HospitalInspections.org

Based on observation, interview and record review, the facility failed to ensure the Condition of Participation CFR 482.12 Governing Body was met when:

1. The Governing Body failed to ensure that the facility's computer data base system was protected from a cyber-attack, which affected the facility's computer operational system, as evidenced by:

a. The facility's antiviral system failed to prevent a virus intrusion into the hospital computer data base system which disrupted the computer operational systems affecting the quality of patient care, and resulted to a possible breach. (Refer to A-0441 and A-0063)

b. There was no policy and procedure in place during the malware intrusion, that was approved by the Governing Board, that specifically described a back up plan on how the facility should respond to unsuspected or known information system security alerts or incidents. (Refer to A-0441 and A-0063)

2. There was no oversight to ensure effective provision of care when:

a. There was no documented evidence the medications prescribed by the physician were transcribed and administered as ordered for seven out of 30 sampled patients (Patients 17, 18, 20, 21, 22, 27, and 29). (Refer to A-0386 and A-0405)

b. Physician order for Intravenous fluids was not transcribed accurately as prescribed for one of 30 sampled patients (Patient 27). (Refer to A-0386 and A-0405)

c. There was no documented evidence for two of 30 sampled patients (Patients 27 and 28), the written physician orders for laboratory tests were performed. (Refer to A-0386 A-0405)

3. The facility failed to ensure the medical records were maintained when:

a. The facility failed to ensure clinical records are filed appropriately for four of 30 sampled patients (Patients 1, 4, 7, and 8) and easily accessible for retrieving medical records. (Refer to A-0438)

b. The facility's computer system failed to ensure that the facility's computer data base system was protected from a cyber-attack as evidenced by the facility's antiviral system failed to prevent a virus intrusion into the hospital computer data base system which disrupted the computer operational systems affecting the quality of patient care, and resulted to a potential for breach. (Refer to A-0441)

c. There was no policy and procedure in place during the malware intrusion, that was approved by the Governing Board, that specifically described a back up plan on how the facility should respond to unsuspected or known information system security alerts or incidents. (Refer to A-0441)

d. The facility failed to ensure the clinical records were accurate and complete. (Refer to A-0450)

e. The facility failed to ensure the patient clinical records contained reports that were promptly filed and were easily accessible, when two of 30 sampled patients (Patients 27 and 28), did not have documented evidence multiple written physician orders for laboratory tests were performed. (Refer to A-0467)

The cumulative effect of these systemic problems resulted in the failure of the hospital to deliver care in a safe setting and be in compliance with the Condition of Participation for CFR 482.12 Governing Body.

Based on interview and record review, the facility failed to ensure there was a policy and procedure in place during the malware (a software installed into one's machine without one's consent, performing unwanted tasks) intrusion incident, that was approved by the Governing Body (GB), that specifically described a back up plan on how the facility should respond to unsuspected or known information system security alerts or incidents.


Findings:

During an interview with the Chief Nursing Officer (CNO) on April 25, 2016 at 8:55 AM, the CNO described what happened. The CNO stated on March 18, 2016 at 8 PM, one of the facility's "sister facility's" computer system "went down." On March 19, 2016 at approximately 9 AM, some of the Information Technology (IT) crew came to this facility and stated they might need to do a "voluntary shutdown" of the facility's computer system related to a "malware" attack. Since the facility shared some of the "network," at approximately 11 AM-12 PM, the facility IT shutdown of the computer system (IT downtime) was implemented. The facility engaged in the downtime process to prevent the "virus from spreading." On March 19, 2016 at approximately 11 AM - 12 PM, all the facility's computers were shutdown. During the IT downtime process, the facility went into "paper" using paper forms for charting, physician orders, medication administration records, requisitions, reports, etc. The facility's staff were not able to access electronically including the computer electronic medical record system (EMR).

During an interview with the Chief Executive Officer (CEO) on April 25, 2016 at 11:10 AM, the CEO described what happened. The CEO explained the malware blocked the facility's access to the computer's functionality. The facility's computer system was brought down (computer electronic medical record system - EMR system - a system used for charting, physician orders, requisitions, communication between different departments within the facility, etc), as a precautionary measure.

During an interview with the Regional IT Director (RITD) on April 25, 2016 at 1:50 PM, when asked to describe what happened, the RITD stated another sister facility experienced an "outbreak" on March 18, 2016 in the evening. And then another sister facility also started experiencing the "symptoms" (computer file would be unaccessible at user file levels); files did not look "normal." The IT staff had to voluntarily shut down EMR system as a preventive measure to prevent the symptoms from spreading. The RITD further explained that the system shutdown included shutting down of the computer electronic medical record systems (EMR system) in all units.

The RITD further explained that at the time of the incident, this facility would connect to its other sister facilities through an "open" private trusted Wide Area Network (WAN a computer network in which computers over a wide geographical area would connect; provided remote access to clinical documents, billing purposes, etc..). The netwrok traffic was considered a private trusted network (a secured internal network) and had no restrictions. The RITD stated, given the event that had happened, there should had been more restrictions. When asked what the facility's policy and procedure was on the facility's use of the WAN network, the RITD confirmed prior to the incident, there was no policy and procedure developed and approved by the governing board, that was specific on the use of the WAN.

During a follow up phone interview with the RITD on April 26, 2016 at 2:20 PM, RITD confirmed prior to the incident, the WAN was "open" (had no granular access in between) and had no monitoring device installed at the time of the incident.

During an interview with the Corporate IT Director (CITD) in the presence of the IT Manager, and the Administrator, on April 27, 2016 at 11:45 AM, CITD stated the WAN is only for connectivity and had nothing to do with the data.

During an interview with the Pharmacist 1 and the Pharmacy Director (PD) on April 25, 2016 at 2:50 PM, the PD explained that during the normal process (prior to the IT downtime process), the physician medication orders would be communicated to the pharmacy department electronically through the EMR system (which they were not able to access), which interfaced with the medication dispensing system. During the IT downtime process from March 19, 2016 to March 25, 2016, the medication dispensing system remained operational, however, since the EMR system was down, the staff were not able to access and enter physician orders on the EMR system. The licensed nurses would personally hand the pharmacy staff a "yellow copy (out of the triplicate copies" of the written physician medication orders. The licensed nurses would update the medication profile list daily on the "paper form" (non-computer electronic medical record form) that the pharmacy department staff would print out from the medication dispensing system. The medication dispensing system remained operational, however, since the EMR system was down, the licensed staffs were not able to enter and document electronically their medication administration record on each patient; they would document on the "paper form" medication profile list.

During an interview with with Laboratory Assistant (Lab Asst) on April 25, 2016 at 4:13 PM, when asked to describe the normal process (prior to the IT downtime process) on how the department handled laboratory orders for the patients, the Lab Asst explained the orders for laboratory tests would be entered electronically through the EMR system which would print out the labels (had the patient name, name of the test, if it were a routine order or a stat order, etc). After the order was processed, the laboratory results would then be entered electronically into the EMR system, that allowed the licensed staff and the physicians in the units to view the results. During the IT downtime process, which started on March 19, 2016 in the morning (and lasted for approximately two weeks) and the EMR system was down, the physician would handwrite the orders on paper forms, and the licensed nurses would bring the copy of the physician orders to the laboratory department. After the order had been processed, the the laboratory results were manually written on a paper form and the laboratory department staff would bring this form back to the unit.

During an interview with the Post Partum Unit Registered Nurse (RN) 4 on April 26, 2016 at 9:55 AM, RN 4 stated that during the IT downtime process, since they were unable to access the EMR system, the licensed staff had to use paper forms for charting, documentation, etc. They would either send the orders to the pharmacy through fax, or would handcarry the orders to the pharmacy department. The electronic medication dispensing system remained operation, however, they had to use the printed paper form medication profile list to manually document medication administration on each patient. The orders for the laboratory tests were also handwritten and to be either called in or faxed to the laboratory department.

During an interview with the Labor and Delivery Unit Registered Nurse (RN) 5 on April 26, 2016 at 10:05 AM, RN 5 stated during the IT downtime process, since they were unable to access the EMR system they had to use the paper forms for charting, documentation, etc. During the normal process prior to the (incident), while the patient (mother) was in the labor process, the patient would be attached to a "monitor" machine (that would monitor the baby's heart rate, the frequency of the mother's contractions, etc. The computer system allowed the licensed staff to view and monitor the results on the central computer system located at the nursing station. Since the computer system was down, the did not have access to the computer system and had to physically enter the patient's room every 10 minutes to check and monitor results from the "monitor" machine that was attached to the patient.

During an interview with the Administrator on April 28, 2016 at 4:03 PM, when asked the Administrator confirmed that prior to the incident, there was no policy and procedure, authorized by the Governing Body, that specifically described the back-up plan on how the facility should respond, should an incident such as this were to occur.


A review of the facility's policy and procedure titled, "Security Policy, Information Systems," dated 02/14, stipulated under Purpose, "The purpose is to: Establish an overall security policy to protect electronic information assets with IS' custodianship; Assign user accountability and responsibility in the protection of electronic information assets; and Demonstrate IS' accountability and responsibility in the establishment and enforcement of appropriate security measures to protect electronic information assets." It stipulated under Contingency Plans, "Contingency Plans must exist and be implemented to enable the Customer's critical systems to resume operation in a timely manner after a serious disruption of these systems. The contingency plans must be documented and tested on a regular basis to ensure the plans remain current and operational. Customers are responsible for developing emergency operational procedures for critical applications as appropriate."

It further stipulated under Contingency Plans, "1. Information Systems... IS must develop Disaster Recovery plans including regularly scheduled backups for systems under their custodianship (i.e., systems-maintained data centers) following the guidelines as (as) established by the IS Department. In conjunction with the owner, IS must periodically perform an Application Impact Analysis to determine how quickly an application must be made available in the event of a disaster to manage priorities. For new applications, protection must be determined as part of the system analysis and design or software purchase process. New systems should demonstrate their compliance with backup and disaster recovery requirements before implementation. The level of protection must be balanced with the overall criticality associated with the information asset to be recovered. In addition, appropriate emergency mode operation plans must be defined. IS must periodically test and validate the established plans for production systems at the data centers. 2. Customers & Users ... Each office or user must develop and implement backup and disaster recovery plans for all other applications and data not under the custodianship of IS. These plans should ensure that critical (needed to continue core business operations) microcomputer-based applications and data could be recovered quickly enough after an incident to allow the department or office to continue conducting business in an effective manner. Departments must consider emergency mode operation plans in the event critical systems are not available."

During an interview with the RITD, in the presence of the IT Manager, the Administrator, and the CNO, a concurrent review of the facility's policy and procedure titled, "Security Policy, Information Systems," dated 02/14, were conducted on April 29, 2016 at 9:55 AM. When asked, prior to the incident, what the facility's contingency plans were in place, in the event an incident such as this were to occur, the RITD stated there should have been more of an outlined plan in response to this type of magnitude. The RITD recounted the timeline of the incident as follows:

a. On March 18, 2016, an alert of a security incident within the corporate systems was received between 10:30 PM and 11:30 PM. No details were given at that time.

b. On March 19, 2016 at approximately 9:15 AM (approximately 11 hours and 45 minutes to 12 hours and 45 minutes since the alert of a security incident was received), the house supervisor reported to the corporate's IT Help Desk and to the on-call IT, that the workstation computers were not responding to user input (described as freezing or lack of action happening from the keyboard or mouse input).

c. On March 19, 2016 between 10 AM and 11 AM (approximately 45 minutes to an hour since the House Supervisor initially reported the workstation computers' non-response), the facility's WAN network was physically disconnected by the on call IT, at the instruction of RIT, per the corporate's IT team. During this time. IT staff physically unplugged workstations from the network and power throughout the facility.

d. On March 19, 2016 between 10:30 AM and 11:30 AM (approximately one hour and 15 minutes to two hours and 15 minutes since the House Supervisor initially reported the workstation computers' non-response), at the request of RIT and the corporate's IT team, (EMR) system shutdown process was started.

On April 29, 2016 at 11:45 AM, the CNO present a copy of the facility's contingency plan titled, "Information System Security Program Hardware/Media Security," dated 02/14. During a concurrent interview with the CNO and a review of the contingency plan, the CNO confirmed the plan "was very broad" and it did not specify the steps on what the facility would follow should an incident such as this were to occur.

Based on interview an record review, the facility failed to ensure the Conditions of Participation CFR 482.23 Nursing Services was met when there was no oversight to ensure effective provision of care when:


1. There was no documented evidence the medications prescribed by the physician were transcribed and administered as ordered for seven out of 30 sampled patients (Patients 17, 18, 20, 21, 22, 27, and 29). (Refer to A-0386 and A-0405)

2. Physician order for Intravenous fluids was not transcribed accurately as prescribed for one of 30 sampled patients (Patient 27). (Refer to A-0386 and A-0405)

3. There was no documented evidence for two of 30 sampled patients (Patients 27 and 28), the written physician orders for laboratory tests were performed. (Refer to A-0386 A-0405)

The cumulative effect of these systemic problems resulted in the failure of the hospital to deliver care in a safe setting and be in compliance with the Condition of Participation CFR 482.23 Nursing Services.

Based on interview an record review, the facility failed to ensure there was oversight to ensure effective provision of care when:

1. There was no documented evidence the medications prescribed by the physician were transcribed and administered as ordered for seven out of 30 sampled patients (Patients 17, 18, 20, 21, 22, 27, and 29). These failures had the potential to result in patients not receiving the appropriate medical interventions as prescribed, affecting patients' overall health and safety, in a universe of 25.

2. Physician order for Intravenous fluids was not transcribed accurately as prescribed for one of 30 sampled patients (Patient 27). These failures had the potential to result in patients not receiving the appropriate medical interventions as prescribed, affecting patients' overall health and safety, in a universe of 25.

3. There was no documented evidence for two of 30 sampled patients (Patients 27 and 28), the written physician orders for laboratory tests were performed. This failure had the potential to result in lack of accurate and appropriate monitoring of the patient's condition, in a universe of 25.

Findings:

During an interview with the Chief Nursing Officer (CNO) on April 25, 2016 at 8:55 AM, the CNO described what happened. The CNO stated on March 18, 2016 at 8 PM, the facility's "sister facility" (name of hospital) computer system "went down." On March 19, 2016 at approximately 9 AM, some of the Information Technology (IT) crew came to this facility and stated they might need to do a "voluntary shutdown" of the facility's computer system related to a "malware" (a software installed into one's machine without one's consent, performing unwanted tasks) attack. Since the facility shared some of the "network," at approximately 11 AM-12 PM, the facility IT shutdown was implemented and the facility engaged in the downtime process to prevent the "virus" from spreading. On March 19, 2016 at approximately 11 AM - 12 PM, all the facility's computers were shutdown. During the downtime process from March 19, 2016 to approximately March 24, 2016 to March 25, 2016 (approximately five to six days), the facility went into "paper" (non-computer electronic medical record form) using paper forms for charting, physician orders, medication administration records, requisitions, reports, etc. The computer electronic medical record system (EMR - computer program for patient's medical records) was brought live strategically in phases so as not to overwhelm the system.

1.a. An interview with the Director of Labor and Delivery Services (DLD) and the Registered Nurse (RN 1), and a concurrent review of Patient 17's clinical record, were conducted on April 26, 2016 at 3:45 PM.

A review of Patient 17's clinical record revealed Patient 17 was admitted to the facility on March 21, 2016. The Operative Report dated March 21, 2016, revealed Patient 17 underwent a repeat cesarean section surgery (delivery of the baby through a surgical incision on the mother's abdomen).

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated and timed March 21, 2016 at 9:30 AM, revealed written physician orders as follows:

a. Dilaudid (pain medication) one milligram (mg) by mouth every two hours prn (as needed).

b. Norco 5/325 (pain medication) mg two tablets by mouth every six to eight hours prn.

c. Toradol (pain medication) 30 mg every six hours prn for pain.

During an interview with the DLD and a concurrent review of Patient 17's clinical record, she confirmed there was no documented evidence the above physician orders were transcribed and were administered as ordered; "I don't know what happened to that."

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.b. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 18's clinical record, were conducted on April 27, 2016 at 9:10 AM.

A review of Patient 18's clinical record revealed Patient 18 was admitted to the facility on March 18, 2016. The History and Physical dated March 19, 2016 revealed Patient 18 had diagnoses that included hypertension (a condition of high blood pressure). A consultation dated March 22, 2016, revealed Patient 18 had been having "rectal bleeding off and on for last couple of months." It further revealed Patient 18 had history of colon polyps (growth on the large intestines) and hemorrhoids (a condition with swelling of blood vessels of the rectum) with diverticulosis (a condition wherein pouches are developed in the colon wall).

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated and timed March 22, 2016 at 11 AM, revealed a written physician order for Anusol HC suppository (medication used to treat hemorrhoids) twice a day for 5 days.

During an interview with the DLD and a concurrent review of Patient 18's clinical record, she confirmed there was no documented evidence the above physician orders were transcribed and were administered as ordered on March 22, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

1.c. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 20's clinical record, were conducted on April 27, 2016 at 10 AM.

A review of Patient 20's clinical record revealed Patient 20 was admitted on March 23, 2016. The Operative Report dated March 25, 2016 revealed Patient 20 underwent laparoscopic cholecystectomy (a surgical removal of the gallbladder).

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated and timed March 25, 2016 at 4 PM, revealed an order for Ancef (an antibiotic) one gram (gm) intravenous piggy back (IVPB-medication given through the veins) every six hours for three additional doses. The order instructed to "Please give dose now."

During an interview with the CNO and a concurrent review of Patient 20's clinical record, CNO confirmed there was no documented evidence the above physician order was administered as ordered on March 25, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

1.d. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 21's clinical record, were conducted on April 27, 2016 at 10:20 AM.

A review of Patient 21's clinical record revealed Patient 21 was admitted on March 21, 2016. The History and Physical form dated March 22, 2016 revealed Patient 21 had diagnoses that included hypertension (a condition of hihg blood pressure)and diabetes (a condition with abnormal blood sugar levels).

A review of the "paper form (non-computer electronic form)" Medication Reconciliation Form/Order Sheet dated March 21, 2016, revealed written physician orders that included the following:

a. Fish Oil 1400 units by mouth every day (to be continued upon admission/transfer).

b. COQ 10 (an antioxidant medication) by mouth every day (to be continued upon admission/transfer).

During an interview with the CNO and a concurrent review of Patient 21's clinical record, CNO confirmed there was no documented evidence the above physician orders were administered as ordered on March 23, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

1.e. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 22's clinical record, were conducted on April 27, 2016 at 10:40 AM.

A review of Patient 22's clinical record revealed Patient 22 was admitted on March 23, 2016. Patient 22 underwent surgical dilatation and curettage (D&C - a surgical removal of tissues in the uterus).

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated March 23, 2016, it included medication orders for the following:

a. Zofran (medication used to treat nausea and vomiting) 4 milligrams (mg) intramuscularly (IM - administered in the muscle) every four hours as needed (prn).

b. Motrin (medication used to treat pain and fever) 800 mg every six hours prn.

During an interview with the CNO and a concurrent review of Patient 22's clinical record, CNO confirmed there was no documented evidence the above physician orders were transcribed as ordered on March 23, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

1.f. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated March 23, 2016 at 2:50 PM, it documented multiple physician orders including the following:


a. Tylenol 325 milligrams (mg) tablet by mouth every four hours as needed (prn) for temperature above 100.4 degrees Farenheit (°F - a unit of temperature), headache, mild pain. The CNO confirmed the order transcribed did not include headache and mild pain as indications for the administration of Tylenol on March 23, 2016 and March 24, 2016.

b. Levothyroxine (a medication used to treat thyroid conditions) 0.125 microgram (mcg) by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

c. Calcium (a supplement) 5oo milligrams (mg) by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

d. Multivitamin one tablet by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

A review of the "paper form" Physician's Order Sheet dated March 24, 2016 at 6:10 PM, it documented multiple physician orders including an order for Heparin (a blood thinner medication) 5000 units subcutaneously (SQ - administered on the layer just beneath the skin) every day. Hold if any bleeding occurs as platelet (a blood element that functions to stop bleeding) count below 100 (unit). The CNO confirmed there was no documented evidence the order was transcribed and administered on March 24, 2016.

A review of the "paper form" Physician Order's Sheet dated March 26, 2016 at 2:20 PM revealed a written physician order for Levothyroxin (a medication used to treat thyroid conditions) 0.05 milligrams (mg) by mouth every day for hypothyroidism ( a condition wherein the body does not have enough thyroid hormones). The CNO confirmed there was no documented evidence the order was transcribed and administered on March 26, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

1.g. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 29's clinical record, were conducted on April 27, 2016 at 2:50 PM.

A review of Patient 29's clinical record revealed Patient 29 was admitted on March 16, 2016.

A review of the physician History and Physical form dated as dictated on March 17, 2016 revealed Patient 29's chief complaint was, "Altered mental status for one day with history of dialysis (a procedure to clean the blood) and renal (pertains to the kidneys) disease. It further noted Patient 29's calcium (an element in the blood) level was 7.4 (typical calcium level range is 8.4 - 11.0).

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated March 25, 2016 at 9:10 AM, revealed multiple orders including a medication order of Calcium Carbonate 500 milligrams (mg) to be administered via GT (administered through a gastric tube) three times a day. The CNO confirmed there was no documented evidence on both the paper form and the electronic form, that the medication order was transcribed and administered since the day it was ordered on March 25, 2016 until Patient 29 was discharged on April 5, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

During a Quality Assessment and Performance Improvement (QAPI) meeting the with facility's QAPI committee members on April 28, 2016 at 5:15 PM, when asked if CNO was aware the multiple written physician orders were either not transcribed accurately, or did not have documented evidence they were administered, or were not transcribed at all, the CNO confirmed she was not. When asked who was supposed to oversee that these written physician orders were transcribed and administered accurately and as ordered, the CNO stated it should have been the nurse's, who received the order, responsibility to transcribe and carry out the order. When asked who oversaw to ensure these nurses were doing so, the CNO confirmed, "I guess that would be me." CNO stated she was not made aware of the issues.

A review of the CNO Job description revealed, "... The following statements are intended to describe the major elements and requirements of the position and should not be taken as an all-inclusive list of responsibilities, duties, and skills required of individuals assigned to this job." It further stipulates, "B. DUTIES AND RESPONSIBILITIES 1. Plans, organizes and directs nursing organization and/or related departments effectively to ensure the provision of excellent patient care to the populations served. Works in collaboration with department managers to ensure compliance with company's mission-and vision as well as federal, state, and other regulatory agencies requirements. 2. Develops and implements clear, concise and current written policies and procedures, protocols and/or clinical pathways, and monitoring of the quality of the service. Is available to assist the staff to identify and/or minimize risk factors."

During an interview with the Governing Body Representative (GBR) in the presence of the CNO on April 28, 2016 at 10:05 AM, the GBR confirmed the "gaps" and the "mistakes" on the transcription of the written physician orders. The GBR also confirmed the facility had young nurses that were not used to "paper" forms.

2. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the "paper form (non-computer electronic medical record form)" Physician Order's Sheet dated March 23, 2016 at 2:50 PM, it documented multiple written physician orders including the following:

a. Intravenous fluid (IVF - fluids administered through the veins) or normal saline (NS - a solution) at a rate of 50 milliliters/hour (ml/hr - rate). The CNO confirmed the order was transcribed on the paper form Medication Administration Record to be given at a rate of "40 ml/hr" on March 23, 2016 and March 24, 2016. The CNO confirmed the order was signed as administered on March 23, 2016 at 3 PM.


During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."


3.a. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the Physician's Order Sheet dated March 23, 2016 at 2:50 PM, revealed multiple written physician orders that included orders for the following laboratory tests to be performed:

a. Magnesium and phosphate levels (elements in the blood).

b. Urinalysis (urine testing) with culture.

c. Glycohemoglobin (HbA1c - a blood test that measures the amount of sugar that coats the red blood cells).

d. Protime/Prothrombin (PT/PTT - tests that measure how long it takes for the blood to clot).

e. Thyroid panel (test to check the thyroid gland function).


A review of the Physician's Order Sheet dated March 23, 2016 at 12:40 PM, revealed a written physician order for an MRSA (Methicillin Resistant Staphylococcus Aureus - a bacteria) screen for left and right nares.

During the concurrent interview with the CNO on April 27, 2016 at 2:15 PM , she confirmed there was no documented evidence of laboratory results to show the above laboratory tests were performed.

An interview with the Director of Laboratory Services (DLS) and a concurrent review of Patient 27's clinical record and the laboratory requisitions, were conducted on April 28, 2016 at 9:40 AM. The DLS confirmed there was no documented evidence that a requisition for the above laboratory tests, was sent to the laboratory department to perform the tests.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."


3.b. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 28's clinical record were conducted on April 27, 2016 at 2:30 PM. It revealed Patient 28 was admitted on March 16, 2016.

A review of the Operative Report dated March 23, 2016, revealed Patient 28 underwent Excision (surgical procedure) of the sacral coccyx (pertains to the tailbone area) decubitus ulcer (bedsore).

A review of the Physician's Order Sheet dated March 22, 2016 at 7:25 AM, revealed written physician orders for the following laboratory tests to be performed:

a. Complete blood count (CBC - test to check blood levels).

b. Basic Metabolic Panel (BMP - group of blood tests that evaluates the body's metabolism).

During the concurrent interview with the CNO on April 27, 2016 at 2:35 PM , she confirmed there was no documented evidence of laboratory results to show the above laboratory tests were performed.

An interview with the Director of Laboratory Services (DLS) and a concurrent review of Patient 28's clinical record and the laboratory requisitions, were conducted on April 28, 2016 at 10:15 AM. The DLS confirmed there was no documented evidence that a requisition for the above laboratory tests, was sent to the laboratory department to perform the tests.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

During a Quality Assessment and Performance Improvement (QAPI) meeting the with facility's QAPI committee members on April 28, 2016 at 5:15 PM, when asked CNO was aware the multiple written physician orders for laboratory tests did not have documented evidence they were performed, the CNO confirmed she was not. When asked who was supposed to oversee that these written physician orders were transcribed and carried out accurately and as ordered, the CNO stated it should have been the nurse's, who received the order, responsibility to transcribe and carry out the order. When asked who oversaw to ensure these nurses were doing so, the CNO confirmed, "I guess that would be me." CNO stated she was not made aware about the issues.

A review of the CNO Job description revealed, "... The following statements are intended to describe the major elements and requirements of the position and should not be taken as an all-inclusive list of responsibilities, duties, and skills required of individuals assigned to this job." It further stipulates, "B. DUTIES AND RESPONSIBILITIES 1. Plans, organizes and directs nursing organization and/or related departments effectively to ensure the provision of excellent patient care to the populations served. Works in collaboration with department managers to ensure compliance with company's mission-and vision as well as federal, state, and other regulatory agencies requirements. 2. Develops and implements clear, concise and current written policies and procedures, protocols and/or clinical pathways, and monitoring of the quality of the service. Is available to assist the staff to identify and/or minimize risk factors."

During an interview with the Governing Body Representative (GBR) in the presence of the CNO on April 28, 2016 at 10:05 AM, the GBR confirmed the "gaps" and the "mistakes" on the transcription of the written physician orders. The GBR also confirmed the facility had young nurses that were not used to "paper" forms (non-computer electronic medical records forms).

Based on interview an record review, the facility failed to ensure multiple physician orders for medications were administered in accordance to an order of the physician when:

1. There was no documented evidence the medications were transcribed and administered for eight out of 30 sampled patients (Patients 2, 17, 18, 20, 21, 22, 27, and 29).

2. Physician order for intravenous fluids adminsitration was not transcribed accurately for one of 30 sampled patients (Patient 27).

These failures had the potential to result in patients not receiving the appropriate medical interventions as prescribed, affecting patients' overall health and safety, in a universe of 25.

Findings:

1a. During a review of Patient 2's clinical record (non-computer electronic medical record forms) on April 27, 2016 at 10:20 AM, it indicated Patient 2 was admitted on April 16, 2016 with diagnoses of S/P (status post) BKA (bilateral knee amputee), LLE (left lower extremity) gangrene (dead tissue caused by an infection), hypertension (high blood pressure), diabetes (high blood sugar), and peripheral artery disease (circulatory problem in which narrowed arteries reduce blood flow to the limbs).

During a review of Patient 2's physician order written on April 20, 2016 at 1546 (3:46 PM) indicated, "Increase IV (intravenous) fluid NS (normal saline- used to supply water and salt to the body) at 150 ml/hr (milliliter per hour) for 2 hours." The Medical Surgical/Telemetry Director (MSTD) confirmed that the physician order was not transcribed to the MAR. The MSTD stated, "I don't know why the order was not carried out, and there is no profile order for increased IV fluids."

A review of the nurses' progress notes dated March 20, 2016 at 1540 (3:40 PM) indicated,"... called Dr.(name of the doctor), received new orders to increase NS rate from 80 ml/hr to 150 ml/hr x 2hr... " MSTD confirmed there was no documentation in the nurse's progress note that the physician order was carried out.



32496

1.b. During an interview with the Chief Nursing Officer (CNO) on April 25, 2016 at 8:55 AM, the CNO described what happened. The CNO stated on March 18, 2016 at 8 PM, the facility's "sister facility" (name of hospital) computer system "went down." On March 19, 2016 at approximately 9 AM, some of the Information Technology (IT) crew came to this facility and stated they might need to do a "voluntary shutdown" of the facility's computer system related to a "malware" (a software installed into one's machine without one's consent, performing unwanted tasks) attack. Since the facility shared some of the "network," at approximately 11 AM-12 PM, the facility IT shutdown was implemented and the facility engaged in the downtime process to prevent the "virus" from spreading. On March 19, 2016 at approximately 11 AM - 12 PM, all the facility's computers were shutdown. During the downtime process from March 19, 2016 to approximately March 24, 2016 to March 25, 2016 (approximately five to six days), the facility went into "paper" (non-computer electronic medical record forms) using paper forms for charting, physician orders, medication administration records, requisitions, reports, etc. The computer electronic medical record system (EMR) was brought live strategically in phases so as not to overwhelm the system.

An interview with Director of Labor and Deliver Services (DLD) and the Registered Nurse (RN 1), and a concurrent review of Patient 17's clinical record, were conducted on April 26, 2016 at 3:45 PM.

A review of Patient 17's clinical record revealed Patient 17 was admitted to the facility on March 21, 2016. The Operative Report dated March 21, 2016, revealed Patient 17 underwent a repeat cesarean section surgery (a delivery of the baby through a surgical incision on the mother's abdomen).

A review of the "paper form (non-computer electronic medical record form)" physician order sheet dated and timed March 21, 2016 at 9:30 AM, revealed written physician orders as follows:

a. Dilaudid (pain medication) one milligram (mg) by mouth every two hours prn (as needed).

b. Norco 5/325 (pain medication) mg two tablets by mouth every six to eight hours prn.

c. Toradol (pain medication) 30 mg every six hours prn for pain.

During an interview with the DLD and a concurrent review of Patient 17's clinical record, she confirmed there was no documented evidence the above physician orders were transcribed and were administered as ordered; "I don't know what happened to that."

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.c. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 18's clinical record, were conducted on April 27, 2016 at 9:10 AM.

A review of Patient 18's clinical record revealed Patient 18 was admitted to the facility on March 18, 2016. The history and physical dated March 19, 2016 revealed Patient 18 had diagnoses that included hypertension (a condition of high blood pressure). A consultation dated March 22, 2016, revealed Patient 18 has been having "rectal bleeding off and on for last couple of months." It further revealed Patient 18 had history of colon polyps (growth on the large intestines) and hemorrhoids (a condition with swelling of blood vessels of the rectum) with diverticulosis (a condition wherein pouches are developed in the colon wall).

A review of the "paper form (non-computer electronicmedical record form)" physician order sheet dated and timed March 22, 2016 at 11 AM, revealed a written physician order for Anusol HC suppository (medication used to treat hemorrhoids) twice a day for 5 days.

During an interview with the DLD and a concurrent review of Patient 18's clinical record, she confirmed there was no documented evidence the above physician orders were transcribed and were administered as ordered on March 22, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.d. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 20's clinical record, were conducted on April 27, 2016 at 10 AM.

A review of Patient 20's clinical record revealed Patient 20 was admitted on March 23, 2016. The Operative Report dated March 25, 2016 revealed Patient 20 underwent laparoscopic cholecystectomy (a surgical removal of the gallbladder).

A review of the "paper form (non-computer electronic medical record form)" physician order sheet dated and timed March 25, 2016 at 4 PM, revealed an order for Ancef (an antibiotic) one gram (gm) intravenous piggy back (IVPB-medication given through the veins) every six hours for three additional doses. The order instructed to "Please give dose now."

During an interview with the CNO and a concurrent review of Patient 20's clinical record, CNO confirmed there was no documented evidence the above physician order was administered as ordered on March 25, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.e. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 21's clinical record, were conducted on April 27, 2016 at 10:20 AM.

A review of Patient 21's clinical record revealed Patient 21 was admitted on March 21, 2016. The History and Physical dated March 22, 2016 revealed Patient 21 had diagnoses that included hypertension (a condition of high blood pressure) and diabetes (a condition with abnormal blood sugar levels).

A review of the "paper form (non-computer electronic medical record form)" Medication Reconciliation Form/Order Sheet dated March 21, 2016, revealed written physician orders that included the following:

a. Fish Oil 1400 units by mouth every day (to be continued upon admission/transfer).

b. COQ 10 (an antioxidant medication) by mouth every day (to be continued upon admission/transfer).

During an interview with the CNO and a concurrent review of Patient 21's clinical record, CNO confirmed there was no documented evidence the above physician orders were administered as ordered on March 23, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.f. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 22's clinical record, were conducted on April 27, 2016 at 10:40 AM.

A review of Patient 22's clinical record revealed Patient 22 was admitted on March 23, 2016. Patient 22 underwent surgical dilatation and curettage (D&C - a surgical removal of tissues in the uterus).

A review of the "paper form (non-electronic form)" physician order sheet dated March 23, 2016, it included medication orders for the following:

a. Zofran (medication used to treat nausea and vomiting) 4 milligrams (mg) intramuscularly (IM - administered in the muscle) every four hours as needed (prn).

b. Motrin (medication used to treat pain and fever) 800 mg every six hours prn .

During an interview with the CNO and a concurrent review of Patient 22's clinical record, CNO confirmed there was no documented evidence the above physician orders were transcribed as ordered on March 23, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.g. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the "paper form (non-computer electronic medical record form)" physician order sheet dated March 23, 2016 at 2:50 PM, it documented multiple physician orders including the following:

a. Intravenous fluid (IVF - fluids administered through the veins) or normal saline (NS - a solution) at a rate of 50 milliliters/hour (ml/hr - rate). The CNO confirmed the order was transcribed on the paper form Medication Administration Record to be given at a rate of "40 ml/hr" on March 23, 2016 and March 24, 2016. The CNO confirmed the order was signed as administered on March 23, 2016 at 3 PM.

b. Tylenol 325 milligrams (mg) tablet by mouth every four hours as needed (prn) for temperature above 100.4 degrees Farenheit (°F - a unit of temperature), headache, mild pain. The CNO confirmed the order transcribed did not include headache and mild pain as indciations for Tylenol to be administered only on March 23, 2016 and March 24, 2016.

c. Levothyroxine (a medication used to treat thyroid conditions) 0.125 microgram (mcg) by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

d. Calcium (a supplement) 500 milligrams (mg) by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

e. Multivitamin one tablet by mouth daily. The CNO confirmed there was no documented evidence the order was transcribed and administered on March 23, 2016 and March 24, 2016.

A review of the "paper form" physician order sheet dated March 24, 2016 at 6:10 PM, it documented multiple physician orders including an order for Heparin (a blood thinner medication) 5000 units subcutaneously (SQ - administered on the layer just beneath the skin) every day. Hold if any bleeding occurs as platelet (a blood element that functions to stop bleeding) count below 100 (unit). The CNO confirmed there was no documented evidence the order was transcribed and administered on March 24, 2016.

A review of the "paper form" Physician Order's Sheet dated March 26, 2016 at 2:20 PM revealed a written physician order for Levothyroxin (a medication used to treat thyroid conditions) 0.05 milligrams (mg) by mouth every day for hypothyroidism (a condition wherein the body does not have enough thyroid hormones). The CNO confirmed there was no documented evidence the order was transcribed and administered on March 26, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

1.h. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 29's clinical record, were conducted on April 27, 2016 at 2:50 PM.

A review of Patient 29's clinical record revealed Patient 29 was admitted on March 16, 2016.

A review of the physician history and physical dated as dictated on March 17, 2016 revealed Patient 29's chief complaint was, "Altered mental status for one day with history of dialysis (a procedure to clean the blood) and renal (pertains to the kidneys) disease. It further noted Patient 29's calcium (an element in the blood) level was 7.4 (typical calcium level range is 8.4 - 11.0).

A review of the "paper form (non-computer electronic medical record form)" physician order sheet dated March 25, 2016 at 9:10 AM, revealed multiple orders including a medication order of Calcium Carbonate 500 milligrams (mg) to be administered via GT (administered through a gastric tube) three times a day. The CNO confirmed there was no documented evidence on both the paper form and the electronic form, that the medication order was transcribed and administered since the day it was ordered on March 25, 2016 until Patient 29 was discharged on April 5, 2016.

During an interview with the Director of Pharmacy (DP) and a concurrent review of the clinical records on April 28, 2016 at 8:45 AM, the DP stated the during the system downtime, it was the licensed nurse who would conduct the twenty-four hour chart checks to ensure the medication orders were transcribed on the medication administration records accurately.

During a Quality Assessment and Performance Improvement (QAPI) meeting the with facility's QAPI committee members on April 28, 2016 at 5:15 PM, when asked CNO was aware the multiple written physician orders were either not transcribed accurately, or did not have documented evidence they were administered, or were not transcribed at all, the CNO confirmed she was not. When asked who was supposed to oversee that these written physician orders were transcribed and administered accurately and as ordered, the CNO stated it should have been the nurse's, who received the order, responsibility to transcribe and carry out the order. When asked who oversaw to ensure these nurses were doing so, the CNO confirmed, "I guess that would be me." CNO stated she was not made aware about the issues.

During an interview with the Governing Body Representative (GBR) in the presence of the CNO on April 29, 2016 at 10:05 AM, the GBR confirmed the "gaps" and the "mistakes" on the transcription of the written physician orders. The GBR also confirmed the facility had young nurses that were not used to "paper" forms.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

2. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the "paper form (non-computer electronic medical record form)" physician order sheet dated March 23, 2016 at 2:50 PM, it documented multiple physician orders including the following:

Tylenol 325 milligrams (mg) tablet by mouth every four hours as needed (prn) for temperature above 100.4 degrees Farenheit (°F - a unit of temperature), headache, mild pain. The CNO confirmed the order transcribed did not include headache and mild pain as indciations for Tylenol to be administered only on March 23, 2016 and March 24, 2016.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

During an interview with the Director of Pharmacy (DP) and a concurrent review of the clinical records on April 28, 2016 at 8:45 AM, the DP stated the during the system downtime, it was the licensed nurse who would conduct the twenty-four hour chart checks to ensure the medication orders were transcribed on the medication administration records accurately.

During a Quality Assessment and Performance Improvement (QAPI) meeting the with facility's QAPI committee members on April 28, 2016 at 5:15 PM, when asked CNO was aware the multiple written physician orders were either not transcribed accurately, or did not have documented evidence they were administered, or were not transcribed at all, the CNO confirmed she was not. When asked who was supposed to oversee that these written physician orders were transcribed and administered accurately and as ordered, the CNO stated it should have been the nurse's, who received the order, responsibility to transcribe and carry out the order. When asked who oversaw to ensure these nurses were doing so, the CNO confirmed, "I guess that would be me." CNO stated she was not made aware about the issues.

During an interview with the Governing Body Representative (GBR) in the presence of the CNO on April 29, 2016 at 10:05 AM, the GBR confirmed the "gaps" and the "mistakes" on the transcription of the written physician orders. The GBR also confirmed the facility had young nurses that were not used to "paper" forms.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff members on noting and transcribing written physician orders on "paper forms."

The facility failed to ensure the Conditions of Participation CFR 482.24 Medical Records Services was met when:

1. The facility failed to ensure clinical records are filed appropriately for four of 30 sampled patients (Patients 1, 4, 7, and 8) and easily accessible for retrieving medical records. (Refer to A-0438)

2. The facility's computer system failed to ensure that the facility's computer data base system was protected from a cyber-attack as evidenced by:

a. The facility's antiviral system failed to prevent a virus intrusion into the hospital computer data base system which disrupted the computer operational systems affecting the quality of patient care, and resulted to a possible breach. (Refer to A-0441)

b. There was no policy and procedure in place during the malware intrusion, that was approved by the Governing Board, that specifically described a back up plan on how the facility should respond to unsuspected or known information system security alerts or incidents. (Refer to A-0441)

3. The facility failed to ensure the clinical records were accurate and complete. (Refer to A-0450)

4. The facility failed to ensure the patient clinical records contained reports that were promptly filed and were easily accessible, when two of 30 sampled patients (Patients 27 and 28), did not have documented evidence multiple written physician orders for laboratory tests were performed. (Refer to A-0467)

The cumulative effect of these systemic problems resulted in the failure of the hospital to deliver care in a safe setting and be in compliance with the Condition of Participation CFR 482.24 Medical Records.

Based on interview and record review, the facility failed to ensure clinical records are filed appropriately for four of 30 sampled patients (Patients 1, 4, 7, and 8) and easily accessible for retrieving medical records. This failure had the potential of patient not receiving appropriate care without accurate available information.

Findings:

During an interview with the Chief Nurse Officer (CNO) on April 25, 2016 at 8:55 AM, she stated the facility was on downtime (using non-computer electronic medical record forms) on March 19, 2016 to March 24, 2016.

During record review of the following patients on April 27, 2106 at 10:00 AM with Medical Surgical/Telemetry Director (MSTD) it indicated:

1. For Patient 1, the physician order was reviewed and indicated there was an order of laboratory tests to be done on March 22, 23, and 24, 2016 such as, basic metabolic panel (BMP-group of blood tests that provide information about body's metabolism), magnesium (electrolytes in the body important for the maintenance of heart and nervous system), and phosphorus (needed for building healthy strong bones). The MSTD confirmed there was no evidence of laboratory results in Patient 1's chart record file.

2. For Patient 4, the physician order written on March 21, 2016, indicated, complete blood count (CBC-test measures several components of and features of blood) and BMP. The MSTD confirmed there was no evidence of laboratory results in Patient 4's chart record file.

3. For Patient 7, the physician order written on March 23 and 24, 2016 indicated, BMP, Magnesium, and Phosphorus laboratory tests. The MSTD confirmed there was no evidence of laboratory results in Patient 7's chart record file.

4. For Patient 8, the physician order on March 20, 2016 of abdominal ultrasound report and medication administration record (MAR) for medication order of "Miralax (a laxative to treat occasional constipation) 17 gram with 8 ounces fluid daily "were missing in Patient 8's chart record file. MSTD confirmed there was no evidence of abdominal ultrasound report and MAR for medication order of Miralax.

During an interview with Medical Surgical /Telemetry Director (MSTD) on April 27, 2016 at 10:20 AM, he confirmed the missing laboratory results in clinical records of Patients 1, 4, 7, and 8. MSTD further stated he did not know why the laboratory results were missing, "The results should have been together with the patients' file." He stated he will contact the laboratory staff to check for the results.

During an interview with Health Information Management Staff (HIM) on April 28, 2016 at 10:30 AM, she stated she picked up records from the unit, sort out by document type, and process what was received. She further stated, for any missing record she would go to the nurses to find out why the records were missing.

A review of the facility policy and procedure titled, Record Content," revised January 2008 indicated, "... Patient records shall contain...results of diagnostic studies performed..laboratory, radiology.. "

Based on interview and record review, the facility's computer system failed to ensure that the facility's computer data base system was protected from a cyber-attack, which affected the facility's computer operational systems, as evidenced by:

1. The facility's antiviral system failed to prevent a virus intrusion into the hospital computer data base system which disrupted the computer operational systems affecting the quality of patient care, and resulted to a possible breach.

2. There was no policy and procedure in place during the malware intrusion, that was approved by the Governing Board, that specifically described a back up plan on how the facility should respond to unsuspected or known information system security alerts or incidents.

These deficient practices had the potential for unauthorized access of any confidential medical information used in ways not authorized by the patient in a universe of 25 patients.

Findings:

1. During an unannounced visit on April 25, 2016 at 8:10 AM, a complaint validation survey was conducted.

During an interview with Chief Nursing Officer (CNO) on April 25, 2016 at 8:55 AM, she stated, "On March 19, 2016, some Information Technology (IT) crew came to the facility and voluntarily shut down the system due to malware intrusion, kind of virus attack, as a precautionary measures. The CNO further stated, "The Meditech system (a system used for charting, physician orders, requisitions, communication between different departments within the facility, etc.) was shut down between 11:00 AM or 12:00 PM."

During an interview with the Administrator on April 25, 2016 at 9:20 AM, she stated that the facility initiated the computer system downtime period (computer documentation is done on paper) the morning of March 19, 2016.

During an interview with Regional Information Technology Director (RITD) on April 25, 2016 at 1:50 PM, he stated he was alerted about a malware intrusion (a software installed into one's machine without one's consent, performing unwanted tasks) which started at a hospital (name of hospital), then followed by another hospital (name of hospital) on March 18, 2016. He further on stated on March 19, 2016 this facility was having symptoms such as, "The working station was not working correctly and the system was off line." RITD further explained that the symptom noted was like "excel was encrypted," meaning, "the file did not look normal." RITD stated, early morning on March 19, 2016, the facility responded to carry out the downtime procedure and removed the computer from network connection to prevent any further malware intrusion.

Further interview with the RITD, he stated the downtime was initiated on March 19, 2016. RITD stated, "Prior to the malware intrusion, the private network was opened to traffic which is the Wide Area Network (WAN- allowed area connection to exist over a larger network area), not essentially restricted, and was an open network between hospitals.

During an interview with Registered Nurse (RN 3) at MST (Medical Surgical telemetry) unit on April 25, 2016 at 2:50 PM, she stated she was scheduled during the downtime on March 19, 2016 from 7:00 AM for 12 hour shift. She further stated, "Around 10:45 AM, physician and other staff cannot log in to elctronic medical record system."

During an interview with IT from Corporate Office on April 27, 2016 at 11:45 AM, he stated that each hospital had its own Local Area Network (LAN- a computer being plugged into local area network within the facility computer system), traffic to flow between hospitals, where exchange of data access occurs." He further stated, "The downtime was the proactive approach to the facility as a precautionary measure."

During a follow up interview with RITD on April 29, 2016 at 9:00AM, RITD was asked what was the specific response time when problem was noted, he stated, "I cannot give specific time line or speculate what the bad guys are doing at that time. The security alert from other facility was late night on March 18, 2016. He stated, "I was alerted via phone call by the team. We were in constant communication with other team at (name of hospitals)." He further stated, the decision was to shut down Meditech and disconnect WAN. He stated the Mcaffee system was the first line of defense. He stated, "The Mcaffee is providing what is intended to do and showed that is operating as it should."

RITD was asked as to how the malware intrusion got through the system, he stated, "The analogy is that the bad guys are more robust and intelligent to do it." He stated, "Before the event, the WAN between sites were available for communications with all sister facilities (names of hospitals). When asked what damage was done by this event to the WAN, he stated, "I cannot say what damage had been done. It is still being reviewed by security agency."

When asked RITD, if there was a response protocol for malware intrusion, he stated, "No response protocol in place, new process will be more outlined to this type of magnitude."


32496

2. During an interview with the Chief Nursing Officer (CNO) on April 25, 2016 at 8:55 AM, the CNO described what happened. The CNO stated on March 18, 2016 at 8 PM, the facility's "sister facility" (name of hospital) computer system "went down." On March 19, 2016 at approximately 9 AM, some of the Information Technology (IT) crew came to this facility and stated they might need to do a "voluntary shutdown" of the facility's computer system related to a "malware" (a software installed into one's machine without one's consent, performing unwanted tasks) attack. Since the facility shared some of the "network," at approximately 11AM-12PM, the facility IT shutdown was implemented and the facility engaged in the downtime process to prevent the "virus" from spreading. On March 19, 2016 at approximately 11AM - 12PM, all the facility's computers were shutdown. During the downtime process from March 19, 2016 to approximately March 24, 2016 to March 25, 2016 (approximately five to six days), the facility went into "paper" (non-computer electronic medical record forms) using paper forms for charting, physician orders, medication administration records, requisitions, reports, etc. The computer electronic medical record system (EMR - a system used for charting, physician orders, requisitions, communication between different departments within the facility, etc), was brought live strategically in phases so as not to overwhelm the system.

During an interview with the Chief Executive Officer (CEO) on April 25, 2016 at 11:10 AM, the CEO described what happened. The CEO explained the malware blocked the facility's access to the computer's functionality. The facility brought down everything (EMR), as a precautionary measure.

During an interview with the Regional IT Director (RITD) on April 25, 2016 at 1:50 PM, the RITD described what happened. The RITD stated another sister facility experienced an "outbreak" on March 18, 2016 in the evening. The another sister facility started experiencing the "symptoms" (computer file would be unaccessible at user file levels); files did not look "normal." The IT staff had to voluntarily shut down the facility's Meditech system on March 19, 2016 to March 24, 2016, as a preventive measure to prevent the symptoms from spreading. The (EMR) system was turned on a graduated pace and became on "full sign on" on March 25, 2016 (approximately 6 days later).

An interview with the Administrator was conducted on April 28, 2016 at 4:03 PM. The Administrator confirmed that prior to the incident, there was no policy and procedure, authorized by the Governing Body, that specifically described the back-up plan on how the facility's should respond to any suspected or known information system security alerts or incidents, should an incident such as this were to occur.

A review of the facility's policy and procedure titled, "Security Policy, Information Systems," dated 02/14, stipulated under Purpose, "The purpose is to: Establish an overall security policy to protect electronic information assets with IS' custodianship; Assign user accountability and responsibility in the protection of electronic information assets; and Demonstrate IS' accountability and responsibility in the establishment and enforcement of appropriate security measures to protect electronic information assets." It stipulated under Contingency Plans, "Contingency Plans must exist and be implemented to enable the Customer's critical systems to resume operation in a timely manner after a serious disruption of these systems. The contingency plans must be documented and tested on a regular basis to ensure the plans remain current and operational. Customers are responsible for developing emergency operational procedures for critical applications as appropriate."

During an interview with the RITD, in the presence of the IT Manager, the Administrator, and the CNO, a concurrent review of the facility's policy and procedure titled, "Security Policy, Information Systems," dated 02/14, were conducted on April 29, 2016 at 9:55 AM. RITD was asked, prior to the incident, what the facility's contingency plans were that specifically described the back-up plan on how the facility should respond to any suspected or known information system security alerts or incidents, should an incident such as this were to occur. The RITD stated there should have been more of an outlined plan in response to this type of magnitude.

A review of the "Timeline" report prepared and submitted by the RITD on April 29, 2016 at 12:15 PM, revealed the RITD's recount of the timeline of the incident as follows:

a. On March 18, 2016, an alert of a security incident within the corporate systems was received between 10:30 PM and 11:30 PM. No details were given at that time.

b. On March 19, 2016 at approximately 9:15 AM (approximately 11 hours and 45 minutes to 12 hours and 45 minutes since the alert of a security incident was received), the House Supervisor reported to the corporate's IT Help Desk and to the on-call IT staff, that the workstation computers were not responding to user input (described as freezing or lack of action happening from the keyboard or mouse input).

c. On March 19, 2016 between 10 AM and 11 AM (approximately 45 minutes to an hour since the House Supervisor initially reported the workstation computers' non-response), the facility's WAN network was physically disconnected by the on call IT, at the instruction of RIT, per the corporate's IT team. During this time, the IT staff physically unplugged the computer workstations from the network and the power throughout the facility.

d. On March 19, 2016 between 10:30 AM and 11:30 AM (approximately one hour and 15 minutes to two hours and 15 minutes since the House Supervisor initially reported the workstation computers' non-response), at the request of RIT and the corporate's IT team, (EMR) system shutdown process was started.

On April 29, 2016 at 11:45 AM, the CNO presented a copy of the facility's "Contingency Plan" titled, "Information System Security Program Hardware/Media Security," dated 02/14. During a concurrent interview with the CNO and a review of the contingency plan, the CNO confirmed the contingency plan "was very broad" and it did not specify the steps on how the facility should respond to any suspected or known information system security alerts or incidents, should an incident such as this were to occur.

Based on interview and record review the facility failed to ensure the clinical records were accurate and complete as evidenced by:

1. For Patient 2, the nurse's progress notes was not signed by the author.

2. For Patient , there were multiple clinical records with no patient identification.

3. For Patient 4, the physician order was not signed by the nurse who carried out the physician order.

Findings:

During a review of Patient 2's admission registration it indicated Patient 2 was admitted on April 16, 2016 with admitting diagnoses of LLE (left lower extremity) gangrene(dead tissue caused by an infection), hypertension (high blood pressure), diabetes (high blood sugar),and peripheral artery disease(circulatory problem in which narrowed arteries reduce blood flow to the limbs). Patient 2 was discharged on April 20, 2016.

1. A review of clinical record for Patient 2 was conducted on April 27, 2016 at 10:20 AM with Medical Surgical /Telemetry Director (MSTD). It was noted that the nurses' progress notes written on March 20, 2016 were not signed by the author who made the entries. The nurse's notes were entered on the following times:

0730 - (7:30 AM)
0920 - (9:20 AM)
1439 - (2:39 PM)
1540 - (3:40 PM)
1620 - (4:20 PM)
1630 - (4:30 PM)

During a concurrent interview with MSTD he confirmed there was no signature of the author who made the nurse's notes on April 27, 2016.

A review of the facility policy and procedure titled "Record Content," revised January 2008 indicated, "All inpatient.... Records shall contain the following patient identification: name, identification numbers, hospital account, name of admitting physician."

2. During a review of Patient 2's admission registration it indicated Patient 2 was admitted on April 16, 2016 with admitting diagnoses of LLE (left lower extremity) gangrene(dead tissue caused by an infection), hypertension (high blood pressure), diabetes (high blood sugar),and peripheral artery disease(circulatory problem in which narrowed arteries reduce blood flow to the limbs). Patient 2 was discharged on April 20, 2016.

During a review of Patient 2's Medication Administration record (MAR) dated March 20, 2016 through March 21, 2016, there was no patient identification. MSTD confirmed there was no patient identification.

A review of Patient 2's Interdisciplinary (IDT) Patient/Family Education record, IDT Plan of Care from pages one to seven, Blood Glucose monitoring record, and Graphic record for intake and output and vital signs record, indicated no patient identification. MSTD confirmed there was no patient identification.

A review of the facility policy and procedure titled "Chart Preparation for Scanning'" revised May 2013 indicated, "III. Verify that every page of record contains patient identification."

3. During a review of Patient 4's admission registration on March 21, 2016 at 10:30 AM, it indicated Patient 4 was admitted on March 16, 2016 and was discharged on March 22, 2016.

During a review of Patient 4's physician order written on March 21, 2106 it indicated, "CBC (complete blood count), BMP (basic metabolic panel), Phos (phosphorous)3/22/16 at 0600 (6:00 AM) and Zofran 8 milligram IV(intravenous) every 8 hr prn (as needed) N/V (nausea/vomiting)." The section on physician order sheet under "Noting RN's Signature" was blank.

During an interview with MSTD on April 27, 2016 at 10:20 AM, MSTD confirmed that the signature of the nurse who transcribed the physician order was missing. MSTD stated, "The nurse who transcribed the order should have noted and signed the physician order."

Based on interview and record review, the facility failed to ensure the patient clinical records contained reports that were promptly filed and were easily accessible, when two of 30 sampled patients (Patients 27 and 28), did not have documented evidence multiple written physician orders for laboratory tests were performed. This failure had the potential to result in lack of accurate and appropriate monitoring of the patient's condition, in a universe of 25.

Findings:

1. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 27's clinical record, were conducted on April 27, 2016 at 1:45 PM.

A review of Patient 27's clinical record revealed Patient 27 was admitted on March 23, 2016.

A review of the Emergency Room Report dated March 23, 2016 revealed Patient 27 had Pneumonia (a condition of the lungs), multiple left rib fractures (a break in the bone) and left wrist fracture.

A review of the physician progress notes dated March 23, 2016 at 4:20 PM, noted "IVF (intravenous fluids - fluids administered through the veins) at 50 cc/hr (cubic centimeter/hour - rate)."

A review of the physician progress notes dated March 23, 2016 at 5 PM, revealed a pulmonary consult that documented "DVT (Deep Vein Thrombosis - a condition wherein blood clots form) prec (precaution)."

A review of the Physician's Order Sheet dated March 23, 2016 at 2:50 PM, revealed multiple written physician orders that included the following laboratory tests to be performed:

a. Magnesium and phosphate levels (elements in the blood).
b. Urinalysis (urine testing) with culture.
c. Glycohemoglobin (HbA1c - a blood test that measures the amount of sugar that coats the red blood cells).

d. Protime/Prothrombin (PT/PTT - test that measures how long it takes for the blood to clot).

e. Thyroid panel (test to check the thyroid gland function).

Further review of the Physician's Order Sheet dated March 23, 2016 at 12:40 PM, revealed a written physician order for an MRSA (Methicillin Resistant Staphylococcus Aureus - a bacteria) screen for left and right nares.
During the concurrent interview with the CNO on April 27, 2016 at 2:15 PM , she confirmed there was no documented evidence of laboratory results to show the above laboratory tests were performed.

An interview with the Director of Laboratory Services (DLS) and a concurrent review of Patient 27's clinical record and the laboratory requisitions, were conducted on April 28, 2016 at 9:40 AM. The DLS confirmed there was no documented evidence that a requisition for the above laboratory tests, was sent to the laboratory to perform the tests.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

2. An interview with the Chief Nursing Officer (CNO), and a concurrent review of Patient 28's clinical record were conducted on April 27, 2016 at 2:30 PM. It revealed Patient 28 was admitted on March 16, 2016.

A review of the Operative Report dated March 23, 2016, revealed Patient 28 underwent Excision (surgical procedure) of sacral coccyx (pertains to the tailbone area) decubitus ulcer (bedsore).

A review of the Physician's Order Sheet dated March 22, 2016 at 7:25 AM, revealed written physician orders for the following laboratory tests to be performed:

a. Complete blood count (CBC - tests to check blood levels).

b. Basic Metabolic Panel (BMP - group of blood tests that evaluates the body's metabolism).

During the concurrent interview with the CNO on April 27, 2016 at 2:35 PM , she confirmed there was no documented evidence of laboratory results to show the above laboratory tests were performed.

An interview with the Director of Laboratory Services (DLS) and a concurrent review of Patient 28's clinical record and the laboratory requisitions, were conducted on April 28, 2016 at 10:15 AM. The DLS confirmed there was no documented evidence that a requisition for the above laboratory tests, was sent to the laboratory to perform the tests. When asked how the laboratory department monitored to which licensed nurse staff the laboratory staff would hand or report the paper laboratory results to, to ensure verfication of receipt of the patient's laboratory results, the DLS stated the laboratory department did not have a log or tracking for the routine laboratory test results. Unless the laboratory test was ordered as STAT (as soon as possible), then the laboratory staff would document on the paper laboratory result form which license nurse they had called and spoken to at the unit.

During an interview with the Chief Nursing Officer (CNO) on April 29, 2016 at 11:45 AM, she confirmed there was no facility policy and procedure specific to noting and transcribing written physician orders on "paper forms." CNO also confirmed there was no education provided to the licensed staff member on noting and transcribing written physician orders on "paper forms."

A review of the facility's policy and procedure titled "Record COntent," dated 5/13, it stipulated, "POLICY: To establish the content of hospital medical records...PROCEDURE: ALL Inpatient and/or Same Day Surgery/Medical patient records shall contain the following:...1.8 results of diagnostic studies performed...1.8.2. Laboratory..."