Every finding on record at Pediatric Services of America, LLC

Based on the findings of an onsite unannounced home health agency Medicare re-certification and state re-licensure survey completed on 8/28/24, Aveanna Healthcare., was found to be in compliance with the requirements of 42 CFR, Part 484.22, Subpart B, Conditions of Participation: Home Health Agencies - Emergency Preparedness.

Based on the findings of an onsite unannounced home health agency Medicare re-certification and state re-licensure survey completed on 8/28/24, Aveanna Healthcare was found not to be in compliance with the requirements of 42 CFR, Part 484, Subparts B and C, Conditions of Participation: Home Health Agencies.

Receive all services in plan of care CFR(s): 484.50(c)(5) Receive all services outlined in the plan of care. This ELEMENT is not met as evidenced by: Based on the review of agency policies, clinical record (CR) reviews, and interview, the agency failed to ensure services were provided in accordance with the plan of care for two (2) of seven (7) CR reviewed. (CR #2 and CR#7) Findings include: Review of agency Policy Missed Services on 8/28/24 at 9:00 AM states, "Patients/caregivers should be consulted in advanced regarding scheduling of services, so the patient receives the ordered services. Because the frequency of services are ordered by the physician, a missed service affects the plan of care, which may need to be updated or changed.” Review of agency Policy Admission on 8/28/24 at 9:00 AM states, “Admission Criteria Patients will be accepted for care in accordance with the following standards: 2. Thee required services are within the scope and availability of what can be provided by the location.” Review of clinical records (CR) conducted 8/26/24 from 10:30 AM-2:00 PM revealed the following: CR#2: Start of care 7/19/24 (certification period 7/19/24-9/16/24): The Plan of care contained orders as follow: SN will provide 10-15 hours per month for essential household duties for 60 days start effective date: 7/19/24. SN will provide 30-50 hours per week of private duty nursing for 60 days. Start effective date 7/19/24 There was no documentation showing where 10-15 hours per month for essential household duties had been provided CR#7 Start of care 7/9/24 (certification period 7/9/24-9/6/24): The Plan of care contained orders as follow: HHA/CNA will provide 70-98 hours of unskilled care per week for 60 days For the week beginning 7/7/24 only 22.5 hours of care had been provided For the week beginning 7/14/24 only 29.5 hours of care had been provided For the week beginning 7/21/24 only 23.5 hours of care had been provided For the week beginning 7/28/24 only 13 hours of care had been provided For the week beginning 8/4/24 only 38.5 hours of care had been provided For the week beginning 8/11/24 only 34 hours of care had been provided Interview with the Area Vice President of Clinical operations at the time of the record reviews confirmed the above findings

Based on the findings of an unannounced off-site home health agency complaint investigation survey conducted March 31, 2021, Aveanna Healthcare, was found to not be in compliance with the requirements of 42 CFR, Part 484, Subparts B and C, Conditions of Participation: Home Health Agencies.

Have a confidential clinical record CFR(s): 484.50(c)(6) Have a confidential clinical record. Access to or release of patient information and clinical records is permitted in accordance with 45 CFR parts 160 and 164. This ELEMENT is not met as evidenced by: Based on review of electronic health record procedures for screening for COVID, emails from complainant, Agency Administrator and Agency Area Vice President of Clinical Operations and an interview with the Office Administrator, the agency failed to ensure that electronic protected health information (PHI) was secured and kept confidential according to HIPAA (Health Insurance Portability and Accountability Act) standards. Findings: Review of two (2) website links for employee COVID-19 Assessment Reading and COVID Individual/Patient Screening Tool Location on 04/14/21 at 12:35 PM revealed: The following statement is printed at the bottom of the employee/patient COVID-19 assessment reading: "This content is created by the owner of the form. The data you submit will be sent to the form owner. Microsoft is not responsible for the privacy or security practices of its customers, including those of this form owner. Never give out your password. The owner of this form has not provided a privacy statement as to how they will use your response data. Do not provide personal or sensitive information." Surveyor used web link for employee COVID-19 assessment reading and was able to complete assessment and submit the assessment without being asked to submit it securely Review of Aveanna Healthcare Mobile App Security Acknowledgement Form on 04/14/21 at 1:55 PM revealed: The security form has several statements that need to be acknowledged by the employee when using the Mobile App including: the employee understanding that they are responsible for complying with the Health Insurance Portability and Accountability Act (HIPAA) and Aveanna policies, the employee will ensure that their personal cell phone is secure and password protected, the employee should not allow other people to use their personal cell phone while the mobile app is installed, the employee will not save any protected health information that was accessed from the mobile app on their personal cell phone. The Mobile App security acknowledgement form also informs the employee that if they fail to secure their personal cell phone while the Mobile App is installed, it could lead to a privacy violation which could include notification, breach reporting and possible sanctions against the employee and Aveanna. Review of emails sent between complainant and Agency Administrator on 04/14/21 at 4:30 PM revealed: Complainant didn't feel comfortable using her personal cell phone to complete the COVID screening tools and asked why the agency was not supplying the technology to the staff to use or to allow the staff to use their HOPE device (electronic tablet used for documentation) to complete the screenings. Agency Administrator responded "I created the links, they only come to my email. EVERYTHING I do is encrypted, so no worries. Feel free to put the links on the hope device. Everyone else in the company does it on their phones, I fail to understand your hesitation to cooperate with company protocol." An interview with the Agency Administrator and Agency Area Vice President of Clinical Operations conducted on 4/8/21 at approximately 12:30 PM confirmed the above findings.

Protection of records CFR(s): 484.110(d) Standard: Protection of records. The clinical record, its contents, and the information contained therein must be safeguarded against loss or unauthorized use. The HHA must be in compliance with the rules regarding protected health information set out at 45 CFR parts 160 and 164. This STANDARD is not met as evidenced by: Based on review of electronic health record procedures for screening for COVID, emails from complainant, Agency Administrator and Agency Area Vice President of Clinical Operations and an interview with the Office Administrator, the agency failed to ensure that electronic protected health information (PHI) was secured and kept confidential according to HIPAA (Health Insurance Portability and Accountability Act) standards. Findings: Review of two (2) website links for employee COVID-19 Assessment Reading and COVID Individual/Patient Screening Tool Location on 04/14/21 at 12:35 PM revealed: The following statement is printed at the bottom of the employee/patient COVID-19 assessment reading: "This content is created by the owner of the form. The data you submit will be sent to the form owner. Microsoft is not responsible for the privacy or security practices of its customers, including those of this form owner. Never give out your password. The owner of this form has not provided a privacy statement as to how they will use your response data. Do not provide personal or sensitive information." Surveyor used web link for employee COVID-19 assessment reading and was able to complete assessment and submit the assessment without being asked to submit it securely Review of Aveanna Healthcare Mobile App Security Acknowledgement Form on 04/14/21 at 1:55 PM revealed: The security form has several statements that need to be acknowledged by the employee when using the Mobile App including: the employee understanding that they are responsible for complying with the Health Insurance Portability and Accountability Act (HIPAA) and Aveanna policies, the employee will ensure that their personal cell phone is secure and password protected, the employee should not allow other people to use their personal cell phone while the mobile app is installed, the employee will not save any protected health information that was accessed from the mobile app on their personal cell phone. The Mobile App security acknowledgement form also informs the employee that if they fail to secure their personal cell phone while the Mobile App is installed, it could lead to a privacy violation which could include notification, breach reporting and possible sanctions against the employee and Aveanna. Review of emails sent between complainant and Agency Administrator on 04/14/21 at 4:30 PM revealed: Complainant didn't feel comfortable using her personal cell phone to complete the COVID screening tools and asked why the agency was not supplying the technology to the staff to use or to allow the staff to use their HOPE device (electronic tablet used for documentation) to complete the screenings. Agency Administrator responded "I created the links, they only come to my email. EVERYTHING I do is encrypted, so no worries. Feel free to put the links on the hope device. Everyone else in the company does it on their phones, I fail to understand your hesitation to cooperate with company protocol." An interview with the Agency Administrator and Agency Area Vice President of Clinical Operations conducted on 4/8/21 at approximately 12:30 PM confirmed the above findings.