Dr Home Health

“Release of patient identifiable OASIS info. CFR(s): 484.40 Condition of participation: Release of patient identifiable OASIS information. The HHA and agent acting on behalf of the HHA in accordance with a written contract must ensure the confidentiality of all patient identifiable information contained in the clinical record, including OASIS data, and may not release patient identifiable OASIS information to the public. This Condition is not met as evidenced by: Based on record review and interview, the agency failed to ensure the confidentiality of 2 of 15 discharged patients (Patients #14, and #15) identifiable information contained in the clinical record, including OASIS data, and did not prevent the release patient identifiable OASIS information to anyone other than an agency representative. This failure resulted in the confidential information of the 2 patients being identified / associated with Agency B instead of Agency A, and being accessible for unauthorized use on Agency’s B paper chart records. Refer to G0438.”

“Governing body CFR(s): 484.105(a) Standard: Governing body. A governing body (or designated persons so functioning) must assume full legal authority and responsibility for the agency’s overall management and operation, the provision of all home health services, fiscal operations, review of the agency’s budget and its operational plans, and its quality assessment and performance improvement program. This Standard is not met as evidenced by: Based on record review and interviews, 2 of 2 members of the agency’s governing body (ADM and Alt ADM) failed to be responsible for the overall management of the agency’s operations, in that: The two governing body members did not ensure the agency was actively engaged in planning for or providing skilled services since the formation of the agency. This failure placed the agency at risk of not having the staff and other services in place to provide care for skilled patients if needed and prevented the SR from determining the agency’s compliance with Federal provider requirements. Findings During pre-survey preparation for the survey on 08/25/2025, the SR did not find any results for the following OASIS reports: • Record review of report entitled, “Potentially Avoidable Event: Patient Listing Report” dated 08/25/2025 that was ran for the last 12 months revealed no results found. • Record review of report entitled; “Potentially Avoidable Event Report” dated 08/25/2025 that was ran for the last 12 months revealed no results found. • Record review of report entitled, “Agency Client-Related Characteristics (Case Mix) Report” dated 08/25/2025 that was ran for the last 12 months revealed no results found. • Record review of report entitled, “HHA Activity Report dated 08/25/2025 with ran range used of the last 12 months (01/01/24 to 12/31/24) revealed no results found. • Record review of report entitled, “HHA Activity Report” dated 08/25/2025 with ran range used of last 3 years (08/25/22 to 08/25/25) revealed no results found. • Record review of report entitled, “HHA Discharge Report” dated 08/25/2025 with ran range used of the last 12 months revealed no results found. • Record review of report entitled, “HHA Discharge Report” dated 08/25/2025 with ran range used of the last 3 years (08/25/22 to 08/25/25) revealed no results found. • Record review of report entitled, “HHA Roster Report” dated 08/25/2025 revealed no results found. • Record review of report entitled, “HHA Error Summary Report” dated 08/25/2025 with ran range of the last 12 months revealed no results found. Record review of TULIP (a database utilized by the state to maintain licensing, demographic information, complaints and self-reported incidents on home health and hospice agencies for the State of Texas), showed the following: • The agency maintained a current license to provide Hospice, L&C, LHHS and PAS Services for the licensure period of 06/09/2025 to 06/09/2028. • Listed Agency as the owner at 100% since 02/20/2020. Record review of agency’s employee roster revealed that DON and ADON as skilled nurses for the agency. During entrance conference on 08/26/2025 at 2:21PM. SR inquired from the Alt ADM, what the unduplicated skilled admission for the agency would be? Alt ADM stated, “That number would be 0, because we haven’t had any patients for the past year.” SR inquired from the Alt ADM, when was the last time the agency had any patients? Alt ADM stated, “I’m not sure.” SR inquired further from the Alt ADM, was the last patient serviced by the agency within the last three years? Alt ADM stated, “Yes. I think maybe year 2022, but I’m not really sure.” During entrance conference on 08/26/2025 at 2:54PM. When asked about surrendering the L&C and LHHS categories from the agency’s license for the agency since the agency had not admitted skilled patients since 2022, and to keep the PAS category only. Alt ADM stated, “We don’t do PAS anymore. So, we have L&C, and LHHS only when we renewed our license. We want to keep our provider number, We would like the opportunity to keep our provider number.” During an interview on 08/26/2025 with the Alt ADM at 3:38PM. SR inquired from the Alt ADM, can you tell me who the governing body are? Alt ADM stated, “Me and [ADM].” SR inquired further, what are the responsibilities of the governing body? Alt ADM stated, “We review the policies, the flow of the business, review annuals to review that we are in compliance. Review the budget. And pay all the bills.” During an interview on 08/26/2025 with the Alt ADM at 3:41PM. SR inquired from the Alt ADM, can you tell me what were the efforts that the agency made to admit patients to the agency prior to this survey? Alt ADM stated that she marketed but that didn’t work because all the contracts that the agency didn’t have. It seemed no one had just traditional Medicare. During an interview on 08/29/2025 with the Alt ADM at 5:32PM. SR inquired from the Alt ADM, if the Governing Body was responsible for getting referrals and obtaining patients. Alt ADM stated, “Yes you can say that.” During an interview on 08/29/2025 with the Alt ADM at 5:33PM. SR inquired from the Alt ADM, how could this failure affect patient/client care, if the governing body is not getting referrals and obtaining patients. Alt ADM stated, “There’s no effect on patient care.” During an interview on 08/29/2025 with the Alt ADM at 5:37PM. SR inquired from the Alt ADM, if the agency received any referrals? Alt ADM stated that towards the end of 2022 the agency stopped getting referrals. SR explained to Alt ADM on 08/29/2025 at 6:24PM that a CoP would be cited and the agency put on a 90-day termination track for failing to organize, manage, and administer its resources to be primarily engaged in providing Skilled nursing and other therapeutic services, so it remained qualified to participate in its provider agreement with Medicare / Medicaid. Record review of agency’s policy and procedure manual entitled, “LD.10- Governing Body” revised date of 10/12/2015 pages 1 to 3, reads in part, “Purpose: To define the authority and responsibility of the governing body. Policy: A. A governing body/owner, whether an individual, members of a limited liability corporation or a board of directors, assumes full legal authority and responsibility for the management… the provision of all services, its fiscal operations, and the continuous quality assessment and performance improvement that are consistent with acceptable standards of practice. B. The governing body/owner sign and abide by the confidentiality statement policies… Procedure… B… Activities of the governing body/owner include, but are not limited to: • Decision making; • Appointing a qualified administrator… • Reviewing the annual program evaluation; • Adopting and periodically reviewing written bylaws or equivalent; • Establishing or approving written policies and procedures governing operations… Quality Assessment/ Performance Improvement… • Oversight of the management and fiscal affairs of the hospice; • Annual review of the policies and procedures; • Retaining ultimate responsibility when authority is delegated to individual personnel or to an advisory committee; and • Oversight… is documented in reports to the board or documented in minutes of board meetings…””

“Have a confidential clinical record CFR(s): 484.50(c)(6) Have a confidential clinical record. Access to or release of patient information and clinical records is permitted in accordance with 45 CFR parts 160 and 164. This Element is not met as evidenced by: Based on record review and interview, the agency (Agency A) failed to ensure the confidentiality of 2 of 15 discharged patients (Patients #14 and #15) identifiable information contained in the clinical record, including OASIS data, and did not prevent the release patient identifiable OASIS information to anyone other than an agency representative, in that; Agency A was provided access to printed-out binders for Agency B for patients #14, and #15. This use of Agency B’s printed-out paper chart binders provided Agency A’s personnel with access to the confidential records of patients #14, and #15. These failures resulted in the confidential information of the 2 Agency A patient’s being identified / associated with Agency B instead of Agency A, and being accessible for unauthorized use on Agency B’s printed-out paper chart binders. Findings Record review of discharged patient roster, revealed that Patients #14, and #15 were not included in the discharged patient roster. Instead, Agency A presented to SR printed out paper chart binders of Patients #14, and #15. CR of Patient #14 Record review of discharged Patient #14’s POC entitled, “Home Health Certification and Plan of Care” for SOC 03/27/2021 with the certification period of 03/27/21 to 05/25/21 reads in part, ““Agency A at the address of Agency A’s 2nd location…” Further record review revealed patient’s identifiable health information such as patient’s name, address, DOB (date of birth), and medical history. Although, agency was listed on POC as providing services for patient #14; per OASIS Reports from years 2021 to present (08/29/2025), patient #14 was not a patient of the agency. CR of Patient #15 Record review of discharged Patient #15’s document entitled, “OASIS-D1 Transfer” for SOC 07/14/2021 with the certification period of 07/14/21 to 09/11/21 reads in part, “Agency A at the address of Agency B.” Although, agency was listed on the document as providing services for patient #15; per OASIS Reports from years 2021 to present (08/29/2025), patient #15 was not a patient of the agency. During an interview on 08/28/2025 with the Alt ADM at 10:21AM. Alt ADM, “I am looking through these (patient) binders, and it looks like I only have two of them instead of the three that I thought I had.” HIPAA data breach violations occurred when Agency A obtained patient #14, and patient #15’s printed-out paper chart binders from [EMR A] through Agency B administrative staff member. During an interview on 08/29/2025 with the Alt ADM at 5:46PM. SR inquired from the Alt ADM, why did you give me full access to the patients that were not listed in the discharged roster that was provided for the year 2022. Alt ADM stated, “I don’t understand.” SR restated the question; for instance: patients, [Other patient #1] and [Other patient #2] were discharged in the year 2024. Why was I granted access to these patient’s records to review them. Alt ADM stated, “Due to cost of the EMR system, we attempted to take ownership over another entity’s EMR system that was not being utilized at the time.” SR inquired from the Alt ADM, if the patients were admitted under the agency, why did agency continue to use the EMR for [Agency B]? Alt ADM stated, “I don’t understand but let me rephrase, why did we continue to use their platform? Um… a. we needed an EMR system for… How can I say this? Basically, documentation purposes, for organized documentation purposes. 2. We were told that we could update our info to change ownership of the EMR platform.” SR inquired further from the Alt ADM, who was the one that told the agency that the agency can do that? Alt ADM stated, “When we called [EMR B] there’s a form that you can fill out to update that information. right?” During an interview on 08/29/2025 with the Alt ADM at 6:03 PM. SR inquired from the Alt ADM, who is to ensure that the policies and procedures of HIPAA are implemented accordingly throughout the agency. Alt ADM stated, “Who is to ensure? That would be the ADM and the DON; but everyone that also has contact with the patient’s information. However, ADM and DON enforce the policy of HIPAA.” Record review of agency’s policy manual entitled, “Release of Patient Identifiable OASIS Information- 6.3.1” unrevised date, and unpaged, reads in part, “Policy: the agency will safeguard data collected for the OASIS items. Purpose: To define relation of information for OASIS items. Procedure: Agency staff (including contract staff) will ensure the confidentiality of all patient information contained in the medical record, including OASIS data items. Agency will not release patient identifiable OASIS information to the public.” Record review of agency’s policy manual entitled, “Patient Confidentiality” an unrevised date, and unpaged, reads in part, “Policy: All information related to provision of home care for specific patient is treated confidential, including home care records. Purpose: Every patient has the right to know that any information related to the care provided by the Agency will be kept confidential. Every employee will be aware of the need for patient confidentiality and to respect it. Procedure: The agency will comply with applicable HIPAA rules and regulations. 2. Staff will treat any information obtained from patients, caregivers, physicians and other sources in a confidential manner… 14. The Agency maintains the confidentiality of OASIS data while it is being used for patient care and may not release it without the consent of the patient for any reason other than for what it is intended, which is to appropriately deliver patient care. Access to OASIS information is limited to Agency staff. 15. If the Agency contracts with a vendor for transmission of its OASIS data, a written agreement addresses the confidentiality of that data must be in place. Violations of data confidentiality by an entity contracted by the Agency are still the responsibility of the Agency and would constitute condition level non-compliance. Therefore, the Agency is ultimately responsible for compliance with the confidentiality requirements and is the responsible party if the contractor does not meet the requirements…””