Ten Most Frequently Cited Deficiencies

A facility may not release information that is resident-identifiable to the public. The facility may release information that is resident-identifiable to an agent only in accordance with a contract under which the agent agrees not to use or disclose the information (except to the extent the facility itself is permitted to do so).

Just as facilities using paper documentation, facilities using an electronic format for resident documentation must comply with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules.

Surveyors are not responsible for assessing compliance with HIPAA rules. The surveyors' responsibility is to assess compliance with the regulatory requirement for maintaining the content and confidentiality of the medical record.