Johnson City Medical Center

“OPERATING ROOM POLICIES CFR(s): 482.51(b) Surgical services must be consistent with needs and resources. Policies governing surgical care must be designed to assure the achievement and maintenance of high standards of medical practice and patient care. This Standard is not met as evidenced by: 36003 Based on facility policy review, review of an Association for Professionals in Infection Control and Epidemiology (APIC) document, observations and interviews the facility failed to ensure surgical instruments were cleaned in accordance with professional standards for 1 of 3 decontamination areas observed. The findings include: Review of the facility’s policy titled, “Surgical Services Sterile Processing,” dated 3/7/2025, revealed “...Sterile processing is a multi-step process...to provide clean and sterile surgical supplies and equipment for patient use... Decontaminating ...cleaning all reusable items...Workflow patterns will be implemented and maintain workflow form [from] high contamination areas to clean areas...” Review of an APIC document titled, “Sterile Processing,” dated 4/26/2019, revealed “...Ideally, the decontamination area should have a three-section sink for cleaning (one section for cleaning, one for initial rinsing, and one for final rinsing)...” Review of the facility’s policy titled, “Surgical Services Sterile Processing,” dated 3/7/2025, revealed, “...Sterile processing is a multi-step process...to provide clean and sterile surgical supplies and equipment for patient use...Decontaminating... cleaning all reusable items...Workflow patterns will be implemented and maintain workflow form [from] high contamination areas to clean areas...” During observations of the surgical instrument decontamination area on 6/23/2026 at 10:25 AM, revealed a 3-compartment sink and washers used to disinfect surgical instruments located at a wall to the left of the 3-compartment sink. Observation of the 3-compartment sink revealed: -Compartment A- (sink furthest away from the instrument washer typically used for soaking used/soiled instruments) contained soapy water with no instruments soaking. -Compartment B- (middle sink typically used for scrubbing/washing soiled instruments) contained water. -Compartment C- (sink closest to washers typically used for final rinse) contained a robotic endoscope (device which uses motorized features to provide surgeons with enhanced maneuverability, precise navigation, and greater control inside the body) soaking in water with cleaning solution. Continued observation of the area revealed 1 open cart containing trays of used/soiled surgical instruments sitting between the 3-compartment sink and the instrument washers and a large, uncovered red biohazard (used for any substance which may pose a threat to humans) container with soiled materials sitting next to the ultrasonic surgical instrument cleaner (a device which uses high-frequency sound waves to assist with cleaning of soiled surgical instruments). During an interview on 6/23/2026 at 10:25 AM, Sterile Processing Technician A confirmed sink compartment A contained soapy water for soaking soiled instruments ; sink compartment B contained rinse water; and a robotic endoscope was soaking in sink compartment C. Sterile Processing Technician A stated soiled surgical instruments were soaked and scrubbed in sink compartment A, rinsed in compartment B, placed in a tray, and then placed in the ultrasonic surgical instrument cleaner for 3 minutes. After the cycle was completed, Sterile Processing Technician A confirmed the instruments were removed from the ultrasonic cleaner, carried past compartment C where the robotic endoscope was soaking, past the uncovered biohazard container and past the open cart with soiled surgical instruments to place the instruments in the washer. Continued interview revealed the Sterile Processing Technician A stated the robotic endoscope would be washed in the soak water in sink compartment C, rinsed in sink compartment B (middle compartment) taken to a clean table located across from and to the left of the 3-compartment sink. The robotic scope would then be placed on a tray, dried, wiped with a cleansing wipe, carried past compartment C where soiled robotic endoscopes were soaked, past the uncovered biohazard container, past the open cart with soiled surgical instruments and then passed through the window to the clean area of sterile processing. Sterile Processing Technician A stated “...There’s no [directed pathway of] flow right now...” During an interview on 6/23/2026 at 10:40 AM, the Surgical Services Director confirmed the open cart of soiled instruments and uncovered biohazard container were placed in an area which posed a risk of contaminating cleaned instruments as they were being transported to the washer. During an interview on 6/24/2026 at 2:42 PM, the Surgical Services Director stated a workflow for cleaning soiled instruments included: -Placing the cart with soiled instruments next to sink compartment A (furthest away from instrument washer) instead of compartment C. -Soiled instruments were to soak in water with appropriate cleaning solution in sink compartment A. -Instruments were to be washed, brushed, flushed, and rinsed in sink compartment B. -Final rinse of instruments in sink compartment C. After the final rinse, the instruments should be placed in the ultrasonic cleaner and carried to the wall washer. The Surgical Services Director confirmed the present workflow for decontamination of soiled instruments currently was not from dirty to clean, did not follow accepted infection control practices, and posed a possible risk of contamination of cleaned surgical instruments. Review of surgical site infections revealed there were no trends indicating infections related to surgical instrumentation.”

“A Life Safety Code Complaint Investigation #TN00076056 was conducted by the State of Tennessee Health Facilities Commission on 6/11/2025. During this life safety complaint survey, Johnson City Medical Center was found in substantial compliance with the requirements for participation of Medicare/Medicaid at 42 CFR Subpart 482.41(b), Life Safety from Fire, and the related National Fire Protection Association (NFPA) standard 101-2012 Edition. The requirements at 42 CFR, Subpart 482.41(b) are MET as evidence by: During the life safety complaint survey, #TN00076056, conducted on 6/11/2025, no deficiencies were cited under 42 CFR PART 482.41, Requirements for Hospitals.”

“GOVERNING BODY CFR(s): 482.12 There must be an effective governing body that is legally responsible for the conduct of the hospital. If a hospital does not have an organized governing body, the persons legally responsible for the conduct of the hospital must carry out the functions specified in this part that pertain to the governing body ... This Condition is not met as evidenced by: 48363 Based on hospital document review, observations, and interviews, the hospital’s governing body failed to ensure each patient’s rights were protected and promoted, including to ensure the confidentiality of patient records were maintained when 37 of 37 patient records were breached. The hospital’s non-compliance placed all patients in a serious and immediate threat and placed them in an Immediate Jeopardy (IJ). The findings include: Review of hospital documentation provided to patient’s titled, “Patient Rights and Responsibilities,” revised 10/05/2018, revealed “ ...You have the right to be treated with consideration, respect and dignity ...You have the right to receive care in a safe setting, to be free from neglect, exploitation ...You have the right to privacy and to confidentiality of your clinical records...” Review of hospital policy titled, “Patient/Resident Rights- [Name of hospital ownership/organization],” revised 7/11/2023, revealed “... [Name of hospital ownership/organization] is committed to the observance of each patient/resident’s rights ...” Review of hospital documentation titled, “Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Corrective Action Plan Procedural Guide,” dated 8/1/2022, revealed “...level 3: Deliberate or purposeful privacy or security violations, noncompliant with the law, without harmful intent...Failure to ensure security policies and procedures are followed...level 4: Deliberate or purposeful privacy or security violations, noncompliant with the law, with harmful and/or malicious intent...Acquisition, access, use, or disclosure of protected health information in a manner not permitted by law which compromises the security or privacy of the protected health information...” Review of hospital documentation titled “[Hospital] Patients Impacted by HIPPA Violations,” with the HIPPA Compliance Officer on 8/29/2024 at 9:15 AM, revealed the compliance investigations of patients who had received care at the hospital were impacted by “Impermissible Access” of PHI as follows: June 2024 - 28 patients. July 2024 - 4 patients. August 2024 - 5 patients. Continued review revealed the “Impermissible Access” of PHI by the hospital employees were not permitted, according to the hospital policy, to gain access to the PHI records of 37 patients from June-August 2024. Review of a Correction Action Notice dated 6/20/2024, revealed an Unlicensed Employee #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed multiple patients [28 patients] without a HIPAA permitted reason. The information accessed included patients’ demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN, name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patients’ medical records. Review of Correction Action Notice dated 7/23/2024, revealed Certified Nurse Aide (CNA) #2 received a “Final Written Warning” for Health Insurance Portability and Accountability Act (HIPAA) Violation when the employee accessed a patient’s PHI that included patient demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN, name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patient’s medical record. Review of Correction Action Notice dated 7/31/2024, revealed Nurse Aide (NA) #2, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on four (4) separate dates and occasions. Review of Correction Action Notice dated, 8/1/2024, revealed Nurse Aide (NA) #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on seven (7) separate dates and occasions. During an interview on 8/22/2024 at 9:45 AM, the Risk Manager stated Risk Management was not aware of any concerns related to PHI breaches by the hospital employees and “...Compliance might have information [regarding any breaches and facilitated interview with the Senior Vice President, Chief Compliance Officer/Chief Audit Executive]...” During an interview on 8/22/2024 at 1:00 PM, the hospital’s QAPI Coordinator confirmed the QAPI committee had not developed, implemented, or maintained an effective, ongoing, hospital-wide, data-driven QAPI improvement program as it related to PHI. According to the hospital’s QAPI Coordinator, the beach in the PHI did not meet the criteria to be in QAPI. During a speaker telephone interview on 8/22/2024 at 1:10 PM, the Senior Vice President, Chief of Compliance Officer/Chief Audit Executive and the HIPAA Compliance Officer confirmed the Unlicensed Employee #1 violated HIPAA and breached PHI for the 37 patients not under her care. During an interview on 8/28/2024 at 10:00 AM, the Human Resources (HR) Director stated the Unlicensed Employee #1, CNA #2, NA #1, and NA #2 received disciplinary action for their individual breaches of the PHI. The HR Director also stated, “...I think some of them should have been terminated...” She further stated that some of the employees with “Final Written Warnings” had previously breached PHI, continued to receive warnings, and were not always terminated by the hospital. The HR Director stated, “...This is a decision made by Compliance...” During an interview on 8/29/2024 at 10:30 AM, the Assistant Vice President of Compliance and the HIPAA Compliance Manager stated the hospital tracks and trends the data breaches and in-services were provided to the hospital employees upon hire, annually, and throughout the year. However, there were no further in-service trainings when occurrences with breaches of PHI or HIPAA violations occurred. A recommendation of disciplinary action was made to HR and a letter was sent to the patient or patient’s representative when an employees violated HIPAA and breached PHI for patients not under their care. When asked, the Assistant Vice President of Compliance confirmed the PHI breaches were not presented to QAPI. ** cross referrence to §482.13 Condition of Participation: Patient’s Rights A hospital must protect and promote each patient’s rights. Tag A-0115 ** cross referrence to: §482.21 Condition of Participation: Quality Assessment and Performance Improvement Program (QAPI). Tag A-0263”

“PATIENT RIGHTS CFR(s): 482.13 A hospital must protect and promote each patient’s rights. This Condition is not met as evidenced by: 18784 Based on hospital document review, observations, and interviews, the hospital failed to ensure Protected Health Information (PHI) was protected for 37 of 37 patients reviewed for PHI. The hospital failed to ensure patient privacy was protected when 2 random patients (RP) (RP #4 and #5) received care at the emergency room nurses’ station and of 3 random patients (RP #1, #2, and #3) who received care in the emergency room waiting area among other waiting patients, families, and visitors. The failure of the hospital to mitigate risks associated with breaches and potential disclosures of PHI, for which the hospital was entrusted, and the hospital’s failure to maintain patients’ right to privacy in the emergency department, placed all patients in a serious and immediate threat and placed them in an Immediate Jeopardy (IJ). The findings include: 1. Review of hospital documentation, provided to patients, titled, “Patient Rights and Responsibilities,” revised 10/05/2018, revealed “...You have the right to be treated with consideration, respect and dignity...You have the right to receive care in a safe setting, to be free from neglect, exploitation...You have the right to privacy and to confidentiality of your clinical records...” Review of a hospital policy titled, “Patient/Resident Rights- [Name of hospital ownership/organization],” revised 7/11/2023, revealed “...[Name of hospital ownership/organization] is committed to the observance of each patient/resident’s rights...” Review of hospital documentation titled, “Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Corrective Action Plan Procedural Guide,” dated 8/1/2022, revealed “...level 3: Deliberate or purposeful privacy or security violations, noncompliant with the law, without harmful intent...Failure to ensure security policies and procedures are followed...level 4: Deliberate or purposeful privacy or security violations, noncompliant with the law, with harmful and/or malicious intent ...Acquisition, access, use, or disclosure of protected health information in a manner not permitted by law which compromises the security or privacy of the protected health information...” 2. Review of the hospital’s Review of Corrective Action Notices revealed the following: On 6/20/24 Unlicensed Employee #1 received a Final Written Warning for accessing 28 patient medical records without a HIPAA permitted reason. On 7/23/24 Certified Nursing Assistant (CNA) #2 received a Final Written Warning for accessing a patient’s medical record information, without authorization. On 7/31/24 Nursing Assistant (NA) #3 received a Final Written Warning for accessing patient PHI on four (4) separate occasions, without authorization. On 8/1/24 NA #1 received a Final Written Warning for accessing patient PHI on seven (7) separate occasions, without authorization. On 8/29/24, the hospital’s HIPAA Compliance Officer verified through investigation, Unlicensed Employee #1, CNA #3, NA #1, and NA #3, had accessed PHI of 37 patients, without authorization. During an interview on 8/28/24, the hospital’s Human Resource (HR) Director stated some of the above named employees should have been terminated for breaching the PHI. During an interview on 8/29/24 the Assistant Vice President (VP) of Compliance/HIPAA Manager stated the hospital did not provide additional inservices to staff after the breaches of the PHI had been determined. 3. During survey observations, the hospital’s emergency room (ER) physical environment allowed patients to overhear nurses discuss the care, diagnosis, and laboratory (lab) results of other patients. The hospital had 15 designated stretchers placed along the walls and nurses’ stations of the ER, without the use of privacy screens, allowing visibility of patients with other patients, visitors and families. The patients who received care were able to be seen by others and their care information could be easily overheard by other patients, families, and visitors. Refer to A0143 and A0146”

“QAPI CFR(s): 482.21 The hospital must develop, implement and maintain an effective, ongoing, hospital-wide, data-driven quality assessment and performance improvement program. The hospital’s governing body must ensure that the program reflects the complexity of the hospital’s organization and services; involves all hospital departments and services (including those services furnished under contract or arrangement); and focuses on indicators related to improved health outcomes and the prevention and reduction of medical errors. The hospital must maintain and demonstrate evidence of its QAPI program for review by CMS. This Condition is not met as evidenced by: 48363 Based on hospital documentation review, policy review, employee record review, and interviews, the hospital failed to mitigate risks by not demonstrating evidence of Quality Assurance Performance Improvement (QAPI) associated with breaches of 37 of 37 patients’ Protected Health Information (PHI) allowing for potential disclosures of the patients PHI which could potentially have personal and financial impacts on any patient who received care at the hospital, and has placed all patients in a serious and immediate threat and placed them in an Immediate Jeopardy (IJ). The findings include: Review of hospital documentation, provided to patients, titled, “Patient Rights and Responsibilities,” revised 10/05/2018, revealed “...You have the right to be treated with consideration, respect and dignity...You have the right to receive care in a safe setting, to be free from neglect, exploitation...You have the right to privacy and to confidentiality of your clinical records...” Review of a hospital policy titled, “Patient/Resident Rights- [Name of hospital ownership/organization],” revised 7/11/2023, revealed “... [Name of hospital ownership/organization] is committed to the observance of each patient/resident’s rights ...” Review of hospital documentation titled, “Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Corrective Action Plan Procedural Guide,” dated 8/1/2022, revealed “...level 3: Deliberate or purposeful privacy or security violations, noncompliant with the law, without harmful intent...Failure to ensure security policies and procedures are followed...level 4: Deliberate or purposeful privacy or security violations, noncompliant with the law, with harmful and/or malicious intent ...Acquisition, access, use, or disclosure of protected health information in a manner not permitted by law which compromises the security or privacy of the protected health information...” Review of Correction Action Notice dated 6/20/2024, revealed an Unlicensed Employee #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed 28 patients’ medical records, without a HIPAA permitted reason. The information accessed included patients’ demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN, name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patients’ medical records. Review of Correction Action Notice dated 7/23/2024, revealed Certified Nurse Aide (CNA) #2 received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that included patient demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN, name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patient’s medical record. Review of Correction Action Notice dated 7/31/2024, revealed Nurse Aide (NA) #2, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on four (4) separate dates and occasions. Review of Correction Action Notice dated, 8/1/2024, revealed NA #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on seven (7) separate dates and occasions. Review of hospital documentation titled “[Hospital] Patients Impacted by HIPPA Violations,” with the HIPPA Compliance Officer on 8/29/2024 at 9:15 AM, revealed the compliance investigations of patients who had received care at the hospital were impacted by “Impermissible Access” of PHI as follows: June 2024 - 28 patients. July 2024 - 4 patients. August 2024 - 5 patients Continued review revealed the “Impermissible Access” of PHI by hospital employees were not permitted, by hospital policy, to gain access to the PHI records of 37 patients from June-August 2024. During an interview on 8/22/2024 at 9:45 AM, the Risk Manager stated Risk Management was not aware of any concerns related to PHI breaches by the hospital employees and “...Compliance might have information [regarding any breaches and facilitated interview with the Senior Vice President, Chief Compliance Officer/Chief Audit Executive]...” During an interview on 8/22/2024 at 1:00 PM, the hospital’s Quality Assurance Performance Improvement (QAPI) Coordinator stated the QAPI committee did not develop, implement, or maintain an effective, ongoing, hospital-wide, data-driven QAPI program as it related to PHI. According to the hospital’s QAPI Coordinator, breaches in the PHI did not meet the criteria to be in QAPI. During a speaker telephone interview on 8/22/2024 at 1:10 PM, the Senior Vice President, Chief of Compliance Officer/Chief Audit Executive and the HIPAA Compliance Officer confirmed the Unlicensed Employee #1 violated HIPAA and breached PHI for the 28 patients not under her care. During an interview on 8/28/2024 at 10:00 AM, the Human Resources (HR) Director, stated the Unlicensed Employee #1, CNA #2, NA #1 and NA #2 received disciplinary action for their individual breaches in PHI. The HR Director also stated, “...I think some of them should have been terminated...” She further stated that some of the employees with “Final Written Warnings” had previously breached PHI, continued to receive warnings, and were not always terminated by the hospital. The HR Director stated, “This is a decision made by Compliance.” During an interview on 8/29/2024 at 10:30 AM, the Assistant Vice President of Compliance and the HIPAA Compliance Manager revealed the hospital tracks and trends the data breaches and in-services were provided to the hospital employees upon hire, annually, and throughout the year. However, there were no further in-service trainings when occurrences with breaches of PHI or HIPAA violations occurred. A recommendation of disciplinary action was made to HR and a letter was sent to the patient or patient’s representative when an employees violated HIPAA and breached PHI for patients not under their care. The Assistant Vice President of Compliance confirmed the PHI breaches were not presented to QAPI. ** cross refer to §482.13 Condition of Participation: Patient’s Rights A hospital must protect and promote each patient’s rights. Tag A-0115”

“PATIENT RIGHTS: PERSONAL PRIVACY CFR(s): 482.13(c)(1) The patient has the right to personal privacy. This Standard is not met as evidenced by: 18784 Based on hospital observations, and interviews, the hospital failed to ensure patient privacy was protected when 2 random patients (Random Patient (RP) #4 and #5) received care at the emergency room (ER) nurses’ station and of 3 random patients (RP #1, #2, and #3) who received care in the emergency room waiting area among other waiting patients, families, and visitors. The hospital failed to ensure patients right to privacy was maintained when staff provided care in the emergency room and in the emergency waiting area. The findings include: During observations and interviews in the ER and the ER waiting room on 8/21/2024 at 9:23 AM; 8/22/2024 at 9:44 AM, and 3:14 PM; on 8/27/2024 at 8:40 AM and 3:40 PM; and on 8/28/2024 at 6:30 AM, revealed all 35 ER bays were filled with patients along with patients in the designated 15 stretchers that lined the walls and nurses’ station of the ER providing opportunity for others to overhear protected PHI and to observe patient care of other patients by the nursing and medical staff. During an observation on 8/22/2024 at 3:14 PM, in the ER waiting room, revealed the ER waiting area had an overflow of patients with 3 “Results Waiting” chairs that were located near the ER waiting room lobby, where RP #1 and RP #2 were receiving intravenous (IV) fluids and medication in the presence of the other waiting patients, families, and visitors. This setting allowed for opportunities in breaches of the patient’s PHI. During an observation and interview on 8/26/2024, at 3:30 PM, RP #1 and RP #2 were observed in wheelchairs in the ER waiting room with IV fluids infusing and the IV bag hanging on IV poles. RP #2 was observed to have a smaller bag of IV antibiotics infusing in addition to the IV fluids. The nursing staff stated RP #2 was receiving antibiotics for a urinary tract infection (UTI). During an observation in the ER on 8/27/2024 at 3:15 PM, RP #3 was observed sitting in a wheelchair in the ER waiting room with IV fluids infusing and the IV bag hanging on a pole. During an observation and interview on 8/28/2024 at 6:40 AM, revealed 2 patients (RP #4 and RP #5) lying on stretchers approximately 4 feet from the end of RP #1’s occupied stretcher to the end of the RP #2’s occupied stretcher. The two patients’ occupied stretchers were placed against the nurses’ station, RP #1 and RP #2 were facing each other in clear view, and without the use of privacy screens, or visual barriers between them which allowed the patients opportunity to view the care provided to one another. Due to the short distance between the patients, RP #1 and RP #2 could easily overhear Registered Nurse (RN) #1 and RN #2’s verbal report. The surveyor observed and easily overheard verbal report of the off-going shift from RN #1 to the oncoming RN #2 and the verbal reports of the patients status for each individual patient. The surveyor stood on the outside of the nurses’ station near RP #1 and RP #2 and easily heard each patients’ names, diagnosis, and pending laboratory reports. After RN #1 and RN#2 completed their verbal reports for RP#1 and RP #2, the surveyor asked if either RN #1 or RN #2 were concerned with HIPAA violations with providing oral reports with each patient’s PHI. RN#1 stated, “We don’t talk that loud for them to hear.” RN #1 and RN #2 were informed that the surveyor could clearly hear their reports for each patient while standing near RP #1 and RP #2. The hospital’s ER physical environment allowed patients to overhear nurses discuss the care, diagnosis, and lab results of other patients. The hospital has 15 designated stretchers placed along the walls and nurses’ stations of the ER, without the use of privacy screens, allowing visibility of patients with other patients, visitors and families. The patients who received care were able to be seen by others and their care information could be easily overheard by other patients, families, and visitors.”

“PATIENT RIGHTS: CONFIDENTIALITY OF RECORDS CFR(s): 482.13(d) Patient Rights: Confidentiality of Records This Standard is not met as evidenced by: 48363 Based on hospital document review, observations, and interviews, the hospital failed to ensure Protected Health Information (PHI) was protected for 37of 37 patients reviewed for PHI. The hospital failed to ensure patient privacy was protected when 2 random patients (RP) (RP #4 and #5) received care at the emergency room nurses’ station and of 3 random patients (RP #1, #2, and #3) who received care in the emergency room waiting area among other waiting patients, families, and visitors. The disclosure of PHI could potentially have personal and financial impacts on any patient that receives or has received care at the hospital. The failure of the hospital to mitigate risks associated with breaches and potential disclosures of PHI for which the hospital was entrusted, placed all patients in a serious and immediate threat and placed them in an Immediate Jeopardy (IJ). The findings include: Review of hospital documentation, provided to patients, titled, “Patient Rights and Responsibilities,” revised 10/05/2018, revealed “...You have the right to be treated with consideration, respect and dignity...You have the right to receive care in a safe setting, to be free from neglect, exploitation...You have the right to privacy and to confidentiality of your clinical records...” Review of a hospital policy titled, “Patient/Resident Rights- [Name of hospital ownership/organization],” revised 7/11/2023, revealed “... [Name of hospital ownership/organization] is committed to the observance of each patient/resident’s rights...” Review of hospital documentation titled, “Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Corrective Action Plan Procedural Guide,” dated 8/1/2022, revealed “...level 3: Deliberate or purposeful privacy or security violations, noncompliant with the law, without harmful intent...Failure to ensure security policies and procedures are followed...level 4: Deliberate or purposeful privacy or security violations, noncompliant with the law, with harmful and/or malicious intent ...Acquisition, access, use, or disclosure of protected health information in a manner not permitted by law which compromises the security or privacy of the protected health information...” Review of hospital documentation titled “[Hospital] Patients Impacted by HIPPA Violations,” with the HIPPA Compliance Officer on 8/29/2024 at 9:15 AM, revealed the compliance investigations of patients who had received care at the hospital were impacted by “Impermissible Access” of PHI as follows: June 2024 - 28 patients. July 2024 - 4 patients. August 2024 - 5 patients. Continued review revealed the “Impermissible Access” of the PHI by the hospital employees were not permitted, according to the hospital policy, to gain access to the PHI records of 37 patients from June-August 2024. Review of Correction Action Notice dated 6/20/2024, revealed an Unlicensed Employee #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed multiple patients [28 patients] without a HIPAA permitted reason. The information accessed included patients’ demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN (Social Security Number), name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patients’ medical records. Review of Correction Action Notice dated 7/23/2024, revealed Certified Nurse Aide (CNA) #2 received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that included patient demographic information- name, Date of Birth (DOB), age, address, phone numbers, last 4 of SSN, name of primary care physician, email address, language, religion, ethnicity, race, and an overview of the patient’s medical record. Review of Correction Action Notice dated 7/31/2024, revealed Nurse Aide (NA) #3, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on four (4) separate dates and occasions. Review of Correction Action Notice dated, 8/1/2024, revealed Nurse Aide (NA) #1, received a “Final Written Warning” for HIPAA Violation when the employee accessed a patient’s PHI that was not in employee’s care on seven (7) separate dates and occasions. During an interview on 8/22/2024 at 9:45 AM, the Risk Manager stated Risk Management was not aware of any concerns related to PHI breaches by the hospital employees and “...Compliance might have information [regarding any breaches and facilitated interview with the Senior Vice President, Chief Compliance Officer/Chief Audit Executive]...” During a speaker telephone interview on 8/22/2024 at 1:10 PM, with the Senior Vice President, Chief of Compliance Officer/Chief Audit Executive and the HIPAA Compliance Officer revealed The Unlicensed Employee #1 violated HIPAA and breached PHI for the 28 patients not under her care. During an interview on 8/28/2024 at 10:00 AM, the Human Resources (HR) Director, revealed the Unlicensed Employee #1, CNA #2, NA #1 and NA #2 received disciplinary action for their individual breaches in the PHI. The HR Director also stated, “...I think some of them should have been terminated...” She further stated that some of the employees with “Final Written Warnings” had previously breached PHI, continued to receive warnings, and were not always terminated by the hospital. The HR Director stated, “This is a decision made by Compliance.” During an interview on 8/29/2024 at 10:30 AM, the Assistant Vice President of Compliance and the HIPAA Compliance Manager stated the hospital tracks and trends the data breaches and in-services were provided to the hospital employees upon hire, annually, and throughout the year. However, there were no further in-service trainings when occurrences with breaches with PHI or HIPAA violations occurred. A recommendation of disciplinary action was made to HR and a letter was sent to the patient or patient’s representative when an employee violated HIPAA and breached PHI for patients not under their care.”

“COMPLIANCE WITH 489.24 CFR(s): 489.20(l) [The provider agrees,] in the case of a hospital as defined in §489.24(b), to comply with §489.24. This Standard is not met as evidenced by: 33763 Based on hospital policy review, document review, medical record review and interview, the hospital failed to ensure all patients presenting to the hospital’s Emergency Department (ED) seeking care for an emergency medical condition (EMC) received an appropriate and on-going medical screening examination (MSE), monitoring and treatment for 1 of 20 (Patient #1) sampled patients. The findings included: 1. Review of the hospital’s policy titled, “Emergency Medical Treatment and Labor Act (EMTALA)...” revised 9/22/2023 revealed, “...Any person who comes to a DED [dedicated emergency department] seeking examination or treatment for any medical condition must be provided an MSE by the hospital’s QMP [qualified medical person] to determine if an Emergency Medical Condition exists...” Review of the hospital’s policy titled, “Nursing Assessment in the Emergency Department - Triage - Primary - Ongoing and Disposition...” revised 1/6/2023 revealed, “...Upon arrival of the patient to the treatment area, a medical screening exam will be performed along with ongoing vital signs, assessment, and disposition in accordance to the Emergency Severity Index (ESI)...Triage...All patients will be triaged upon arrival to the ED...” 2. Review of the hospital document titled “ESI Category Description” revealed, “ESI Level 1 - Resuscitation Patients who have conditions that are immediately life threatening and require immediate medical attention, such as cardiac arrest or respiratory failure...ESI Level 2 - Emergency Patients who have potentially life threatening conditions that require rapid medical intervention, such as severe chest pain or stroke...” Review of the hospital document titled, “Medical Staff Rules and Regulations” revised 7/1/2019 revealed, “...Medical screening examinations, within the capability of the Medical Center, will be performed on all individuals who come to the Medical Center requesting examination or treatment to determine the presence of an emergency medical condition...” Review of the hospital document titled, “Adult and Pediatric Trauma Activation” revised January 1, 2023 revealed, “...Bravo Trauma Team Criteria Persons who sustain injury with any of the following...Mechanism of Injury...Auto vs [versus] pedestrian/cyclist thrown, run over, or with significant impact...EMS [emergency medical services] provider judgement...” 3. Medical record review revealed Patient #1 was transported to Hospital #1’s ED via ambulance on 7/3/2023 at 5:08 PM after getting trapped between a car door and the car moving and dragging Patient #1 down an asphalt driveway approximately 50 to 60 feet. EMS personnel documented the patient had extensive road rash wounds to the right side of the body and the back area as well as a laceration and hematoma to her head. Patient #1 was evaluated by Trauma Surgeon #1 and ED Provider #1 who both documented Patient #1 had extensive road rash wounds to the right side of the body and back area. Trauma Surgeon #1 and ED Provider #1 did not identify or document about the head laceration or hematoma of Patient #1. The Trauma team completed Computerized Tomography (CT scan - provides a detailed image of the body) scans of the Patient’s head, cervical spine, thoracic spine, lumbar spine, chest, abdomen and pelvis as well as a chest x-ray. All scans and x-rays were determined to be within normal limits. There was no documentation Patient #1’s head laceration was identified, assessed, cleansed or treated. Patient #1 was discharged home in stable condition on 7/3/2023 at 7:42 PM with prescriptions for pain medication and muscle relaxer. 4. On 7/3/2023 at 10:42 PM, Patient #1 presented to Hospital #2’s ED via private vehicle with complaints of head lacerations, headache, dizziness and nausea. A triage assessment was completed at 10:53 PM which revealed Patient #1 had been seen earlier at Hospital #1 after a car had dragged the Patient down an asphalt driveway. Patient #1 complained that Hospital #1 did not treat the lacerations to her head. ED Provider #2 evaluated Patient #1’s head lacerations reviewed the CT scan results from Hospital #1. ED Provider #2 then used local anesthetics, cleansed the 3 lacerations to Patient #1’s head and closed the lacerations with staples. On 7/4/2023 at 1:44 PM, Patient #1 was discharged home in good condition with diagnoses including a concussion without loss of consciousness and head lacerations. Patient #1 was prescribed Zofran for nausea and Cephalexin to prevent infection in the scalp wounds which had been left untreated and filled with debris for several hours. 5. Review of Hospital #1’s July 11, 2023 weekly meetings revealed ED Provider #2 at Hospital #2 had filed an Occurrence report which read, “Patient [Patient #1] was seen as a trauma patient at [Hospital #1] by the trauma team and discharged home after local wound care. Pt returned to ED at [Hospital #2] immediately after discharge (2224 [10:24 PM]) and was found to have undiagnosed scalp lacs [lacerations] with imbedded foreign bodies. Lacs required washout and repair. Pt received 13 staples here in the [Hospital #2] ED. I reviewed the CT images from [Hospital #1] and there are clearly FBs [foreign bodies] present on the CT scan in the posterior scalp area.” 6. Interviews were conducted on 8/27/2024 with Hospital #1’s Director of Risk Management, The Trauma Program Manager, and the Chief Medical Officer. All parties interviewed verified Hospital #1 failed to identify and treat Patient #1’s head lacerations and Hospital #1’s Radiologist failed to include the presence of foreign bodies imbedded in Patient #1’s scalp on his final report of the head CT. Cross Refer to A2406.”

“MEDICAL SCREENING EXAM CFR(s): 489.24(a) & 489.24(c) (a) Applicability of provisions of this section. (1) In the case of a hospital that has an emergency department, if an individual (whether or not eligible for Medicare benefits and regardless of ability to pay) “comes to the emergency department”, as defined in paragraph (b) of this section, the hospital must- (i) Provide an appropriate medical screening examination within the capability of the hospital’s emergency department, including ancillary services routinely available to the emergency department, to determine whether or not an emergency medical condition exists. The examination must be conducted by an individual(s) who is determined qualified by hospital bylaws or rules and regulations and who meets the requirements of §482.55 of this chapter concerning emergency services personnel and direction; and (ii) If an emergency medical condition is determined to exist, provide any necessary stabilizing treatment, as defined in paragraph (d) of this section, or an appropriate transfer as defined in paragraph (e) of this section. If the hospital admits the individual as an inpatient for further treatment, the hospital’s obligation under this section ends, as specified in paragraph (d)(2) of this section. (2)(i) When a waiver has been issued in accordance with section 1135 of the Act that includes a waiver under section 1135(b)(3) of the Act, sanctions under this section for an inappropriate transfer or for the direction or relocation of an individual to receive medical screening at an alternate location do not apply to a hospital with a dedicated emergency department if the following conditions are met: (A) The transfer is necessitated by the circumstances of the declared emergency in the emergency area during the emergency period. (B) The direction or relocation of an individual to receive medical screening at an alternate location is pursuant to an appropriate State emergency preparedness plan or, in the case of a public health emergency that involves a pandemic infectious disease, pursuant to a State pandemic preparedness plan. (C) The hospital does not discriminate on the basis of an individual’s source of payment or ability to pay. (D) The hospital is located in an emergency area during an emergency period, as those terms are defined in section 1135(g)(1) of the Act. (E) There has been a determination that a waiver of sanctions is necessary. (ii) A waiver of these sanctions is limited to a 72-hour period beginning upon the implementation of a hospital disaster protocol, except that, if a public health emergency involves a pandemic infectious disease (such as pandemic influenza), the waiver will continue in effect until the termination of the applicable declaration of a public health emergency, as provided under section 1135(e)(1)(B) of the Act. (c) Use of dedicated emergency department for nonemergency services. If an individual comes to a hospital’s dedicated emergency department and a request is made on his or her behalf for examination or treatment for a medical condition, but the nature of the request makes it clear that the medical condition is not of an emergency nature, the hospital is required only to perform such screening as would be appropriate for any individual presenting in that manner, to determine that the individual does not have an emergency medical condition. This Standard is not met as evidenced by: 33763 Based on hospital policy review, document review, medical record review and interview, the hospital failed to ensure all patients presenting to the hospital’s Emergency Department (ED) seeking care for an emergency medical condition (EMC) received an appropriate and on-going medical screening examination (MSE), monitoring and treatment for 1 of 20 (Patient #1) sampled patients. The findings included: 1. Review of the hospital’s policy titled, “Emergency Medical Treatment and Labor Act (EMTALA)...” revised 9/22/2023 revealed, “...Definitions...Emergency Medical Condition: A medical condition manifesting itself by acute symptoms of sufficient severity...such that the absence of immediate medical attention could reasonably be expected in...Placing the health of the individual...in serious jeopardy...Serious impairment of bodily functions...Serious dysfunction of any bodily organ or part...Medical Screening Examination (MSE): An examination performed by a Qualified Medical Personnel (QMP) to reach with reasonable clinical confidence, the point at which it can be determined whether an emergency medical condition does or does not exist...It is the policy of each [Corporate Hospital Owner] hospital to provide an appropriate MSE, including ancillary services routinely available to the emergency department, within its Capability to...All individuals who present to a DED [dedicated emergency department] for examination or treatment of Any medical condition, whether or not emergent...The MSE must be used to determine whether an Emergency Medical Condition exists...Procedure...Any person who comes to a DED seeking examination or treatment for Any medical condition must be provided an MSE by the hospital’s QMP to determine if an Emergency Medical Condition exists...If it is determined that an Emergency Medical Condition exists...the QMP shall do everything within the Capacity and Capability of the facility and staff to Stabilize the patient...” Review of the hospital’s policy titled, “Nursing Assessment in the Emergency Department - Triage - Primary - Ongoing and Disposition...” revised 1/6/2023 revealed, “...All patients presenting to the ED [Emergency Department] will receive a brief assessment by qualified licensed team members who will then coordinate and facilitate entrance into the appropriate treatment area...Upon arrival of the patient to the treatment area, a medical screening exam will be performed along with ongoing vital signs, assessment, and disposition in accordance to the Emergency Severity Index (ESI)...Triage...All patients will be triaged upon arrival to the ED...Patients will be triaged using the 3-Level Acuity System (Emergent, Urgent, Non-Urgent)...Initial assessment will be based on the ESI 5-Level System...” 2. Review of the hospital document titled ESI Category Description” revealed, “ESI Level 1 - Resuscitation Patients who have conditions that are immediately life threatening and require immediate medical attention, such as cardiac arrest or respiratory failure...ESI Level 2 - Emergency Patients who have potentially life threatening conditions that require rapid medical intervention, such as severe chest pain or stroke...” Review of the hospital document titled, “Medical Staff Rules and Regulations” revised 7/1/2019 revealed, “...Emergency services and care will be provided to any person in danger of loss of life or serious injury or illness whenever there are appropriate facilities and qualified personnel available to provide such services or care...Medical screening examinations, within the capability of the Medical Center, will be performed on all individuals who come to the Medical Center requesting examination or treatment to determine the presence of an emergency medical condition...” Review of the hospital document titled, “Adult and Pediatric Trauma Activation” revised January 1, 2023 revealed, “...Bravo Trauma Team Criteria Persons who sustain injury with any of the following...GCS [Glasco coma scale] 9-13...Injury Patterns...Suspected spinal injury with new motor or sensory loss...Chest wall instability, deformity...Two or more proximal long bone fractures...Crushed, degloved, pulseless or mangled extremity...Active bleeding requiring a tourniquet or wound packing with continuous pressure Mechanism of Injury...Auto vs [versus] pedestrian/cyclist thrown, run over, or with significant impact...EMS provider judgement...” 3. Review of the Emergency Medical Services (EMS) documentation dated 7/3/2023 revealed, EMS was dispatched to Patient #1’s home at 4:27 PM and was on the scene with Patient #1 at 4:34 PM. The report further revealed, “...MVC [motor vehicle collision] that injured a pedestrian. O/A [on arrival] found 29 y/o [year old]...sitting on the curb. Pt [Patient #1] had extreme amount of road rash on her R [right] shoulder all the way down her back with abrasions and road rash noted on R [right] side and R hip. Pt clothes were shredded. Pt also had a hematoma to the back of her head and a lac [laceration] noted there also. Pt stated that she was trying to get something out of her car, and it was out of gear and she got stuck between the door and the side of the car and she was drug approx [approximately] 50 ft. [feet]. Pt stated that she had no loss of conc [consciousness], neck or back pain...Pt with no blood from ears-nose-mouth...Trauma alert done via radio with a 10 min [minute] eta [estimated time of arrival]...established a INT [intermittent needle therapy]...Pt tx [transferred] routine to [Hospital #1]. Pt report given via radio with a 5 min eta [estimated time of arrival]. Pt placed in T1 [trauma room #1] in bed via 4 man sheet draw. Pt and report given to Trauma team and RN [registered nurse] for further treatment and exam...” 4. Review of the medical record revealed Patient #1 presented to Hospital #1’s ED via ambulance and was placed in ED Trauma Room #1 on 7/3/2023 at 5:08 PM with arrival complaint motor vehicle collision. Review of the ED Trauma Flowsheet revealed, “...Mechanism of Injury...Pt dragged by car door down driveway...B/P [blood pressure] 140/90...HR [heart rate 112]...chin black substance around nose...Rt shoulder abrasion - mid clavicle to bicep...... Scalp: Normal...Nursing Observations...pt states she was trying to get something out of her car reaching in drivers door, the car was not in park and Pt caught between door jamb + [and] door, driveway is asphalt and 50-60 ft downhill. Pt denies LOC [loss of consciousness] the car did not run over Pt. Multiple abrasions noted on Rt side + back of Pt...1710 [5:10 PM] C-collar applied to Pt...sent to CT [computerized tomography - shows a detailed image of the body] scan. No active bleeding noted, large abrasions noted...1740 [5:40 PM] Pt returned from CT scan...” There was no documentation ED Trauma staff identified or assessed Patient #1’s head lacerations and hematoma as documented in the EMS report. On 7/3/2023 at 5:10 PM, Trauma Surgeon #1 documented, “...29 year old female [Patient #1] s/p [status post] dragged by own vehicle after getting out of it thinking it was in park on a hill and it began rolling and she was stuck hanging out the door and was reportedly dragged 50-60 feet down an asphalt driveway...EMS reports the pt did not have LOC [loss of consciousness] and the vehicle did not run over the patient. She [Patient #1] presents with moderate amount of road rash on her right side...Glasgow Coma Score...15...” CT scans of the Patient’s Head, C- spine, thoracic (T) spine, lumbar (L) spine, chest, abdomen and pelvis were completed as well as a portable chest x-ray. Trauma Surgeon #1 documented, “...CT head - no acute abnormalities noted...Physical Exam...She [Patient #1] is not in acute distress...Head: Normocephalic. Right Ear: External ear normal. Left Ear: External ear normal. Ears: Comments: Dried blood behind ears, no blood in external canals Nose...Blackened abrasion nare and chin...Skin...extensive road rash right side including right upper shoulder extending posteriorly extends from clavicle to bicep and to scapula posteriorly. Road rash multiple sites including right flank, mid-thigh, lateral knee, calf, lateral ankle and dorsal right ...2-4th toes...She is alert and oriented...Procedures: Conscious sedation with local abrasion wash out...Problems/issues covered today include: right arm, right sided back, right hip abrasions...” There was no documentation Trauma Surgeon #1 identified, assessed, or treated Patient #1’s head lacerations and hematoma. The Trauma Nurse Triage Note dated and signed on 7/3/2023 at 5:38 PM revealed, “...Pt was dragged by her car door when it rolled down her driveway about 50-60 feet. pt states she was caught between door and door jam. Pt has multiple abrasions over her back and right side, arm and rt leg...” There was no documentation of Patient #1’s head laceration and/or hematoma as documented in the EMS report. Review of the CT Head Without Contrast (Final Result) read by Radiologist #1 at Hospital #1 dated 7/3/2023 at 6:07 PM revealed, “...Impression: No significant acute intracranial abnormalities are identified...” Review of a Procedures note written by ED Provider #1 on 7/3/2023 at 7:19 PM revealed, “...Procedure: Conscious Sedation for wound debridement Attending surgeon: [Trauma Surgeon #1]...Indication for procedure: large amount of abrasions right arm, right flank, right leg...Sedation: Ketamine 50mg [milligrams]...After written consent was obtained, the patient was placed on room air. Medications for sedation and analgesia were administered by nursing...After completion of the procedure, patient awoke from sedation without complication. Telemetry and continuous pulse ox [oximetry] were monitored throughout the duration of the procedure and vital signs remained stable. The attending physician, Attending Surgeon [Trauma Surgeon #1] was present for all critical portions of the procedure...” There was no documentation Patient #1’s head lacerations were identified, assessed, and/or treated during the procedure. On 7/3/2023 at 7:42 PM, Patient #1 was discharged home. There was no documentation in the medical record to indicate Patient #1’s head laceration was identified and/or treated by any of the ED Trauma team at Hospital #1. 5. On 7/3/2023 at 10:42 PM, Patient #1 presented to Hospital #2’s ED via private vehicle just 2 hours and 42 minutes after she was discharged from Hospital #1. A triage assessment was completed at 10:57 PM and revealed, “Pt was seen at [Hospital #1] as she had been dragged by her car, but they did not see that she had lacerations on her head in two places and still debris - she had head CT already and was cleared...” The patient was assigned an ESI level 4. Review of Hospital #2’s ED Provider Note written by ED Provider #2 on 7/4/2023 at 1:44 AM revealed, “...29-year-old female who presents with complaint of head laceration. States she was dragged by her car rolling down the driveway earlier today and sustained multiple abrasions and minor injuries. She was seen at [Hospital #1] initially immediately after this event, had head CT which was negative and received care for multiple abrasions to the trunk and extremities. She was discharged without examination of the scalp which has multiple deep lacerations which have bled significantly. She presented here for evaluation and treatment of these lacerations. She also endorses headaches, dizziness, nausea...Physical Exam...Three lacerations noted to scalp. 2 cm [centimeters] to right lateral scalp, 3 cm to occiput...right lateral scalp which is packed with gravel...Lac Repair...7/4/2023 3:46 AM...Anesthesia method: Local infiltration...Lidocaine...Scalp location: Left parietal, occipital, right parietal, Wound length (cm): 2 cm, 3 cm, 3 cm...wound explored through full range of motion and entire depth of wound visualized Contaminated: yes...Area cleansed with : chlorhexidine and saline Amount of cleaning: Extensive...Visualized foreign bodies/material removed: yes (Multiple rocks/gravel)...Skin Repair...Staples Number of staples: 13...Medical Decision Making Patient was seen in ED for complaint of head laceration, was seen at [Hospital #1] earlier and medically cleared, however was not treated for head lac. Lacerations to scalp were anesthetized with local infiltration, thoroughly irrigated and washed with saline and chlohexidine, and closed via staples...Prescribed Zofran for nausea, also prescribed antibiotics as lacerations had been left untreated for several hours and were packed with gravel and grit. Also provided patient care instructions for likely concussion based off of patient’s symptoms...Concussion without loss of consciousness, subsequent encounter...Laceration of scalp...” 6. Review of a Hospital #1 weekly meeting dated July 11, 2023 revealed Hospital #2’s ED Provider #2 filed an Occurrence report which read, “Patient [Patient #1] was seen as a trauma patient at [Hospital #1] by the trauma team and discharged home after local wound care [to the arm]. Pt returned to ED at [Hospital #2] immediately after discharge (2224 [10:24 PM]) and was found to have undiagnosed scalp lacs with imbedded foreign bodies. Lacs required washout and repair. Pt received 13 staples here in the [Hospital #2] ED. I reviewed the CT images from [Hospital #1] and there are clearly FBs [foreign bodies] present on the CT scan in the posterior scalp area.” 7. During an interview on 8/27/2024 at 3:05 PM, Hospital #1’s Director of Risk Management (DRM) verified ED Provider #2 from Hospital #2 reported the incident involving untreated lacerations to Patient #1 which was then investigated by Hospital #1. The DRM continued and stated in viewing the Head CT images, the “picture shows imbedded gravel but it was not documented by Hospital #1’s Radiologist. The DRM stated, “It [the head lacerations with imbedded debris] was a complete miss on our part...” During an interview on 8/27/2024 at 3:30 PM, Hospital #1’s Trauma Program Manager (TPM) verified she was aware of the incident with Patient #1 and assisted with the investigation. The TPM stated during the meeting held to investigate and discuss the incident, “we pulled up the head CT; debris was noted, but it was not documented...” The TPM continued and stated there was no documentation of Patient #1’s head lacerations found in the medical record. During an interview on 8/27/2024 at 4:50 PM, Hospital #1’s Chief Medical Officer (CMO) verified the Radiologist for Hospital #1 failed to document all findings visible in Patient #1’s head CT. The CMO continued and stated there was a missed diagnosis of Patient #1’s head laceration and the “Attending Trauma Surgeon [Trauma Surgeon #1] is ultimately responsible for the Residents [physicians in training] involved.””