Every finding on record at Carepro Hospice, LLC

Based on review of the electronic medical record, policy review, and interview, the hospice agency failed to monitor, manage, and maintain the devices used to access the web-based medical record when it had staff use personal devices such as cell phones, laptops, tablets, and home computers instead of devices owned by the agency. This had the potential to result in unauthorized access to patient information for all patients receiving care from the hospice. Findings include: --- During an interview on 02/27/23 at 9:00 AM, the Administrator stated the agency used a web-based electronic medical record (EMR) program called "Wellsky." The Administrator stated the agency did not provide devices to access the EMR, and that staff access the program using their personal devices such as home computers, laptops, cell phones, or tablets. The Administrator also confirmed that it is possible for staff to save their log-in password to their computer and to save patient information as a PDF (portable document format) document to their personal computer. The Administrator confirmed the agency would not know if a staff person saved their log-in information or downloaded patient information and that the agency does not have the ability to monitor staffs personal electronic devices used to access the web-based EMR. During review of patient medical records located in the EMR during the survey, it was possible to save the password enabling further logins without re-entering username and password. Also, it would be possible to save patient information including the plan of care, medication list, progress notes, and patient identifying information including name, address, diagnosis, and insurance information. Review of the agency policy titled, "Patient Rights," dated November 2013, revealed, "[Name of agency] will respect and safeguard all protected health information of the patients it services ... Protect health information (PHI) is any information about health status, provision of health care, or payment for health care that can be linked to a specific individual in any form (verbal, written, electronic)." Review of the agency policy titled, "Safeguarding/Retrieval of Clinical/Service Record," dated November 2013, revealed, "The organization will safeguard the clinical/services record against loss, destruction, tampering or unauthorized use through the development of processes, policies and procedures."