North Shore University Hospital

“GOVERNING BODY CFR(s): 482.12 There must be an effective governing body that is legally responsible for the conduct of the hospital. If a hospital does not have an organized governing body, the persons legally responsible for the conduct of the hospital must carry out the functions specified in this part that pertain to the governing body ... This Condition is not met as evidenced by: 28406 . Based on interview and record review, the facility’s Governing Body failed to maintain oversight of the hospital’s Quality Assessment and Performance Improvement Program to ensure corrective actions were implemented for patients’ privacy violations (A-0053). . Cross Reference: 482.12(a)(10) Governing Body: Consultation with Medical Staff”

“QAPI CFR(s): 482.21 The hospital must develop, implement and maintain an effective, ongoing, hospital-wide, data-driven quality assessment and performance improvement program. The hospital’s governing body must ensure that the program reflects the complexity of the hospital’s organization and services; involves all hospital departments and services (including those services furnished under contract or arrangement); and focuses on indicators related to improved health outcomes and the prevention and reduction of medical errors. The hospital must maintain and demonstrate evidence of its QAPI program for review by CMS. This Condition is not met as evidenced by: 28406 . Based on document review and interview, the facility failed to ensure that a breach in patients’ privacy was timely reported, and corrective actions implemented, per the facility policy on Occurrence Reporting (A-0286). . Cross Reference: 482.21(a)(1)(2), (c)(2), (e)(3) QAPI: Patient Safety, Medical Errors & Adverse Events”

“CONSULTATION WITH MEDICAL STAFF CFR(s): 482.12(a)(10) [The governing body must:] §482.12(a)(10) Consult directly with the individual assigned the responsibility for the organization and conduct of the hospital’s medical staff, or his or her designee. At a minimum, this direct consultation must occur periodically throughout the fiscal or calendar year and include discussion of matters related to the quality of medical care provided to patients of the hospital. For a multi-hospital system using a single governing body, the single multi-hospital system governing body must consult directly with the individual responsible for the organized medical staff (or his or her designee) of each hospital within its system in addition to the other requirements of this paragraph (a). This Standard is not met as evidenced by: 28406 . Based on record review and interview, the facility failed to demonstrate timely review and regulatory compliance of their Hospital Extension Clinic (Sleep Study Center) after a significant occurrence. Findings: A review of the Bylaws and Rules and Regulations of the Medical Staff, effective 10/6/2022, revealed that the Board of Trustees is responsible for establishing policies for institutional management and planning and establishing a mechanism for monitoring, evaluating, and improving the quality of patient care through an organizational performance improvement program. “The Chief Executive Officer appoints additional corporate committees as deemed necessary to properly carry out the operations of the hospital as such, those committees shall confine their activities to the purpose for which they were appointed ... Committees of the Board shall keep regular minutes of the proceedings reflecting business conducted, including findings, conclusions and recommendations and shall report such meetings minutes to the Board of Trustees as required ...” On 4/19/2025, the facility became aware Staff A had been using hidden cameras in the bathroom to record patients in the sleep center. On 9/3/2025, surveyors requested evidence the Chief Executive Officer or administration had notified the Governing Body of the significant occurrence. On 9/3/2025, the facility provided the Governing Body’s “Audit and Corporate Compliance Committee Meeting and Agenda,” dated 4/24/2024, 6/19/2024, 9/24/2024, 1/28/2025, and 4/28/2025. A review of these documents revealed that all minutes and agenda items were redacted. During the interview on 9/3/2025 at 11:40 AM, Staff G stated that the hospital would violate attorney-client privileges by releasing the Governing Body transcripts of the Audit and Surveillance Committee to State Agency Surveyors. The facility failed to provide alternative documented evidence that the Governing Body had been notified of the significant occurrence, reviewed the occurrence, or took action. Further review of all available documents provided by the facility included an email dated 5/21/2025, from the hospital CEO (Chief Executive Officer) to the Board of Trustees. The email outlined that a former employee of the Extension Clinic (Sleep Study Center) was indited on criminal charges. However, the letter showed no evidence of the development, formulation, or implementation of any corrective actions taken systemically in the hospital in response to the occurrence. On 9/5/2025 at 11:10 AM, during an interview and discussion of the Governing Body Minutes with Staff H and Staff J, the staff confirmed that the Governing Body could produce no documented evidence of reviewing and implementing corrective actions or reeducating hospital staff on policies and procedures, including the Corporate Compliance Code of Ethical Conduct.”

“PATIENT RIGHTS: PERSONAL PRIVACY CFR(s): 482.13(c)(1) The patient has the right to personal privacy. This Standard is not met as evidenced by: 10723 . Based on document review and interview, the hospital failed to ensure that staff immediately escalated violations of patients’ privacy in accordance with its Code of Ethical Conduct. Findings: The facility’s “Code of Ethical Conduct,” dated 6/8/2023, directs staff to report immediately to their supervisor, to another member of senior management at the facility, the Office of Corporate Compliance, or the Compliance Helpline, any actual or suspected violations of the code, including breaches of patient privacy and security, or misconduct of any type. Review of the personnel files for Staff E, Staff B, and Staff C revealed these staff members were trained on the code of ethical conduct at the time of their hire. The facility’s policy and procedure, titled “Patient Rights and Responsibilities,” last approved in 4/2024, indicated that patients have the right, consistent with law, to be treated with consideration, respect, and dignity, including privacy in treatment. Interview on 9/2/2025 at 2:30 PM with Staff E revealed that on 4/19/2024 at 11:00 PM, they observed Staff A watching a video of patients using the restroom on their work computer. On 4/22/2024, between 8:00 AM and 9:00 AM, Staff E reported the incident to Staff D. During interview on 9/2/2025 at 1:45 PM, Staff C reported that on 4/23/2024, Staff A admitted to secretly recording patients using the restroom and recorded on 4/20/2024 and 4/21/2024. Staff C revealed they informed Staff A that they were no longer permitted to enter the Sleep Disorder Center. Review of Staff A’s “Badge Event” confirmed that Staff A worked and had patient contact on 4/20/2024 and 4/21/2024. Review of the “Time Reception Detail Desk Report” for the Sleep Disorder Center revealed that fourteen patients (five minors and nine adults) were admitted between 4/20/2024 and 4/21/2024. There was no documented evidence that the patient privacy violation was immediately reported by Staff E, as per the facility’s policy. Staff A worked an additional two nights, during which time Staff A continued to film patients using the restroom. During an interview with Staff H on 9/5/2025 at 9:15 AM, Staff H confirmed these findings. An Immediate Jeopardy (IJ) situation was identified on 9/5/2025 at 2:35 PM due to the hospital’s failure to immediately escalate violations of patients’ privacy in accordance with its Code of Ethical Conduct. The facility provided an IJ Removal Plan to survey staff on 9/5/2025 at 4:39 PM. The IJ removal plan was accepted on 9/5/2025 at 5:30 PM. The IJ was removed on 9/8/2025 at 3:00 PM, based on onsite verification of the facility’s implementation of the IJ Removal Plan through observations, interviews, and document review. .”

“PATIENT SAFETY CFR(s): 482.21(a), (c)(2), (e)(3) (a) Standard: Program Scope (1) The program must include, but not be limited to, an ongoing program that shows measurable improvement in indicators for which there is evidence that it will ... identify and reduce medical errors. (2) The hospital must measure, analyze, and track ...adverse patient events ... (c) Program Activities ..... (2) Performance improvement activities must track medical errors and adverse patient events, analyze their causes, and implement preventive actions and mechanisms that include feedback and learning throughout the hospital. (e) Executive Responsibilities, The hospital’s governing body (or organized group or individual who assumes full legal authority and responsibility for operations of the hospital), medical staff, and administrative officials are responsible and accountable for ensuring the following: ... (3) That clear expectations for safety are established. This Standard is not met as evidenced by: 28406 . Based on document review and interview, the facility failed to ensure that a breach in patients’ privacy was timely reported, and corrective actions were implemented per the facility’s Occurrence Reporting policy. Findings: A review of the facility’s policy titled, “Occurrence Reporting,” effective 3/2022, directs all employees to report occurrences involving patient care immediately via the electronic reporting system to ensure that an appropriate record is made and maintained. “The facility’s electronic reporting system shall be utilized by the person or healthcare team member who first learned of or has the best knowledge of the event ... The electronic submission of the event will be reviewed by the designated facility/departmental leadership and Quality Management. As applicable, other departments may be notified, such as Corporate Risk Management and the Office of Legal Affairs. When an occurrence involves any patient and is a security/safety-related incident, the Security Department shall be notified so that an applicable Security Incident report can be completed. Site Security will forward these reports to Corporate Risk Management as needed.” Review of the Personnel files for Staff E, C, and B revealed that these staff members had been trained to this policy at the time of their hire. Review of the security incident report dated 4/25/2024 revealed an arrest notification for Staff A for “tampering with physical evidence and unlawful surveillance.” A review of hospital incident reports from 4/01/2024 to 8/29/2025 revealed no incident regarding patient privacy breaches in the Sleep Study Clinic were reported. An interview with Staff B, on 8/29/25 at 11:25 AM, confirmed that on 4/19/2024, Staff A was observed by another Staff member (Staff E) watching patients using the restroom on camera in violation of ethical codes of conduct. Staff B did not complete an incident report. In an interview on 9/3/2025 at 2:35 PM, Staff E, confirmed that they witnessed patient privacy breaches at the Sleep Study Clinic on 4/19/2024 at 11:00 PM, but did not complete an incident report. Per interview on 9/2/2025 at 1:45 PM, Staff C was informed of the patient privacy violations on 4/23/2024 at 3:30 PM. Staff C confirmed that they did not complete a security incident report. There was no evidence an occurrence report or security report was submitted for review by the designated facility/departmental leadership and Quality Management, as required by hospital policy. These findings were confirmed by Staff H, on 9/3/2025 at 9:15 AM. Staff H stated an incident was not documented in the facility’s electronic reporting system and had not gone through the facility’s quality review process.”