.) Except for nursing homes, the findings stated above are disclosable 90 days following the
date of survey whether or not a plan of correction is provided. For nursing homes, the above findings and plans of correction are disclosable 14 days following the date
these documents are made available to the facility. If deficiencies are cited, an approved plan of correction is requisite to continued program participation.
LABORATORY DIRECTOR'S OR PROVIDER/SUPPLIER
REPRESENTATIVE'S SIGNATURE
TITLE
(X6) DATE
FORM CMS-2567 (02/99)
Previous Versions Obsolete
Facility ID:
If continuation sheet
Page 1 of 3
Event ID:
675078
Printed: 05/15/2026
Form Approved OMB
No. 0938-0391
Department of Health & Human Services
Centers for Medicare & Medicaid Services
STATEMENT OF DEFICIENCIES
AND PLAN OF CORRECTION
(X1) PROVIDER/SUPPLIER/CLIA
IDENTIFICATION NUMBER:
(X2) MULTIPLE CONSTRUCTION
675078
B. Wing
A. Building
(X3) DATE SURVEY
COMPLETED
01/16/2026
NAME OF PROVIDER OR SUPPLIER
STREET ADDRESS, CITY, STATE, ZIP CODE
Woodway Nursing & Rehab
2808 Stoneybrook Drive
Houston, TX 77063
For information on the nursing home's plan to correct this deficiency, please contact the nursing home or the state survey agency.
(X4) ID PREFIX TAG
SUMMARY STATEMENT OF DEFICIENCIES
(Each deficiency must be preceded by full regulatory or LSC identifying information)
F 0842
Level of Harm - Minimal harm
or potential for actual harm
Residents Affected - Few
addressed to the facility's President/CEO with a different facility name and the same address as this
facility:-Letter 1 was dated 05/21/2025 and contained certified mail and first-class mail from an entity
representing CR#1 requesting medical records to be sent within 45 days. It contained an authorization form
for protected health information requesting CR#1's entire record from 08/01/2024 to present and
electronically signed by CR #1's RP. It listed CR #1's Certificate of Death dated 01/05/2025. It had CR #1's
RP's state ID.-Letter 2 was dated 6/24/2025 with the same information. It was certified mail and first class
mail.-Letter 3 was dated 7/9/2025 with the same information. It was certified mail and first class mail. Letter
3 had a scan of the certified mail envelope also dated 7/9/2025 addressed to this facility's physical address.
When verified on USPS' website, it stated this letter had not reached its destination.-Letter 4 was dated
7/22/2025 with the same information. The PDF was labelled addressed and sent to the facility's Corporate
Office; there was a scan of the certified mail envelope dated 07/22/2025. When verified on USPS' website,
it stated this letter was returned to sender. -Letter 5 was dated 09/12/2025 with the same information. It also
had a scan of the certified mail dated 09/21/2025 addressed to the facility's parent company. When verified
on USPS' website, it stated this letter was received and signed by an individual at the postal facility. Record
review of the facility's TULIP profile, on 4/1/2025 the facility had a name change. Per the Facility Summary
Report, there was no change to the facility's parent company. The facility's status was effective
08/15/2025.Record review of CR #1's face sheet dated 1/16/2026, he was a [AGE] year-old male originally
admitted on [DATE] and last re-admitted on [DATE]. His most recent hospitalization was 10/10/2024 to
11/29/2024. His medical diagnoses included: anemia, Parkinsonism, pressure ulcer of left hip (9/27/24),
Alzheimer's Disease, quadriplegia, pressure ulcer of sacral region stage 4 (6/26/24), dysphagia, acute
respiratory failure with hypoxia (11/29/2024) and pneumonia (11/29/2024). It listed CR #1's RP in the
contacts section.Record review of the resident's progress notes, there were no notes documented before
09/27/2024.Record review of the resident's discharge MDS dated [DATE], he was discharged to the
hospital on that date. CR #1's most recent Quarterly MDS dated [DATE] reflected CR#1 was rarely or never
understood and a BIMS was not conducted. CR #1 was coded as having short-term and long-term memory
problems and was totally dependent on staff for all ADLs.Interview with the SW on 1/16/2026 at 12:28pm,
she had been at the facility since August 2022, and no one complained about not getting medical records.
The process to request medical records was to speak to the medical records person, DON, Administrator.
Then the facility would get a release form and let the resident or their representative sign it to get their
medical record and that they're entitled to it.Interview with MR on 1/16/2026 at she came back to work in
September 2025, and she did not hear about residents not getting requested documents. Residents and
their representatives could verbally request from her, and she would just need to confirm the correct RP is
making the request. There is also a form that residents and RPs could fill out. She said she was still in the
process of learning about this position and if she had questions, she would ask the Administrator.Interview
with BOM A on 1/16/2026 at 1:03pm, she said she oversaw accounts and authorizations and verifying
eligibility. She denied receiving any medical records requests. BOM A said the new management took over
on 4/1/2025, and they had a different name. BOM A did not remember CR #1.Interview with the former
management company's BOM B on 1/16/2026 at 1:08pm, she looked into CR #1's records and found that
he was admitted to the facility under the old company on 11/7/2023 and discharged [DATE]. She started
working on 11/23/2024 and was not assigned to this facility until February 2025. She said she did not know
this resident and had not received any medical records request from this resident or their RP. BOM B said if
it was a former resident, she would send the request to whoever requested records to the local
(continued on next page)
FORM CMS-2567 (02/99)
Previous Versions Obsolete
Event ID:
Facility ID:
675078
If continuation sheet
Page 2 of 3
Printed: 05/15/2026
Form Approved OMB
No. 0938-0391
Department of Health & Human Services
Centers for Medicare & Medicaid Services
STATEMENT OF DEFICIENCIES
AND PLAN OF CORRECTION
(X1) PROVIDER/SUPPLIER/CLIA
IDENTIFICATION NUMBER:
(X2) MULTIPLE CONSTRUCTION
675078
B. Wing
A. Building
(X3) DATE SURVEY
COMPLETED
01/16/2026
NAME OF PROVIDER OR SUPPLIER
STREET ADDRESS, CITY, STATE, ZIP CODE
Woodway Nursing & Rehab
2808 Stoneybrook Drive
Houston, TX 77063
For information on the nursing home's plan to correct this deficiency, please contact the nursing home or the state survey agency.
(X4) ID PREFIX TAG
SUMMARY STATEMENT OF DEFICIENCIES
(Each deficiency must be preceded by full regulatory or LSC identifying information)
F 0842
Level of Harm - Minimal harm
or potential for actual harm
Residents Affected - Few
FORM CMS-2567 (02/99)
Previous Versions Obsolete
nursing homes' medical records.Interview with the Administrator, he said he started in his position one
month ago. He said the process is for the DON to send medical records requests to the BOM. After some
questioning, the Administrator stated a law firm did call him sometime in December 2025 and it was related
to another resident under a different facility under the same management and it was not for this resident.
He did not write down the name of the person he spoke to or their number. The Administrator said he did
not know or recognize CR #1 and did not have the phone number of the former manager or the previous
Administrator, He said if mail was addressed to the previous company, he would not sign the letters and
that the letters would be sent back. He said the facility did not receive any mail or letters related to CR
#1.Record review of the facility's policy on electronic medical records dated 2018, it read in part, 1.
Electronic records are an acceptable form of medical record management. 2. The Administrator, in
conjunction with the Quality Assessment and Assurance Committee, shall review requests for and the
implementation of our electronic medical records system. 3. Only authorized people who have been issued
a password and user ID code will be permitted access to the electronic medical records system. 4. The
facility will make reasonable efforts to limit the use or disclosure of protected health information to only the
minimum necessary to accomplish the intended purpose of the use or disclosure .Record review of the
facility's policy on electronic medical records dated Qtr. 3, 2018 read in part, Policy Interpretation and
Implementation 1. Electronic records are an acceptable form of medical record management. 2. The
Administrator, in conjunction with the Quality Assessment and Assurance Committee, shall review requests
for and the implementation of our electronic medical records system.Record review of the Texas Civil
Practice and Remedies Code Section 74.051 verified on 05/26/2025 (found on
https://texas.public.law/statutes/tex._civ._practice_and_remedies_code_section_74.051) read in part,
.(a)Any person or his authorized agent asserting a health care liability claim shall give written notice of such
claim by certified mail, return receipt requested, to each physician or health care provider against whom
such claim is being made at least 60 days before the filing of a suit in any court of this state based upon a
health care liability claim. The notice must be accompanied by the authorization form for release of
protected health information as required under Section 74.052 (Authorization Form for Release of
Protected Health Information) (d)All parties shall be entitled to obtain complete and unaltered copies of the
patient's medical records from any other party within 45 days from the date of receipt of a written request
for such records; provided, however, that the receipt of a medical authorization in the form required by
Section 74.052 (Authorization Form for Release of Protected Health Information) executed by the claimant
herein shall be considered compliance by the claimant with this subsection.Record review of the Texas Civil
Practice and Remedies Code Section 74.052 verified on 05/26/2025 (found on
https://texas.public.law/statutes/tex._civ._practice_and_remedies_code_section_74.052) read in part, (a)
Notice of a health care claim under Section 74.051 (Notice) must be accompanied by a medical
authorization in the form specified by this section .
Event ID:
Facility ID:
675078
If continuation sheet
Page 3 of 3
Reading this as a family member? Your long-term care ombudsman is a free advocate for residents and families.
Back to topCitations
1 citation recorded*CMS
What do CMS severity letters mean?
Serious (G-L). Actual harm to a resident, or immediate jeopardy. Codes G through I indicate actual harm; J through L indicate immediate jeopardy to resident health or safety.
General (A-F). No actual harm found, or harm that is minimal. The facility must still submit a Plan of Correction. Most CMS citations land here.
Each letter combines severity with scope: how many residents the deficiency affected.
F842 - Resident-identifiable information
Safeguard resident-identifiable information and/or maintain medical records on each resident that are in accordance with accepted professional standards.
FAQ · About this visit
Common questions about this visit
What happened during the January 16, 2026 survey of Woodway Nursing & Rehab?
This was a inspection survey of Woodway Nursing & Rehab on January 16, 2026. The surveyor cited 1 deficiency, recorded on the federal Form 2567 statement of deficiencies.
Were any deficiencies cited at Woodway Nursing & Rehab on January 16, 2026?
Yes, 1 deficiency was cited, each with a CMS Scope and Severity grade. The first was: "Safeguard resident-identifiable information and/or maintain medical records on each resident that are in accordance with..."
What type of survey was this?
This was a inspection survey conducted by state surveyors under federal Centers for Medicare & Medicaid Services (CMS) oversight. Findings are published on CMS Care Compare.
SourceView on CMS Care Compare
Next steps
Concerned about a resident’s care?Find your local ombudsman through the Eldercare Locatoror file a complaint with your state survey agency.
Researching this visit professionally?Book a 15-minute calland we will walk through what we have on file.
Data from CMS Care Compare public records. Dataset last refreshed . If you believe any information is inaccurate, report it here.