|Survey Date: 9/9/2015|
Regulation Number:0388, level B scope/severity
Regulation Title: Resident Record - Confidentiality Protection
Regulation Description: 1.105 (5) (d) The confidentiality of the resident record including all medical, psychological and sociological information shall be protected at all times, in accordance with all applicable state and federal laws and regulations.
Based upon record review and interviews, the facility failed to have evidence the confidentiality of the residents' records was protected, including all medical, psychological and sociological information; affecting six of six residents (#2, #3, #9 and former residents #1, #10, #11), whom the facility provided a portion of the residents' confidential records to an outside agency provider. (Cross refer to tag #P006) The findings:
During the onsite investigation records for former resident #1 and current residents #2 and #3 were reviewed. No evidence was found that indicated the facility was authorized to disclose confidential records to an outside agency mental health provider.
Records from the outside agency mental health provider were received by the department on 9/1/15, including an email to the provider from the administrator of record. Attached to the email were face sheets and insurance information for residents #1 - #3 and #9 - #11. The face sheets included social security number, date of birth, diagnoses and other sensitive information about each resident.
The outside agency mental health provider stated on 9/2/15 that he had approached the facility to offer a non-pharmacological approach to managing residents with difficult behaviors. He stated that he was given a list of the residents that might be able to benefit from his services and he requested and received a physician's order for each resident, to allow him to conduct assessments with the residents. He further stated that he was provided the above mentioned email with the information for six residents attached. The outside agency mental health provider stated that he was not able to provide services to three of the residents due to insurance issues. The other three residents, (#1, #2 and #3) he was able to provide services and sent up a meeting with the facility to conduct assessments of each resident and to review their respective records. He stated he was given access to the residents' records, including medication administration records (MARs) and physician orders, which he reviewed prior to meeting with the residents.
Five of the six residents' legal representatives were interviewed on 9/2/15 and each of them stated they had no recollection of the facility requesting permission to make a referral to the outside mental health provider.
The administrator of record stated on 9/8/15 that she obtained a verbal consent from five of the six resident's to set up an assessment with the outside agency mental health provider, which included the release of records. She stated that the resident agreement also had language included, which would allow for the disclosure of the residents' confidential information to providers.
A copy of a sample release of information was sent to the department, which included a line to document the name of the provider to whom the information was being sent, the specific information being provided and the purpose for the disclosure, as well as a line for the signature of the resident or the legal representative. A request was made for copies of such disclosures that were signed by the legal representatives which allowed the disclosure of information to the outside agency mental health provider. The executive director provided a fax on 9/16/15, which included a statement that no disclosures were found in the six residents' records which specifically allowed the disclosure of the residents' information to the outside agency provider.
Facility Plan of Correction:
P388 Resident Record Confidentiality
The management team will be re-trained on the Release Resident Records policy and the Authorization for Release of Information on Nov 3, 2015 by the District Director of Operations and the District Director Clinical Services. The DDO or DDCS will monitor for compliance during routine site visits.
(1.How was the in-service with the management team documented?)
An in-service/training sign-in sheet will be provided to document that associates attended training, as well as a copy of the Resident Record Confidentiality policy and Authorization for Release of Information attached to the sign-in sheet.
(2.How often will the monitoring during site visits be occurring and how will that monitoring be documented?)
Community site visits will be conducted bi-annually by the DDCS or DDO, unless it is needed sooner. The visit will be documented on the site visit form and legal documentation in chart.