Every finding on record at Key West HHA LLC

A recertification survey was conducted 6/3/2025 through 6/5/2025 at Island Home Care, a Home Health Agency in Key West, Florida. Island Home Care is not in compliance with Code of Federal Regulations (CFR) 42, part 484, Home Health Services. The following is a description of the noncompliance.

Have a confidential clinical record CFR(s): 484.50(c)(6) Have a confidential clinical record. Access to or release of patient information and clinical records is permitted in accordance with 45 CFR parts 160 and 164. This ELEMENT is not met as evidenced by: Based on observation, medical records reviewed, interviews, and policy reviewed, the agency failed to ensure transmission of confidential medical information was secured for 1(Patient #3) of 1 patient observed having confidential information transmitted. using an employee’s private cell phone. The agency failed to ensure confidential medical information was transmitted using a secured, encrypted device instead a staff member was observed using a private cell phone for transmitting. Policy reviewed revealed, the home health agency is a member of the LHC Group, Inc…A review of the Acceptable Use and Security, approved Policy Committee, revision date 4/01/22, policy number 13.2.001. Section: All LHCG information systems users shall…numbers: 12. Not text PHI, which is prohibited on company issued and personal mobile devices in an effort to mitigate risk of breach of protected health information. 13. Not take pictures of patients, patient’s wounds, patient’s information or patient’s location, which is prohibited on personal devices. Policy review of LHC Group, Inc…Confidentiality of Patient Information, Policy Committee, revision date 4/20/21, policy number 7.009. Purpose: To safeguard patient records against loss or unauthorized use and to establish standard for maintaining confidentiality of patient information. Policy: All patient’s medical record information will be maintained in a confidential manner. On 6/3/25, at 12:55 p.m., Registered Nurse (RN) Staff A, was observed during Patient #3’s home visit discussing the patient discharge process. RN Staff A explained the Notice of Medicare Non-Coverage form and proceeded to complete a section of the form. The Nurse was observed taking take a photograph of the form with her personal cellular phone and then transmitted the photograph. RN Staff A was interviewed and confirmed she used her personal phone which did not have an encrypted Agency App. RN Staff A said she covered the patient identification information was covered with her finger. On 6/5/25, at 8:50 a.m., the Executive Director (ED) was interviewed and said, “The agency allows the caregivers to use their personal phones to communication with the patient or their representative, for setting up schedules.” The ED confirmed text messaging on the employee personal phones do not go through an agency provided secured app. The home health agency gives their caregivers computer tablets for documentation. The ED said the tablets do not have a secure network to text forms. On 6/5/25, at 9:33 a.m., the ED said during an interview, “texted information should be documented in the patients record. Texted information should be noted on the nurses’ visit notes. I expect that is where the text information should be documented. That is how the agency would track and know what was texted and to whom.” Patient #3’s medical review revealed, a Health Insurance Portability and Accountability Act (HIPAA) Related Admission Agreement form signed on 4/18/25. A review of the section, “Texting You” revealed the patient checked, “No” to both not receiving text messages regarding visit dates and times, and not receiving patient protected health information, (PHI) via unsecured text. Review of RN Staff A’s 6/3/25, Visit Note Report failed to provide evidence of texting the patient’s Notice of Medicare Non-Coverage form.