Magnolia Regional Health Center

“COMPLIANCE WITH LAWS CFR(s): 482.11(a) The hospital must be in compliance with applicable Federal laws related to the health and safety of patients. This Standard is not met as evidenced by: 48927 Based on staff interviews, review of the facility’s Record of Conference with Compliance/HIPAA for Physician #1, Board of Trustees Audit and Compliance Committee Meeting Minutes dated 02/16/2026, e-mail documentation of the Health Insurance Portability Accountability Act (HHIPAA) Investigation dated 10/03/2026 and HIPAA policies provided the facility failed to ensure the facility followed federal HIPAA regulations for reporting a breach of patient privacy under the Department of Health and Human Services Office for Civil Rights, 45 CFR Parts 164 Security and Privacy Sub Part D “Notification in the Case of a Breach of Unsecured Protected Health Information” for one (1) of three (3) medical records reviewed; Patient #1. Findings Include: An interview with the facility’s Compliance Officer/Risk Manager/Patient Advocate on 05/20/2026 at 9:57 a.m. revealed the Compliance Officer participated in the internal investigation for this complaint and that the investigation confirmed Physician #1 ordered 24 cupcakes with Patient #1’s picture on them with the caption “frequent flyer”. The Compliance Officer reported Physician #1 confirmed the picture was obtained from social media and sent to the local bakery. The cupcakes were brought into the Emergency Department (ED) by Physician #1 and placed in the ED breakroom. An additional interview with the facility’s Compliance Officer/Risk Manager/Patient Advocate on 05/20/2026 at 11:41 a.m. confirmed the facility performed an internal Human Resources Investigation and that the facility did not report the incident to the Mississippi State Board of Medical Licensure. The complaint was reported anonymously. A follow-up interview with the facility’s Compliance Officer/Risk Manager/Patient Advocate on 05/20/2026 at 1:09 p.m. confirmed the facility failed to report incident to the Office of Civil Rights based on federal regulations at 45 CFR Parts 164 Security and Privacy Sub Part D “Notification in the Case of a Breach of Unsecured Protected Health Information. Review of the facility’s record of conference, “Performance Management Record of Conference (Compliance/HIPAA)”, dated 10/01/2025 regarding Physician #1 confirmed. “ ...facility’s compliance officer, risk management, patient advocate was contacted the morning of 10/01/2025 regarding cupcakes with a patient’s picture embedded in the icing. An investigation was initiated and discovered the cupcakes were a gift from Physician #1 to Registered Nurse (RN) #1 for her birthday. Emergency Room (ER) cameras confirmed Physician #1 brought the cupcakes in through the back door of the ER and took them to the ER breakroom. The investigation confirmed the cupcakes were ordered through a local bakery. Physician #1 confirmed she sent a social media image of Patient #1 to the local bakery and had it added to the icing of 24 cupcakes ...The facility determined Physician #1’s actions were in violation of the Compliance Pledge, Confidentiality Statement, Portions of the Employee Handbook, which include segments regarding Employee Conduct and Work Rules, Social Media and Confidentiality/HIPAA Compliance and her conduct did not exhibit the characteristics of abiding by the facility’s Promise, Values and ROOTS ...”. No documented evidence in the report the breach was reported to the Office of Civil Rights or to the patient whose rights were violated. Review of the facility’s Board of Trustees Audit and Compliance Committee Meeting Minutes dated 02/16/2026, reveal no documentation of the privacy breach reported to the Office of Civil Rights or to the patient whose rights were violated based on the federal requirements at 45 CFR Parts 164 Security and Privacy Sub Part D “Notification in the Case of a Breach of Unsecured Protected Health Information. Unable to review the facility’s policy and procedure for reporting, facility only provided HIPAA policies for Authorizations 5.0 and Training 14.0. No HIPAA reporting policies and procedures presented for review. Review of the Facility’s email dated 10/06/2026 at 11:55 a.m. between the Facility’s Compliance Officer/Risk Manager/Patient Advocate and Physician #2, the Department Chair/Program Director of Emergency Medicine reveals the facility identified the incident as a HIPAA violation with a list of violations that were identified. During exit conference on 05/20/2026 at 5:00 p.m. with the Compliance Officer, Risk Management, Patient Advocate, survey findings were discussed, and no further information was submitted for review.”

“PATIENT RIGHTS: PERSONAL PRIVACY CFR(s): 482.13(c)(1) The patient has the right to personal privacy. This Standard is not met as evidenced by: 48927 Based on staff interviews, review of the facility’s Record of Conference with Compliance/Health Insurance Portability Accountability Act (HIPAA) for Physician, e-mail documentation of the facility’s HIPAA Investigation dated 10/03/2026, and HIPAA policies provided, the facility failed to ensure the privacy requirements for a patient’s basic right to respect, and dignity were met or reported to the required agencies for one (1) of three (3) patient records reviewed; Patient #1 Findings Include: An interview with the facility’s Compliance Officer/Risk Manager/Patient Advocate on 05/20/2026 at 9:57 a.m. revealed the Compliance Officer participated in the internal investigation for this complaint and the investigation confirmed Physician #1 ordered 24 cupcakes with Patient #1’s picture on them and the caption “frequent flyer”. She reported Physician #1 confirmed the picture was obtained from social media and sent to the local bakery. The cupcakes were brought into the Emergency Department (ED) by Physician #1 and placed in the ED breakroom. Review of the facility’s record of conference, “Performance Management Record of Conference (Compliance/HIPAA)”, dated 10/01/2025 regarding Physician #1 confirmed. “ ...facility’s compliance officer, risk management, patient advocate was contacted the morning of 10/01/2025 regarding cupcakes with a patient’s picture embedded in the icing. An investigation was initiated and discovered the cupcakes were a gift from Physician #1 to Registered Nurse (RN #1) for her birthday. Emergency Room (ER) cameras confirmed Physician #1 brought the cupcakes in through the back door of the ER and took them to the ER breakroom. The investigation confirmed the cupcakes were ordered through a local bakery. Physician #1 confirmed she sent a social media image of patient #1 to the local bakery and had it added to the icing of 24 cupcakes ...The facility determined Physician #1’s actions were in violation of the Compliance Pledge, Confidentiality Statement, Portions of the Employee Handbook, which include segments regarding Employee Conduct and Work Rules, Social Media and Confidentiality/HIPAA Compliance and her conduct did not exhibit the characteristics of abiding by the facility’s Promise, Values and ROOTS ...” and Action Taken and Plan for Improvement including suspension and Physician #1 will provide HIPAA training to Emergency Room Physicians (ERPs) and Emergency Room (ER) Residents once a month for six months beginning 10/01/2025 with evidence of the same presented to Physician #2. At the time of this survey, no documented evidence of HIPAA training by Physician #1 has been provided for review. Review of the Facility’s email dated 10/06/2026 at 11:55 a.m. between the Facility’s Compliance Officer/Risk Manager/Patient Advocate and Physician #2, the Department Chair/Program Director of Emergency Medicine reveals the facility identified the incident as a HIPAA violation with a list of violations that were identified. No documentation provided the facility followed the federal regulations for reporting HIPAA breaches. Review of the facility policy “HIPAA Compliance 5.0 Authorizations,” no documented date reveals A HIPAA compliant authorization will be utilized before Using or Disclosing that individual’s protected health information (PHI) for any purpose not permitted by HIPAA ...”. During exit conference on 05/20/2026 at 5:00 p.m. with the Compliance Officer, Risk Management, Patient Advocate, survey findings were discussed, and no further information was submitted for review.”

“QUALITY IMPROVEMENT ACTIVITIES CFR(s): 482.21(b)(2)(ii), (c)(1), (c)(3) (b) Program Data (2) [The hospital must use the data collected to - .....] (ii) Identify opportunities for improvement and changes that will lead to improvement. (c) Program Activities (1) The hospital must set priorities for its performance improvement activities that-- (i) Focus on high-risk, high-volume, or problem-prone areas; (ii) Consider the incidence, prevalence, and severity of problems in those areas; and (iii) Affect health outcomes, patient safety, and quality of care. (3) The hospital must take actions aimed at performance improvement and, after implementing those actions, the hospital must measure its success, and track performance to ensure that improvements are sustained. This Standard is not met as evidenced by: 48927 Based on staff interview and review of the facility’s Performance Management Record of Conference (Compliance/Health Insurance Portability Accountability Act (HIPAA)) the facility failed to ensure actions for improvement were implemented to prevent additional privacy breaches to include HIPAA training by Physician #1 one (1) time a month for six (6) months beginning 10/01/2025 for the Emergency Department (ED) Providers and ED Residents for one (1) of one (1) days of survey. Findings Include: Interview on 05/20/2026 at 1:09 p.m. with the Facility’s Compliance Officer confirmed the facility does not have documentation that the required monthly HIPAA training for six (6) months beginning 10/01/2025 was provided by Physician #1 to Emergency Department (ED) Providers and ED Residents as part of her disciplinary action plan related to a HIPAA breach. Review of the facility’s record of conference, “Performance Management Record of Conference (Compliance/HIPAA)”, dated 10/01/2025 regarding Physician #1 confirmed. “ ...facility’s compliance officer, risk management, patient advocate was contacted the morning of 10/01/2025 regarding cupcakes with a patient’s picture embedded in the icing. An investigation was initiated and discovered the cupcakes were a gift from Physician #1 to Registered Nurse (RN #1) for her birthday. Emergency Room (ER) cameras confirmed Physician #1 brought the cupcakes in through the back door of the ER and took them to the ER breakroom. The investigation confirmed the cupcakes were ordered through a local bakery. Physician #1 confirmed she sent a social media image of patient #1 to the local bakery and had it added to the icing of 24 cupcakes ...The facility determined Physician #1’s actions were in violation of the Compliance Pledge, Confidentiality Statement, Portions of the Employee Handbook, which include segments regarding Employee Conduct and Work Rules, Social Media and Confidentiality/HIPAA Compliance and her conduct did not exhibit the characteristics of abiding by the facility’s Promise, Values and ROOTS ...Action taken and Plan for Improvement: ...Physician #1 will provide HIPAA training to Emergency Room Physicians (ERPs) and Emergency Room (ER) Residents once a month for six months with evidence of the same presented to Physician #2 ...”. No evidence of HIPAA education present for review. Review of the facility policy “HIPAA Compliance 5.0 Authorizations,” no documented date reveals A HIPAA compliant authorization will be utilized before Using or Disclosing that individual’s protected health information (PHI) for any purpose not permitted by HIPAA ...”. During the Exit Conference on 05/20/2026 at 5:00 p.m. with facility’s Compliance, Risk Management, Patient Advocate, survey findings were discussed, and no further documentation was submitted for review.”

“COMPLIANCE WITH 489.24 CFR(s): 489.20(l) [The provider agrees,] in the case of a hospital as defined in §489.24(b), to comply with §489.24. This Standard is not met as evidenced by: 42975 Based on medical record review and review of the facility’s “Medical Staff Bylaws and Rules and Regulations,” the facility failed to provide an appropriate medical screening exam (MSE) to evaluate a pregnant patient (25 weeks gestation) for other possible emergency medical conditions related to pain and possible gallstones after triage in the Labor and Delivery Department ruled out fetal distress or complications for one (1) of 20 medical records reviewed; Patient #1. Findings Include: Review of Patient #1’s medical record for 09/01/2024 reveals Patient presented to the Emergency Department (ED) at 2:28 p.m. with a complaint of abdominal pain, 25 weeks pregnant, and possible gallstones. Triaged by Registered Nurse (RN) #1 at 2:46 p.m. and report called to RN # 2 in Labor and Delivery department because patient is over 20 weeks gestation in pregnancy and patient transported to the Labor and Delivery Department. Review of Patient #1’s medical record “OB-Progress Notes” for 09/01/2024 at 2:55 p.m. revealed the Patient was triaged by Obstetric Registered Nurse (OBRN) #2. Patient #1 complaint of abdominal pain that worsens at times with worse pain this morning, denies contractions, vaginal bleeding or fluid leaking. Patient #1 states, “ ...Primary Care Physician (PCP) reported seeing gallstones on a recent scan ...” no follow-up care has been scheduled. Fetal monitors placed; urinalysis obtained, no evidence of contractions, fetal distress or demise, urinalysis results protein-positive (+) one (1), blood-large, ketones -moderate, urobilinogen-one (1), bilirubin-negative, glucose-negative, nitrates-negative. The RN called the Obstetric Physician on-call, Physician #1, with results from Labor and Delivery Department triage assessment and received orders for Patient #1’s discharge and to follow-up with clinic or Primary Care Provider (PCP). Progress note reveals Patient #1 was discharged at 3:54 p.m. There was no documented evidence of a history and physical exam to determine the etiology of present complaint of abdominal pain, details of pain, or presence of other symptoms which may suggest and emergent medical condition by a qualified medical practitioner. Cross refer to A-2406/489.24(a) for further information documenting the facility’s failure to complete a medical screening examination by a qualified medical practitioner (QMP) to determine if an emergency medical condition (EMC) exists. During the Exit conference with the Director of Quality Services, Director of Compliance, Executive Director of Clinical Services, Chief Nursing Officer and the Chief Executive Officer on 10/17/2024 at 1:00 p.m. survey findings were discussed, and no further information was presented for review.”

“MEDICAL SCREENING EXAM CFR(s): 489.24(a) & 489.24(c) (a) Applicability of provisions of this section. (1) In the case of a hospital that has an emergency department, if an individual (whether or not eligible for Medicare benefits and regardless of ability to pay) “comes to the emergency department”, as defined in paragraph (b) of this section, the hospital must- (i) Provide an appropriate medical screening examination within the capability of the hospital’s emergency department, including ancillary services routinely available to the emergency department, to determine whether or not an emergency medical condition exists. The examination must be conducted by an individual(s) who is determined qualified by hospital bylaws or rules and regulations and who meets the requirements of §482.55 of this chapter concerning emergency services personnel and direction; and (ii) If an emergency medical condition is determined to exist, provide any necessary stabilizing treatment, as defined in paragraph (d) of this section, or an appropriate transfer as defined in paragraph (e) of this section. If the hospital admits the individual as an inpatient for further treatment, the hospital’s obligation under this section ends, as specified in paragraph (d)(2) of this section. (2)(i) When a waiver has been issued in accordance with section 1135 of the Act that includes a waiver under section 1135(b)(3) of the Act, sanctions under this section for an inappropriate transfer or for the direction or relocation of an individual to receive medical screening at an alternate location do not apply to a hospital with a dedicated emergency department if the following conditions are met: (A) The transfer is necessitated by the circumstances of the declared emergency in the emergency area during the emergency period. (B) The direction or relocation of an individual to receive medical screening at an alternate location is pursuant to an appropriate State emergency preparedness plan or, in the case of a public health emergency that involves a pandemic infectious disease, pursuant to a State pandemic preparedness plan. (C) The hospital does not discriminate on the basis of an individual’s source of payment or ability to pay. (D) The hospital is located in an emergency area during an emergency period, as those terms are defined in section 1135(g)(1) of the Act. (E) There has been a determination that a waiver of sanctions is necessary. (ii) A waiver of these sanctions is limited to a 72-hour period beginning upon the implementation of a hospital disaster protocol, except that, if a public health emergency involves a pandemic infectious disease (such as pandemic influenza), the waiver will continue in effect until the termination of the applicable declaration of a public health emergency, as provided under section 1135(e)(1)(B) of the Act. (c) Use of dedicated emergency department for nonemergency services. If an individual comes to a hospital’s dedicated emergency department and a request is made on his or her behalf for examination or treatment for a medical condition, but the nature of the request makes it clear that the medical condition is not of an emergency nature, the hospital is required only to perform such screening as would be appropriate for any individual presenting in that manner, to determine that the individual does not have an emergency medical condition. This Standard is not met as evidenced by: 42975 Based on staff interview, medical record review, and policy and procedure review, the facility failed to provide an appropriate medical screening exam (MSE) to evaluate a pregnant patient (25 weeks gestation) for other possible emergency medical conditions related to pain and possible gallstones within the capability of the facility’s emergency department by a qualified medical practitioner to determine if an emergency medical condition (EMC) exist after triage in the Labor and Delivery Department ruled out fetal complications for one (1) of 20 medical records reviewed; Patient #1 Findings Include: Review of Patient #1’s medical record revealed the patient presented to the Emergency Department (ED) 25 weeks pregnant with a complaint of abdominal pain on 09/01/2024 and was triaged and sent to the Labor and Delivery Department for evaluation. Patient #1 was triage by a Registered Nurse (RN). Patient reported Primary Care Physician (PCP) saw gallstones on a recent scan, but no follow-up care has been scheduled. No reported vaginal bleeding, no fluid leakage, fetal monitoring shows no contractions, urinalysis results protein-positive (+) one (1), blood-large, ketones -moderate, urobilinogen-one (1), bilirubin-negative, glucose-negative, nitrates-negative. The RN called Physician with results from Labor and Delivery Department triage and received orders for discharge and to follow-up with clinic or PCP. There was no documented evidence a medical screening exam (MSE) with a history and physical exam was performed by a qualified medical practitioner or documentation Patient #1 was sent back to the main Emergency Department (ED) for a MSE to determine the etiology of the patient’s presenting complaint and if an emergent medical condition (EMC) existed that was not related to pregnancy. Interview on 10/16/2024 at 2:00 p.m. with Physician #1, (Obstetrician-Gynecologist (OBGYN) on-call on 09/01/2024) revealed based on report received Patient #1 was not in distress, pregnancy was not in danger. Physician stated he did not send the patient back to the ED. Interview with ED Triage nurse #1 on 10/15/2024 at 3:05 p.m. confirmed he triaged Patient #1, notified the Labor and Delivery Department and transported Patient #1 via wheelchair to Labor and Delivery. ED triage nurse confirmed this was policy and procedure for obstetrical patients over 20 weeks of gestation. Review of the facility’s policy and procedure, “Obstetric (OB) Patients Presenting to Emergency Department,” #ED 554, revised date 06/01/2023, revealed “ ...4. Abdominal Pain ... 1. Ambulatory patients 20 weeks or greater gestation: a. All ambulatory OB patients presenting to the Emergency Department shall register per ED procedures as outpatients b. All ambulatory OB patients will be given a triage assessment in the Emergency Department by the triage nurse. i. If the patient has an OB related problem, and is determined to have no respiratory or circulatory instability, she is to be taken to the Obstetrical Department ... c. The Obstetrical Department will be notified of the patient in the Emergency Department and patient will be transported to the Obstetrical Department by ED staff. d. The patient will be assessed by an OB nurse and the patients on-staff physician, or the on-call Obstetrician will be notified for exam. i. The obstetrician must assess the patient within a reasonable amount of time. ii. This evaluation constituted the medical screening exam as is required of all patients presenting to the Emergency Department ...”. Review of the facility’s policy, “Triage/Medical Screening Exam,” policy #ED 578, revised date 06/01/2023 reveals “ ...An appropriate medical screening exam will be provided within the capability of the ED, including ancillary services routinely available to the ED, to determine whether or not an emergency medical condition exists. ED’s obligations to perform a medical screening examination shall be triggered when: (i) an individual presents to the emergency department and a request is made by the individual or on the individual’s behalf for examination or treatment for a medical condition; ...Only qualified medical personnel may provide medical screening examinations ...”. During the Exit conference with the Director of Quality Services, Director of Compliance, Executive Director of Clinical Services, Chief Nursing Officer and the Chief Executive Officer on 10/17/2024 at 1:00 p.m. survey findings were discussed, and no further information was presented for review.”