Every finding on record at Tendercare Home Health Services Inc

This visit was for a Federal and State complaint of a home health provider. Complaint #: #IN00344991; Substantiated, with findings. Survey Dates: 6/21/21, 6/22/21, 6/23/21 Facility #: 157401 Provider/ CCN #: 157401 MCD #: 100389750A Quality Review Completed on 7/2/21 by Area 3

Have a confidential clinical record CFR(s): 484.50(c)(6) Have a confidential clinical record. Access to or release of patient information and clinical records is permitted in accordance with 45 CFR parts 160 and 164. This ELEMENT is not met as evidenced by: Based on record review and interview, the agency failed to ensure staff adhered to patient rights by ensuring all patient names/ identifiers were kept confidential, including records accessed or stored on electronic devices, 2 of 3 active patient records reviewed. (Patients 1, 2). Findings include: 1. HIPAA Journal, posted 6/8/21, revealed "The HIPAA [Health Insurance Portability and Accountability Act] Privacy Rule protects 18 identifiers of individually identifiable health information. When these data elements are included in a data set, the information is considered protected health information (PHI) and subject to the provisions of the HIPAA Privacy Rules. The identifiers are 1. Names; 2. Addresses (including subdivisions smaller than states such as street, city, county, and zip code); 3. Dates (except years) directly related to an individual, such as birthdays, admission/discharge dates, death dates, and exact ages of individuals older than 89; 4. Telephone numbers; 5. Fax numbers; 6. Email addresses; 7. Social Security numbers; 8. Medical record numbers; 9. Health plan beneficiary numbers; 10. Account numbers; 11. Certificate and license numbers; 12. Vehicle identifiers; 13. Device identifiers and serial numbers; 14. Website URLs; 15. IP addresses; 16. Biometric identifiers, including fingerprints, voice prints, iris, and retina scans; 17. Full-face photos and other photos that could allow a patient to be identified; 18. Any other unique identifying numbers, characteristics, or codes. 2. Review of an agency document titled "Patient Handbook and Notice of Privacy Rights" evidenced "You have the right ... To maintain the confidentiality of your clinical records in accordance with legal requirements and to anticipate Tendercare will release information only with your authorization or as required by law. 3. Review of an agency document titled "Home Health Agency Outcome and Assessment Information Set (OASIS) Statement of Patient Privacy Rights" evidenced "...You have the right to have your personal health care information kept confidential ... We keep anything we learn about you confidential. This means only those who are legally authorized to know, or who have a medical need to know, will see your personal health information." 4. Review of an OSHA (Occupational Safety and Health Administration) packet dated 2021, provided by the administrator on 6/20/21, revealed a module labeled HIPAA, which revealed a HIPAA confirmation statement the agency provided to each employee indicating that employee acknowledged the responsibility and management of confidential client information and that a Tendercare HIPAA manual was made available to that employee, where the employee agreed to abide by its contents and regulations. 5. On 6/22/21, the agency provided a document titled "Investigation regarding allegations against Tendercare employee, [name of former employee G], which evidenced allegations made by individual A, dated 12/31/20. The document revealed that individual A stated former employee G, turned in the documentation for work when former employee G had not worked. Individual A stated former employee G explained to him on multiple occasions she could clock in on her agency issued tablet at her patient's home, leave the home for 12 hours, and then the patient's parent would clock her out or she would go back to the patient's house and clock out. Individual A provided cell phone recordings evidencing discussion with former employee G about their plans for the day and how she needed to get her tablet to the patient's home to clock in before they left. In one specific instance, former employee G attempted to make plans so they could visit a race track. Employee G discussed in detail going to the patient's home, clocking in on her tablet, then the patient's mom agreeing to clock out for former employee G. Individual C, the mother of patient #1, stated she had clocked out "only a few times to give her extra money" but was unsure of the number of times. In exchange, former employee G helped her with "personal things." The document also revealed that the mother of patient #2 stated former employee G had called and asked her adult son to log into her tablet and clock her out .... " 6. Review of the transcripts for recorded calls provided by individual A revealed no available date or time stamps. Call #1 occurred between individual A and former employee G and revealed the following excerpts: Recording #1: Former Employee G - "I have all my hours through the week. I still am gonna [sic] do like a 16 - hour shift on Friday and her overnight. And then, another nurse is gonna [sic] come Saturday during the day. I'm gonna [sic] meet her at her house and she's gonna [sic] get her from 9-5 and the at 5 o'clock, I go back and get her, or, if, uh, her parents are home, they're just gonna [sic] keep her but let me have my shift from 5 - 11 ... So, basically, if I wanted to, every week I could get at least 10 hours of overtime ...so like if I go to her house at 5 o'clock, I'll clock in, and then I could just do my charting and then she'll clock me out that night. So I don't have to worry about, like, going back and getting my tablet, I don't have to worry about clocking out."; Recording #2: Employee G - " ...Her (patient #2) brother and sister are gonna [sic] clock me out tonight ... She's gonna [sic] clock me in in the morning ... I'll just do my whole note for tomorrow and then her mom will clock me out tomorrow night ...."; Recording #3: employee G - " ... I'm trying to figure out a shift to work over here on Saturday, but not work." Individual A - "I thought you said you had to take your pad over there anyway Saturday?" Employee G - "I could just come over here, clock in, fill out all the information, leave my pad, and then come back and end the shift." Unknown female voice - "Your shift is in Noblesville ... Why don't you just drop it off here. I'll sign you in ..." Employee G - If I bring my tablet over here Friday ... I would just have to come over here Saturday to pick it up at midnight and like clock out. She could clock me in at not. What do you think? 7. A review of the personnel file for former employee G revealed a notice of termination, dated 1/4/2020, signed by the alternate administrator. The document revealed "It was reported to Tendercare management that you submitted clinical documentation for reimbursement for shifts that you had not performed. Specifically, the patient's family member clicked you in and out of your shift on your table at their home to secure the GPS location. It was also reported that you took your minor patient to your home on multiple occasions and provided care at your home while leaving your tablet at the patient's home so that the GPS information would not reflect the change of location...." The document referenced the agency handbook sections for employee conduct, termination, and falsification of records and stated employee G signed receipt of the handbook on 8/8/19. Employee G was terminated on 1/4/20. 8. On 6/22/21 at 9:30 AM, the alternate administrator demonstrated the use of a tablet through training mode. After signing on using a user ID and password, the tablet evidenced the daily and weekly schedule of the patient's signing on was accessible once signed into the tablet. If the user clicked on the patient's name, a blank form appeared, which could be completed until the individual signed out on the visit. At that time the visit "closed" and could not be reopened. The administrator stated the agency did not agree that PHI was shared because a patient's name was not PHI. No further information was available. 9. During an interview on 6/21/21, at 2:00 PM, the administrator and alternate administrator revealed that individual A reported on multiple occasions of former employee G leaving her agency issued tablet in patient homes and had the patient's caregivers clock in and/or out for former employee G. Individual A also reported that former employee G was taking patients to the employee's house to provide care. Individual A identified patients 1 and 2 by name and provided the address for both patients. Due to domestic issues between Individual A and former employee G, the administrator stated the agency viewed the report from Individual A as a personnel-related problem, and all documentation concerning the issue was located in the former employee's file. The administrator stated the incident was not treated as a PHI breach because no protected health information was released to individual A that would meet the criteria as PHI. When queried whether individual A was aware of the names and addresses of patients #1 and #2, the administrator stated she was aware and stated "a name isn't protected health information." When queried whether the patient's mother had access to other patient information, the alternate administrator stated the agency EMR (electronic medical record) only evidenced the nurse's schedule for the day, along with a blank electronic form for charting. The administrator and alternate administrator were queried as to whether the mother of patient #1 would need former employee G's user ID and password to sign former employee G out, and both stated yes, but because the tablet only provided the nurse's schedule for the day, and again stated, the incident did not rise to the level of a HIPAA (Health Insurance Portability and Accountability Act) or PHI violation. When queried whether former employee G was ever scheduled to see more than 1 patient in a day, the administrator and alternate administrator stated yes but it was unlikely, and on the days they identified that former employee G left her tablet with patient #1's mother, no other patients were scheduled, so the patient's mother could not see any other names. During further discussion concerning the tablets, the alternate administrator revealed that the tablet was able to show the employee's daily schedule and/or weekly schedule. When queried whether former employee G's weekly schedule revealed the names of all patients she was to see, the alternate administrator stated yes. The administrator stated that was not a breach of PHI because the schedule only showed patient names and did not reveal PHI. Further discussion, the administrator and alternate administrator stated that former employee G was suspended on 12/31/20 pending further investigation, which ultimately resulted in the termination of former employee G. The alternate administrator stated all of the caregivers for former employee G's patients were interviewed and denied that former employee G left the tablet with them or took the patient to the employee's home, except the caregivers for patient 1 and 2. The administrator and alternate administrator stated that the parent of patient #1 denied that the patient was cared for in the home of former employee G, however, the parent of patient #2 stated she had given permission for former employee G to take patient #2 to her home but was unaware there was an altercation. The administrator and alternate administrator stated former employee G was reported to the attorney general and was under investigation to the best of their knowledge. The administrator stated no further follow-up occurred agency-wide because the incident was an individual employee problem related to failure to follow agency practice and not a PHI violation. When queried as to how she knew that tablets were not being left in-home and passwords not shared by other employees, the administrator stated the agency provided yearly HIPAA education and PHI training to all employees. When queried as to whether former employee G received the same training, the administrator stated yes. The administrator stated again that the agency did not view the incidents and a breach in PHI because a name does not count as PHI. When queried whether the agency treated patient addresses as PHI the administrator stated that the incident was a personnel situation, and the agency followed its policy for investigation and termination and reported former employee G to the Attorney General. 410 IAC 17-12-3(b)(2)(E)

Program data CFR(s): 484.65(b)(1),(2),(3) Standard: Program data. (1) The program must utilize quality indicator data, including measures derived from OASIS, where applicable, and other relevant data, in the design of its program. (2) The HHA must use the data collected to- (i) Monitor the effectiveness and safety of services and quality of care; and (ii) Identify opportunities for improvement. (3) The frequency and detail of the data collection must be approved by the HHA's governing body. This STANDARD is not met as evidenced by: Based on record review and interviews, the agency failed to use collected data to monitor the effectiveness and safety of services and quality of care and failed to use the data to identify opportunities for improvement. Findings include: 1. HIPAA Journal, posted 6/8/21, revealed "The HIPAA [Health Insurance Portability and Accountability Act] Privacy Rule protects 18 identifiers of individually identifiable health information. When these data elements are included in a data set, the information is considered protected health information (PHI) and subject to the provisions of the HIPAA Privacy Rules. The identifiers are 1. Names; 2. Addresses (including subdivisions smaller than states such as street, city, county, and zip code); 3. Dates (except years) directly related to an individual, such as birthdays, admission/discharge dates, death dates, and exact ages of individuals older than 89; 4. Telephone numbers; 5. Fax numbers; 6. Email addresses; 7. Social Security numbers; 8. Medical record numbers; 9. Health plan beneficiary numbers; 10. Account numbers; 11. Certificate and license numbers; 12. Vehicle identifiers; 13. Device identifiers and serial numbers; 14. Website URLs; 15. IP addresses; 16. Biometric identifiers, including fingerprints, voice prints, iris, and retina scans; 17. Full-face photos and other photos that could allow a patient to be identified; 18. Any other unique identifying numbers, characteristics, or codes. 2. On 6/22/21, the agency provided a document titled "Investigation regarding allegations against Tendercare employee, [name of former employee G], which evidenced allegations made by individual A, dated 12/31/20. The document revealed that individual A stated former employee G, turned in the documentation for work when former employee G had not worked. Individual A stated former employee G explained to him on multiple occasions she could clock in on her agency issued tablet at her patient's home, leave the home for 12 hours, and then the patient's parent would clock her out or she would go back to the patient's house and clock out. Individual A provided cell phone recordings evidencing discussion with former employee G about their plans for the day and how she needed to get her tablet to the patient's home to clock in before they left. In one specific instance, former employee G attempted to make plans so they could visit a race track. Employee G discussed in detail going to the patient's home, clocking in on her tablet, then the patient's mom agreeing to clock out for former employee G. Individual C, the mother of patient #1, stated she had clocked out "only a few times to give her extra money" but was unsure of the number of times. In exchange, former employee G helped her with "personal things." The document also revealed that the mother of patient #2 stated former employee G had called and asked her adult son to log into her tablet and clock her out .... " 3. A review of the personnel file for former employee G revealed a notice of termination, dated 1/4/2020, signed by the alternate administrator. The document revealed "It was reported to Tendercare management that you submitted clinical documentation for reimbursement for shifts that you had not performed. Specifically, the patient's family member clicked you in and out of your shift on your table at their home to secure the GPS location. It was also reported that you took your minor patient to your home on multiple occasions and provided care at your home while leaving your tablet at the patient's home so that the GPS information would not reflect the change of location...." The document referenced the agency handbook sections for employee conduct, termination, and falsification of records and stated employee G signed receipt of the handbook on 8/8/19. Employee G was terminated on 1/4/20. 5. Review of the agency's QAPI (Quality Assurance and Performance Review) program on 6/23/21 at 12:15 PM, revealed the agency failed to have a program in place to identify the extent and universe of staff disclosing, their individual and unique user IDs and passwords for agency issued tablets, a program to identify the extent and universe of agency employees, the extent and universe of agency employees disclosing protected health information, and the extent and universe of employees providing care to patients in the employee's home. 6. Review of a document titled "Tendercare QAPI", revised 2/5/21, revealed the Executive Members will "Ensure that performance improvement efforts are prioritized and evaluated for effectiveness to promote Tendercare's integrity and quality; Demonstrate clear expectations for patient safety; Address any findings of fraud and waste ...." The Tendercare QAPI mission statement stated "The Tendercare Quality Assurance and Performance Improvement Program will define, implement and maintain ongoing agency-wide programs for quality improvement and patient safety. The program will be developed from evidence-based best practices." 7. On 6/22/21 at 3 PM the alternate administrator stated the agency followed a QAPI template that utilized identified information, investigated and gathered data, compiled and reviewed the data for trends, and developed performance improvement plans, which were tracked for improvement. The agency QAPI program failed to include any documentation related to the release of or breach of protected health information (PHI) or HIPAA. (Health Insurance Portability and Accountability Act). When queried as to whether the agency completed an investigation to determine whether any other agency employees were leaving tablets in patient's homes, or transporting patients to the employees' homes to provide care, the administrator stated it was not necessary because there was no breach of PHI. The administrator stated the agency did a full investigation concerning employee G and determined this was an isolated personnel incident and was resolved per agency policy, resulting in termination of employee G. When queried how the administrator ensured there were no other employees leaving tablets in patient's homes, sharing passwords and user ID (identification or identifiers), or taking patients to their own homes, the administrator stated all employees received training at orientation and annually. When questioned if employee G received that same training, the administrator stated yes. When questioned how the agency could be sure that no other employees broke the rules as did employee G, despite training, the administrator stated employee G was terminated and the agency did not agree that a breach in PHI occurred. No further information was provided. 410 IAC 17-12-2 (a)

Protection of records CFR(s): 484.110(d) Standard: Protection of records. The clinical record, its contents, and the information contained therein must be safeguarded against loss or unauthorized use. The HHA must be in compliance with the rules regarding protected health information set out at 45 CFR parts 160 and 164. This STANDARD is not met as evidenced by: Based on record review and interview, the agency failed to ensure the home health aide safeguarded patient clinical records and its contents from unauthorized use, and failed to ensure compliance with the rules regarding protected health information set out at 45 CFR parts 160 and 164 and with Health Insurance Portability Accountability Act (HIPAA) for 2 of 3 active patient records. (patients 1, 2) Findings include: 1. HIPAA Journal, posted 6/8/21, revealed "The HIPAA [Health Insurance Portability and Accountability Act] Privacy Rule protects 18 identifiers of individually identifiable health information. When these data elements are included in a data set, the information is considered protected health information (PHI) and subject to the provisions of the HIPAA Privacy Rules. The identifiers are 1. Names; 2. Addresses (including subdivisions smaller than states such as street, city, county, and zip code); 3. Dates (except years) directly related to an individual, such as birthdays, admission/discharge dates, death dates, and exact ages of individuals older than 89; 4. Telephone numbers; 5. Fax numbers; 6. Email addresses; 7. Social Security numbers; 8. Medical record numbers; 9. Health plan beneficiary numbers; 10. Account numbers; 11. Certificate and license numbers; 12. Vehicle identifiers; 13. Device identifiers and serial numbers; 14. Website URLs; 15. IP addresses; 16. Biometric identifiers, including fingerprints, voice prints, iris, and retina scans; 17. Full-face photos and other photos that could allow a patient to be identified; 18. Any other unique identifying numbers, characteristics, or codes. 2. Review of an agency document titled "Patient Handbook and Notice of Privacy Rights" evidenced "You have the right ... To maintain the confidentiality of your clinical records in accordance with legal requirements and to anticipate Tendercare will release information only with your authorization or as required by law. 3. Review of an agency document titled "Home Health Agency Outcome and Assessment Information Set (OASIS) Statement of Patient Privacy Rights" evidenced "...You have the right to have your personal health care information kept confidential ... We keep anything we learn about you confidential. This means only those who are legally authorized to know, or who have a medical need to know, will see your personal health information." 4. Review of an OSHA (Occupational Safety and Health Administration) packet dated 2021, provided by the administrator on 6/20/21, revealed a module labeled HIPAA, which revealed a HIPAA confirmation statement the agency provided to each employee indicating that employee acknowledged the responsibility and management of confidential client information and that a Tendercare HIPAA manual was made available to that employee, where the employee agreed to abide by its contents and regulations. 5. On 6/22/21, the agency provided a document titled "Investigation regarding allegations against Tendercare employee, [name of former employee G], which evidenced allegations made by individual A, dated 12/31/20. The document revealed that individual A stated former employee G, turned in the documentation for work when former employee G had not worked. Individual A stated former employee G explained to him on multiple occasions she could clock in on her agency issued tablet at her patient's home, leave the home for 12 hours, and then the patient's parent would clock her out or she would go back to the patient's house and clock out. Individual A provided cell phone recordings evidencing discussion with former employee G about their plans for the day and how she needed to get her tablet to the patient's home to clock in before they left. In one specific instance, former employee G attempted to make plans so they could visit a race track. Employee G discussed in detail going to the patient's home, clocking in on her tablet, then the patient's mom agreeing to clock out for former employee G. Individual C, the mother of patient #1, stated she had clocked out "only a few times to give her extra money" but was unsure of the number of times. In exchange, former employee G helped her with "personal things." The document also revealed that the mother of patient #2 stated former employee G had called and asked her adult son to log into her tablet and clock her out .... " 6. Review of the transcripts for recorded calls provided by individual A revealed no available date or time stamps. Call #1 occurred between individual A and former employee G and revealed the following excerpts: Recording #1: Former Employee G - "I have all my hours through the week. I still am gonna [sic] do like a 16 - hour shift on Friday and her overnight. And then, another nurse is gonna [sic] come Saturday during the day. I'm gonna [sic] meet her at her house and she's gonna [sic] get her from 9-5 and the at 5 o'clock, I go back and get her, or, if, uh, her parents are home, they're just gonna [sic] keep her but let me have my shift from 5 - 11 ... So, basically, if I wanted to, every week I could get at least 10 hours of overtime ...so like if I go to her house at 5 o'clock, I'll clock in, and then I could just do my charting and then she'll clock me out that night. So I don't have to worry about, like, going back and getting my tablet, I don't have to worry about clocking out."; Recording #2: Employee G - " ...Her (patient #2) brother and sister are gonna [sic] clock me out tonight ... She's gonna [sic] clock me in in the morning ... I'll just do my whole note for tomorrow and then her mom will clock me out tomorrow night ...."; Recording #3: employee G - " ... I'm trying to figure out a shift to work over here on Saturday, but not work." Individual A - "I thought you said you had to take your pad over there anyway Saturday?" Employee G - "I could just come over here, clock in, fill out all the information, leave my pad, and then come back and end the shift." Unknown female voice - "Your shift is in Noblesville ... Why don't you just drop it off here. I'll sign you in ..." Employee G - If I bring my tablet over here Friday ... I would just have to come over here Saturday to pick it up at midnight and like clock out. She could clock me in at not. What do you think? 7. A review of the personnel file for former employee G revealed a notice of termination, dated 1/4/2020, signed by the alternate administrator. The document revealed "It was reported to Tendercare management that you submitted clinical documentation for reimbursement for shifts that you had not performed. Specifically, the patient's family member clicked you in and out of your shift on your table at their home to secure the GPS location. It was also reported that you took your minor patient to your home on multiple occasions and provided care at your home while leaving your tablet at the patient's home so that the GPS information would not reflect the change of location...." The document referenced the agency handbook sections for employee conduct, termination, and falsification of records and stated employee G signed receipt of the handbook on 8/8/19. Employee G was terminated on 1/4/20. 8. On 6/22/21 at 9:30 AM, the alternate administrator demonstrated the use of a tablet through training mode. After signing on using a user ID and password, the tablet evidenced the daily and weekly schedule of the patient's signing on was accessible once signed into the tablet. If the user clicked on the patient's name, a blank form appeared, which could be completed until the individual signed out on the visit. At that time the visit "closed" and could not be reopened. The administrator stated the agency did not agree that PHI was shared because a patient's name was not PHI. No further information was available. 9. During an interview on 6/21/21, at 2:00 PM, the administrator and alternate administrator revealed that individual A reported on multiple occasions of former employee G leaving her agency issued tablet in patient homes and had the patient's caregivers clock in and/or out for former employee G. Individual A also reported that former employee G was taking patients to the employee's house to provide care. Individual A identified patients 1 and 2 by name and provided the address for both patients. Due to domestic issues between Individual A and former employee G, the administrator stated the agency viewed the report from Individual A as a personnel-related problem, and all documentation concerning the issue was located in the former employee's file. The administrator stated the incident was not treated as a PHI breach because no protected health information was released to individual A that would meet the criteria as PHI. When queried whether individual A was aware of the names and addresses of patients #1 and #2, the administrator stated she was aware and stated "a name isn't protected health information." When queried whether the patient's mother had access to other patient information, the alternate administrator stated the agency EMR (electronic medical record) only evidenced the nurse's schedule for the day, along with a blank electronic form for charting. The administrator and alternate administrator were queried as to whether the mother of patient #1 would need former employee G's user ID and password to sign former employee G out, and both stated yes, but because the tablet only provided the nurse's schedule for the day, and again stated, the incident did not rise to the level of a HIPAA (Health Insurance Portability and Accountability Act) or PHI violation. When queried whether former employee G was ever scheduled to see more than 1 patient in a day, the administrator and alternate administrator stated yes but it was unlikely, and on the days they identified that former employee G left her tablet with patient #1's mother, no other patients were scheduled, so the patient's mother could not see any other names. During further discussion concerning the tablets, the alternate administrator revealed that the tablet was able to show the employee's daily schedule and/or weekly schedule. When queried whether former employee G's weekly schedule revealed the names of all patients she was to see, the alternate administrator stated yes. The administrator stated that was not a breach of PHI because the schedule only showed patient names and did not reveal PHI. Further discussion, the administrator and alternate administrator stated that former employee G was suspended on 12/31/20 pending further investigation, which ultimately resulted in the termination of former employee G. The alternate administrator stated all of the caregivers for former employee G's patients were interviewed and denied that former employee G left the tablet with them or took the patient to the employee's home, except the caregivers for patient 1 and 2. The administrator and alternate administrator stated that the parent of patient #1 denied that the patient was cared for in the home of former employee G, however, the parent of patient #2 stated she had given permission for former employee G to take patient #2 to her home but was unaware there was an altercation. The administrator and alternate administrator stated former employee G was reported to the attorney general and was under investigation to the best of their knowledge. The administrator stated no further follow-up occurred agency-wide because the incident was an individual employee problem related to failure to follow agency practice and not a PHI violation. When queried as to how she knew that tablets were not being left in-home and passwords not shared by other employees, the administrator stated the agency provided yearly HIPAA education and PHI training to all employees. When queried as to whether former employee G received the same training, the administrator stated yes. The administrator stated again that the agency did not view the incidents and a breach in PHI because a name does not count as PHI. When queried whether the agency treated patient addresses as PHI the administrator stated that the incident was a personnel situation, and the agency followed its policy for investigation and termination and reported former employee G to the Attorney General. 410 IAC 17-15-1 (c)