Victory Home Care Agency

“Develop EP Plan, Review and Update Annually CFR(s): 484.102(a) §403.748(a), §416.54(a), §418.113(a), §441.184(a), §460.84(a), §482.15(a), §483.73(a), §483.475(a), §484.102(a), §485.68(a), §485.542(a), §485.625(a), §485.727(a), §485.920(a), §486.360(a), §491.12(a), §494.62(a). The [facility] must comply with all applicable Federal, State and local emergency preparedness requirements. The [facility] must develop establish and maintain a comprehensive emergency preparedness program that meets the requirements of this section. The emergency preparedness program must include, but not be limited to, the following elements: (a) Emergency Plan. The [facility] must develop and maintain an emergency preparedness plan that must be [reviewed], and updated at least every 2 years. The plan must do all of the following: * [For hospitals at §482.15 and CAHs at §485.625(a):] Emergency Plan. The [hospital or CAH] must comply with all applicable Federal, State, and local emergency preparedness requirements. The [hospital or CAH] must develop and maintain a comprehensive emergency preparedness program that meets the requirements of this section, utilizing an all-hazards approach. * [For LTC Facilities at §483.73(a):] Emergency Plan. The LTC facility must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually. * [For ESRD Facilities at §494.62(a):] Emergency Plan. The ESRD facility must develop and maintain an emergency preparedness plan that must be [evaluated], and updated at least every 2 years. . This Standard is not met as evidenced by: Based on interview, review of facility policies and procedures and review of facility documentation, it has been determined the facility has failed to develop and maintain a comprehensive emergency preparedness plan. Failure to develop and maintain a comprehensive emergency preparedness plan that is relevant to facility operations can result in facilities not being prepared in the event of an emergency, leading to patient or staff injury or death. Findings include: Facility policy titled, “...Emergency Management Plan....” reviewed January 2024 revealed: “...Purpose...To establish a plan which will allow for continuation of services in the event of a disaster affecting the organization or the community...Specific procedures that describe mitigation, preparedness, response and recovery strategies, actions, and responsibilities will be developed for each priority emergency...The plan will provide processes for initiating the response and recovery phases of the plan, including a description of how, when and by whom the phases are to be activated for each priority emergency event....” “...Emergency Preparedness Packet for Home Health Agencies...Prepared by The National Association for Home Care & Hospice....” was identified by Employee #1 as the facility emergency preparedness plan and revealed: “...The materials developed consist of templates of tools to assist in emergency preparedness for agencies, patients and their families, and agency staff...The Home Health Agency Emergency Preparedness Assessment...identifies specific tasks to be completed under each category in order to mitigate the affects of any adverse event that might interfere with normal operations...The home health agency preparedness plan is detailed, all hazard plan designed to guide for agencies when developing their emergency preparedness policies and procedures. Providers will need to tailor the plan to meet their agency’s individual needs....” The emergency preparedness plan begins on page 26 and is titled, “...XYZ Home Care Agency Emergency Preparedness Plan....” Although the plan is somewhat individualized (the organization chart is filled in but has not been recently updated, there are three vendor names listed but no contact information, there is an alternate site listed for evacuation), most of the plan has not been changed from the original template. For example, the plan states that two prearranged radio stations will be utilized if phones are down and the radio stations are listed as “...(xxxx;xxxx).....” Page 28 of the plan assigns the role of Operations to the VP of Operations and Finance/Administration to the Comptroller, neither of which are job titles which appear in Victory Home Health’s organizational chart. The frequency with which nurses or aides should check in with the Agency offices during an agency is blank. In an interview conducted with Employees #1 and #2 on December 4, 2024, Employee #1 confirmed that the Emergency Preparedness Plan had been purchased from a third-party company for the use of Victory Home Care and had not been individualized to the facility according to facility policies and procedures.”

“Plan Based on All Hazards Risk Assessment CFR(s): 484.102(a)(1)-(2) §403.748(a)(1)-(2), §416.54(a)(1)-(2), §418.113(a)(1)-(2), §441.184(a)(1)-(2), §460.84(a)(1)-(2), §482.15(a)(1)-(2), §483.73(a)(1)-(2), §483.475(a)(1)-(2), §484.102(a)(1)-(2), §485.68(a)(1)-(2), §485.542(a)(1)-(2), §485.625(a)(1)-(2), §485.727(a)(1)-(2), §485.920(a)(1)-(2), §486.360(a)(1)-(2), §491.12(a)(1)-(2), §494.62(a)(1)-(2) [(a) Emergency Plan. The [facility] must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years. The plan must do the following:] (1) Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.* (2) Include strategies for addressing emergency events identified by the risk assessment. * [For Hospices at §418.113(a):] Emergency Plan. The Hospice must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years. The plan must do the following: (1) Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach. (2) Include strategies for addressing emergency events identified by the risk assessment, including the management of the consequences of power failures, natural disasters, and other emergencies that would affect the hospice’s ability to provide care. *[For LTC facilities at §483.73(a):] Emergency Plan. The LTC facility must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually. The plan must do the following: (1) Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach, including missing residents. (2) Include strategies for addressing emergency events identified by the risk assessment. *[For ICF/IIDs at §483.475(a):] Emergency Plan. The ICF/IID must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least every 2 years. The plan must do the following: (1) Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach, including missing clients. (2) Include strategies for addressing emergency events identified by the risk assessment. This Standard is not met as evidenced by: Based on interview, review of facility policies and procedures and review of facility documentation, it has been determined the facility has failed to execute and maintain an emergency preparedness plan based on an all-hazards facility-based and community-based risk assessment. Failure to complete, maintain and regularly update a facility and community based all-hazards risk assessment and then develop and regularly update an emergency preparedness plan to reflect the risks identified within the assessment can result in a facility not being prepared to address the hazards most likely to affect a patient and staff population. Findings include: Facility policy titled, “...Emergency Management Plan....” reviewed January 2024 revealed: “...Staff will work with regional or county emergency management planning agencies, where available, in...Establishing priorities among the potential emergencies identified in the hazard vulnerability analysis...Specific procedures that describe mitigation, preparedness, response and recovery strategies, actions, and responsibilities will be developed for each priority emergency...Based on the hazard vulnerability analysis...the organization’s general emergency plan may be enhanced or revised according to the identified potential emergencies and planning activities....” “...Victory Home Health Hazard Vulnerability Assessment....” dated August 29, 2024 revealed the following highly-rated hazards: Environmental/Altered Air quality, Transportation Interruption, Water failure, Information System Failure, Communications Failure, Electrical Failure, Pandemic/Infectious Disease, Civil Disturbance, and Fire. “...Emergency Preparedness Packet for Home Health Agencies....” did not contain specific procedures that related to these hazards. The packet was contained within a binder that did have some general informational material, some of which was relevant to some of the scenarios. For example, there was an educational packet on how to escape from an active shooter which could be relevant to a civil disturbance event. In an interview conducted with Employee #1 and Employee #2 on December 4, 2024, Employee #1 confirmed that specific, facility-based procedures related to the most highly rated hazards had not been developed and added to the facility Emergency Preparedness Plan. Employee #1 verified that the Emergency Preparedness Plan should be developed and updated according to facility policies and procedures.”

“HHA- Procedures for Follow up Staff/Pts. CFR(s): 484.102(b)(3) §484.102(b)(3) Condition of Participation: [(b) Policies and procedures. The HHA must develop and implement emergency preparedness policies and procedures, based on the emergency plan set forth in paragraph (a) of this section, risk assessment at paragraph (a)(1) of this section, and the communication plan at paragraph (c) of this section. The policies and procedures must be reviewed and updated at least every 2 years. At a minimum, the policies and procedures must address the following:] (3) The procedures to follow up with on-duty staff and patients to determine services that are needed, in the event that there is an interruption in services during or due to an emergency. The HHA must inform State and local officials of any on-duty staff or patients that they are unable to contact. This Standard is not met as evidenced by: Based on interview, review of policy and procedure and review of facility documentation, it has been determined the facility has failed to develop and implement a system to follow up with staff or patients to determine services that are needed in the event of an emergency. Failure to develop and implement a system to follow up with staff or patients in the event of an emergency can result in increased death or injury for staff or patients in a mass casualty event. Findings include: Facility policy titled, “...Emergency Management Plan....” reviewed January 2024 revealed: “...The Clinical Supervisors...will be responsible for triaging all patient care, according to...categories....” “...Emergency Preparedness Packet for Home Health Agencies....” identified as the facility Emergency Preparedness Plan revealed: “...Each office will keep and maintain a current list of contact information for staff, staff family members...On admission, the admitting nurse will assign each patient a priority code, dictating that patient’s emergency rating. The admitting nurse will obtain a list of contact numbers, and discuss emergency planning options...All information will be kept...in paper as well as electronic format....” In an interview conducted with Employees #1 and #2 conducted on December 4, 2024, Employees #1 and #2 were asked how they would be able to provide information about staff and patients if phones and electricity were not operational. Employee #2 stated that a paper list of emergency preparedness data for patients including the patient’s emergency rating and contact details was printed daily. Compliance Officer asked to see the list that had been printed for December 4, 2024 but Employee #2 stated this list had not been printed. Compliance Officer asked to see the list printed for December 3, 2024 but this list could also not be provided.”

“Policies/Procedures-Volunteers and Staffing CFR(s): 484.102(b)(5) §403.748(b)(6), §416.54(b)(5), §418.113(b)(4), §441.184(b)(6), §460.84(b)(7), §482.15(b)(6), §483.73(b)(6), §483.475(b)(6), §484.102(b)(5), §485.68(b)(4), §485.542(b)(6), §485.625(b)(6), §485.727(b)(4), §485.920(b)(5), §491.12(b)(4), §494.62(b)(5). [(b) Policies and procedures. The [facilities] must develop and implement emergency preparedness policies and procedures, based on the emergency plan set forth in paragraph (a) of this section, risk assessment at paragraph (a)(1) of this section, and the communication plan at paragraph (c) of this section. The policies and procedures must be reviewed and updated at least every 2 years [annually for LTC facilities]. At a minimum, the policies and procedures must address the following:] (6) [or (4), (5), or (7) as noted above] The use of volunteers in an emergency or other emergency staffing strategies, including the process and role for integration of State and Federally designated health care professionals to address surge needs during an emergency. *[For RNHCIs at §403.748(b):] Policies and procedures. (6) The use of volunteers in an emergency and other emergency staffing strategies to address surge needs during an emergency. *[For Hospice at §418.113(b):] Policies and procedures. (4) The use of hospice employees in an emergency and other emergency staffing strategies, including the process and role for integration of State and Federally designated health care professionals to address surge needs during an emergency. This Standard is not met as evidenced by: Based on review of facility policies and procedures, review of facility documentation and interview, it has been determined the facility failed to develop a policy regarding the use of volunteers during an emergency. Failure to develop a policy regarding the use of volunteers during an emergency event can result in being unprepared for employees who wish to volunteer during a mass casualty event or for the need to accept volunteer staff during a mass casualty event. Findings include: An volunteer policy was requested related to emergency preparedness but it could not be provided. In an interview conducted with Employee #1 and #2 on December 4, 2024, Employee #1 and #2 confirmed a policy regarding the use of volunteers during an emergency event could not be provided and confirmed this was not addressed in the facility emergency preparedness plan.”

“Names and Contact Information CFR(s): 484.102(c)(1) §403.748(c)(1), §416.54(c)(1), §418.113(c)(1), §441.184(c)(1), §460.84(c)(1), §482.15(c)(1), §483.73(c)(1), §483.475(c)(1), §484.102(c)(1), §485.68(c)(1), §485.542(c)(1), §485.625(c)(1), §485.727(c)(1), §485.920(c)(1), §486.360(c)(1), §491.12(c)(1), §494.62(c)(1). [(c) The [facility must develop and maintain an emergency preparedness communication plan that complies with Federal, State and local laws and must be reviewed and updated at least every 2 years [annually for LTC facilities]. The communication plan must include all of the following:] (1) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Patients’ physicians (iv) Other [facilities]. (v) Volunteers. *[For Hospitals at §482.15(c) and CAHs at §485.625(c)] The communication plan must include all of the following: (1) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Patients’ physicians (iv) Other [hospitals and CAHs]. (v) Volunteers. *[For RNHCIs at §403.748(c):] The communication plan must include all of the following: (1) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Next of kin, guardian, or custodian. (iv) Other RNHCIs. (v) Volunteers. *[For ASCs at §416.45(c):] The communication plan must include all of the following: (1) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Patients’ physicians. (iv) Volunteers. *[For Hospices at §418.113(c):] The communication plan must include all of the following: (1) Names and contact information for the following: (i) Hospice employees. (ii) Entities providing services under arrangement. (iii) Patients’ physicians. (iv) Other hospices. *[For HHAs at §484.102(c):] The communication plan must include all of the following: (1) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Patients’ physicians. (iv) Volunteers. *[For OPOs at §486.360(c):] The communication plan must include all of the following: (2) Names and contact information for the following: (i) Staff. (ii) Entities providing services under arrangement. (iii) Volunteers. (iv) Other OPOs. (v) Transplant and donor hospitals in the OPO’s Donation Service Area (DSA). This Standard is not met as evidenced by: Based on review of facility policy, review of facility documentation and interview, it was determined the facility failed to include names and contact information for staff, patient physicians and entities providing services under arrangement in the facility communications plan. Failure to provide contact information that could be needed during an emergency event in the facility communication plan can result in vital services being interrupted during an emergency event for staff and patients. Findings include: “...Emergency Preparedness Packet for Home Health Agencies....” identified as the facility’s emergency preparedness and communication plan contained no staff contact phone numbers, physician phone numbers or phone numbers for entities providing services under arrangement. An accompanying Emergency Preparedness binder also contained no contact phone numbers for these entities. In an interview conducted with Employees #1 and #2 on December 4, 2024, Employee #1 explained that staff phone numbers could be found within the facility EMR (electronic medical record) system. When asked how these phone numbers could be accessed if there was no access to the EMR, Employee #1 did not have an alternate plan. Employee #1 and #2 confirmed that the contact phone numbers could not be found within the communication plan.”

“EP Training Program CFR(s): 484.102(d)(1) §403.748(d)(1), §416.54(d)(1), §418.113(d)(1), §441.184(d)(1), §460.84(d)(1), §482.15(d)(1), §483.73(d)(1), §483.475(d)(1), §484.102(d)(1), §485.68(d)(1), §485.542(d)(1), §485.625(d)(1), §485.727(d)(1), §485.920(d)(1), §486.360(d)(1), §491.12(d)(1). *[For RNCHIs at §403.748, ASCs at §416.54, Hospitals at §482.15, ICF/IIDs at §483.475, HHAs at §484.102, REHs at §485.542, “Organizations” under §485.727, OPOs at §486.360, RHC/FQHCs at §491.12:] (1) Training program. The [facility] must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles. (ii) Provide emergency preparedness training at least every 2 years. (iii) Maintain documentation of all emergency preparedness training. (iv) Demonstrate staff knowledge of emergency procedures. (v) If the emergency preparedness policies and procedures are significantly updated, the [facility] must conduct training on the updated policies and procedures. *[For Hospices at §418.113(d):] (1) Training. The hospice must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing hospice employees, and individuals providing services under arrangement, consistent with their expected roles. (ii) Demonstrate staff knowledge of emergency procedures. (iii) Provide emergency preparedness training at least every 2 years. (iv) Periodically review and rehearse its emergency preparedness plan with hospice employees (including nonemployee staff), with special emphasis placed on carrying out the procedures necessary to protect patients and others. (v) Maintain documentation of all emergency preparedness training. (vi) If the emergency preparedness policies and procedures are significantly updated, the hospice must conduct training on the updated policies and procedures. *[For PRTFs at §441.184(d):] (1) Training program. The PRTF must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles. (ii) After initial training, provide emergency preparedness training every 2 years. (iii) Demonstrate staff knowledge of emergency procedures. (iv) Maintain documentation of all emergency preparedness training. (v) If the emergency preparedness policies and procedures are significantly updated, the PRTF must conduct training on the updated policies and procedures. *[For PACE at §460.84(d):] (1) The PACE organization must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing on-site services under arrangement, contractors, participants, and volunteers, consistent with their expected roles. (ii) Provide emergency preparedness training at least every 2 years. (iii) Demonstrate staff knowledge of emergency procedures, including informing participants of what to do, where to go, and whom to contact in case of an emergency. (iv) Maintain documentation of all training. (v) If the emergency preparedness policies and procedures are significantly updated, the PACE must conduct training on the updated policies and procedures. *[For LTC Facilities at §483.73(d):] (1) Training Program. The LTC facility must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected role. (ii) Provide emergency preparedness training at least annually. (iii) Maintain documentation of all emergency preparedness training. (iv) Demonstrate staff knowledge of emergency procedures. *[For CORFs at §485.68(d):](1) Training. The CORF must do all of the following: (i) Provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles. (ii) Provide emergency preparedness training at least every 2 years. (iii) Maintain documentation of the training. (iv) Demonstrate staff knowledge of emergency procedures. All new personnel must be oriented and assigned specific responsibilities regarding the CORF’s emergency plan within 2 weeks of their first workday. The training program must include instruction in the location and use of alarm systems and signals and firefighting equipment. (v) If the emergency preparedness policies and procedures are significantly updated, the CORF must conduct training on the updated policies and procedures. *[For CAHs at §485.625(d):] (1) Training program. The CAH must do all of the following: (i) Initial training in emergency preparedness policies and procedures, including prompt reporting and extinguishing of fires, protection, and where necessary, evacuation of patients, personnel, and guests, fire prevention, and cooperation with firefighting and disaster authorities, to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles. (ii) Provide emergency preparedness training at least every 2 years. (iii) Maintain documentation of the training. (iv) Demonstrate staff knowledge of emergency procedures. (v) If the emergency preparedness policies and procedures are significantly updated, the CAH must conduct training on the updated policies and procedures. *[For CMHCs at §485.920(d):] (1) Training. The CMHC must provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. The CMHC must demonstrate staff knowledge of emergency procedures. Thereafter, the CMHC must provide emergency preparedness training at least every 2 years. This Standard is not met as evidenced by: Based on review of policies and procedures, review of facility documentation and interview, it has been determined the facility failed to provide annual training in emergency preparedness policies and procedures. Failure to provide annual training in emergency preparedness can result in staff not being familiar with facility policies and procedures and not being up to date on facility emergency preparedness procedures. Findings include: Facility policy titled, “...Emergency Management Plan....” reviewed January 2024 revealed: “...Organization leadership will provide for orientation and education of all personnel regarding participation in the emergency management plan. Education will be provided during orientation and annually thereafter. Education to include...Specifics of organization’s emergency management plan...Information on developing their family’s emergency response plan...Information regarding accessing housing and transportation for staff if necessary....” A review of eleven (11) staff files was conducted. No documentation of emergency preparedness annual training could be found. A review of employee inservice training binders for employees and home health aides was conducted. No documentation of annual emergency preparedness training could be found. In an interview conducted with Employees #1 and #2 on December 4, 2024, Employee #1 confirmed that documentation of annual emergency preparedness training could not be provided.”

“Infection control CFR(s): 484.70(b)(1)(2) Standard: Control. The HHA must maintain a coordinated agency-wide program for the surveillance, identification, prevention, control, and investigation of infectious and communicable diseases that is an integral part of the HHA’s quality assessment and performance improvement (QAPI) program. The infection control program must include: (1) A method for identifying infectious and communicable disease problems; and (2) A plan for the appropriate actions that are expected to result in improvement and disease prevention. This Standard is not met as evidenced by: The facility must maintain a coordinated program for the surveillance, identification, prevention, control, and investigation of infectious and communicable diseases. Analysis of surveillance data should be used to improve care practices and control infections and transmission of communicable diseases. This STANDARD is NOT MET as evidenced by: Based on interview, review of facility policies and procedures and review of Infection Control documentation presented on December 4, 2024, the agency failed adhere to facility policies and procedures to complete TB community risk assessment in the geographic service area to evaluate the risk of M. Tuberculosis transmission. This deficient practice can lead to unnecessary increased risk for Tb transmission among personnel and staff. Findings include: Facility policy titled, “...Tuberculosis Exposure Control Plan”, revealed, “...A risk assessment to evaluate the risk of transmission of M.Tuberculosis will be conducted in the geographic service area and the types of care and services provided” A review of Infection Control Documentation provided on December 3, 2024, failed to reveal a completed TB risk assessment for the geographic area served for 2023 or 2024. In an interview with Employee #1 conducted on December 5, 2024, Employee #1 verified TB assessment for 2023 and 2024 not completed. TB risk assessment for the geographic area served was completed will surveyor was on site.”

“Infection control education CFR(s): 484.70(c) Standard: Education. The HHA must provide infection control education to staff, patients, and caregiver(s). This Standard is not met as evidenced by: The facility must ensure infection control education provided to personnel at periodic intervals to meet the staff’s learning needs to provide adequate care. Education to include identify infection signs and symptoms; identify routes of infection transmission. Such education must include instructions on how to implement current infection prevention/treatment practices in the home setting. This STANDARD is NOT MET as evidenced by: Based on interview, review of facility policies and procedures and review of medical records, the Department has determined the home health agency failed to ensure personnel records for each personnel member includes documentation of in-service education as required by policies and procedures. Seven(7) out of seven (7) personnel records reviewed, did not included documentation to support annual TB education. This deficient practice can a knowledge deficit in agency personnel resulting in inadequate infection control practices that can lead to increased risk of nosocomial TB transmission. Findings include: Facility policy titled, “...Tuberculosis Exposure Control Plan”, revealed, “...8. All home health personnel will receive training/education upon hire, and annually thereafter. The education will include: A Basic concepts of TB, transmission, pathogenesis, diagnosis, differences between the signs and symptoms of latent and active TB. B. Potential for exposure C. Principles of infection control to reduce the risk of transmission D. Purpose of the tuberculin skin testing E. Principles of infection control to reduce the risk of transmission E. Principles of preventative therapy for latent infection F. Principles of drug therapy G. Home health worker responsibility H. Responsibility of organization....” A review of Employee records revealed Employees #1,#2, #3,#4, #5, #6, and #7 did not have documentation of annual TB training. A review of Agency binder “In-Service Training” revealed Employees #1,#2, #3,#4, #5, #6, and #7 did not have documentation of annual TB training. In an interview with Employee #1 conducted on December 5, 2024, Employee #1 verified TB training was not provided by OSHA instructor during annual infection control Blood Borne pathogen training but will be included in the training moving forward.”

“Protection of records CFR(s): 484.110(d) Standard: Protection of records. The clinical record, its contents, and the information contained therein must be safeguarded against loss or unauthorized use. The HHA must be in compliance with the rules regarding protected health information set out at 45 CFR parts 160 and 164. This Standard is not met as evidenced by: The home health agency must ensure the clinical record, its contents and the information contained therein must be safeguarded against loss or unauthorized use. The hospice must be in compliance with the Department’s rules regarding personal health information as set out at 45 CFR parts 160 and 164. This STANDARD is NOT MET as evidenced by: Based on interview, review of facility policies and procedures and review of medical records, the Department has determined the home health agency failed to ensure the patient has the right to confidential clinical records means safeguarding the content, including paper records and/or electronically stored information from unauthorized disclosure without the specific informed consent of the patient or legal representative. This deficient practice can result in privacy violations, potential security breaches, and unauthorized access to patient data. Findings include: On December 4th, 2024 it was observed the confidential document destruction holding receptacle located in the hall next to the printer was not properly secured to ensure contents protected against unauthorized access to confidential patient information. During interview, administrator acknowledged the document receptacle holding confidential information documents to be destroyed was not properly secured to ensure unauthorized access. The administrator stated, “We will work on correcting this immediately” On December 4th, 2024 it was observed that a patient vaccine record log on a clipboard hanging on a front hallway wall contained confidential patient information covered by a single sheet of paper. During interview, administrator acknowledged the the clipboard shared by two facilities with staff from both facilities having access to the log contents. The administrator acknowledged this was not acceptable practice and stated, “We will correct this immediately””