NHC Healthcare - Lexington, DAB CR5177 (2018)

DECISION

I sustain the determination of the Centers for Medicare & Medicaid Services (CMS) to impose a $10,000 per-instance civil money penalty against Petitioner, NHC Healthcare ‑ Lexington, a skilled nursing facility.

I. Background

Neither Petitioner nor CMS filed requests to cross-examine witnesses.  I decide this case based on the parties’ written exchanges.

CMS filed a pre-hearing brief and eight proposed exhibits that it identified as CMS Ex. 1-CMS Ex. 8.  Petitioner filed a pre-hearing brief (Petitioner’s brief) and nine proposed exhibits that it identified as NHC Ex. 1-NHC Ex. 9.  Neither party objected to my receiving its adversary’s exhibits.  I receive all of the proposed exhibits into the record.

Page 2

II. Issues, Findings of Fact and Conclusions of Law

A.  Issues

The issues are whether Petitioner failed to comply substantially with a Medicare participation requirement or requirements and whether a per-instance civil money penalty of $10,000 is reasonable.

B.  Findings of Fact and Conclusions of Law

CMS alleges that Petitioner failed to comply substantially in three respects with two Medicare participation requirements stated at 42 C.F.R. §§ 483.10(h) and 483.12.  The first of these regulations mandates that skilled nursing facility residents have a right to personal privacy.  The second regulation directs that residents be free from physical and mental abuse.  This anti-abuse regulation also requires a facility to develop and implement policies to protect a resident against abuse and to report to relevant state authorities any incidents of suspected abuse that are brought to its management’s attention.  42 C.F.R. § 483.12(b), (c).

CMS asserts that Petitioner violated the privacy regulation because one of its staff, a certified nursing assistant, photographed a resident’s bare buttocks while the nursing assistant was performing incontinence care on the resident, and posted the photograph on social media with a demeaning caption, without the resident’s consent.  CMS contends that these actions by the nursing assistant constituted emotional abuse.  Moreover, it asserts that, when the nursing assistant’s acts were brought to the attention of Petitioner’s management, Petitioner failed to promptly report them to state authorities in contravention of regulatory requirements and Petitioner’s own policy.

CMS argues that any one of these asserted deficiencies supports the $10,000 per-instance civil money penalty that it determined to impose.

Stated concisely, the facts are as follows.  The resident whose care is at issue was admitted to Petitioner’s facility in April 2017 after having suffered a severe stroke that left her without movement and sensation on the left side of her body.  CMS Ex. 6 at 1.  The resident, although physically impaired and suffering from anxiety, episodes of panic, and depression, was alert and oriented and motivated to improve and be discharged from the facility.  Id. at 1-4.  The resident expressly denied authorization to Petitioner to show photographs or audio recordings of her to its staff or to the general public on Petitioner’s Facebook page.  Id. at 16.

In the course of providing incontinence care to the resident, a nursing assistant took a photograph of the resident’s bare buttocks without obtaining the resident’s permission.  CMS Ex. 1 at 8-9; CMS Ex. 4 at 3.  Subsequently, this image was posted on social media,

Page 3

apparently by a friend of the nursing assistant, with a caption reading:  “What kind of butt U call that,” followed by several smiley face emojis.The record does not reveal the date(s) when the photograph was taken or posted.  A second certified nursing assistant was in the room when the photograph was taken but failed to report it to Petitioner’s management.  CMS Ex. 1 at 5-6, 8-9; CMS Ex. 4 at 3; CMS Ex. 7 at 4.

A student at a technical college saw the photograph and caption on social media and reported it to a nursing instructor.  CMS Ex. 1 at 5.  On October 18, 2017, the nursing instructor sent an e-mail to Petitioner reporting the incident and attaching three photographs.  CMS Ex. 1 at 15-16; CMS Ex. 7.  The information that the nursing instructor sent to Petitioner on October 18 included a screen shot of the nursing assistant’s Facebook page, identifying Petitioner as her employer.  CMS Ex. 1 at 15-16; CMS Ex. 7 at 2.  Upon learning of the photograph and its publication, Petitioner’s management fired the nursing assistant who took the photograph and the nursing assistant who failed to report the incident.  CMS Ex. 4 at 3.

Petitioner did not report the incident to relevant state authorities until October 20, 2017.  CMS Ex. 1 at 11; CMS Ex. 4 at 1. 

Petitioner has an abuse policy that prohibits its staff from taking, keeping, or using photographs in any manner that would demean or humiliate a resident.  CMS Ex. 1 at 16.  That policy also requires the staff to report to management any direct or indirect knowledge of an event that might constitute abuse, within two hours of learning about that event.  Id.

These facts strongly support CMS’s allegations of noncompliance.  It goes without saying that photographing the bare buttocks of a resident and posting that photograph on social media (or sharing the image with a friend who posts the image) with a demeaning caption is a gross invasion of that resident’s privacy.  It is also abusive, because it subjects the resident to possible scorn or humiliation.  The facts also show that Petitioner failed to implement its anti-abuse policies in that it did not report timely to state authorities the allegations of abuse when they were brought to its management’s attention (a facility must report any incident of suspected abuse to relevant authorities within 24 hours of learning about that incident, 42 C.F.R. § 483.12(b), (c)).

Petitioner largely does not dispute the facts as I have found them.  It raises legal arguments, contending that it should not be subject to the penalty that CMS determined to impose.  I find these arguments to be without merit.

First, Petitioner asserts that it was at all times in compliance with Medicare participation requirements.  Petitioner’s brief at 5-7.  It describes at length the policies and protocols that it implemented in order to prevent the kind of misconduct engaged in by its nursing

Page 4

assistants.  Id.  It contends that its management was completely unaware of the incident until it was subsequently brought to management’s attention and then, management acted immediately to rectify the situation by firing the nursing assistants who were involved and reported the abuse allegations to state authorities.  Id.  It contends that it should be found to have been compliant with regulatory requirements because of its implementation of robust policies intended to protect residents’ privacy and to protect against abuse of residents.

I do not question the existence of the policies and protocols that Petitioner describes, nor do I doubt that Petitioner’s management was unaware of the nursing assistants’ conduct until it was subsequently brought to management’s attention.  But the presence of these policies and management’s ignorance do not gainsay the fact that egregious noncompliance occurred.  The incident occurred despite Petitioner’s policies and protocols.  The reasonable inference is that members of Petitioner’s staff, having been trained, chose to ignore that training.  That is a failure of policy for which Petitioner is liable.

Petitioner argues, however, that a rogue employee or employees are the perpetrators and that it should not be held liable for actions that are outside of the scope of the employees’ duties.  Petitioner’s brief at 9.  I agree that the job descriptions of the nursing assistants certainly did not encompass invading a resident’s privacy and demeaning that resident by taking an unauthorized photograph and publicizing it on social media with a humiliating caption.  Nor did the job description encompass failure to report an incident that should have been reported immediately.  But, that does not allow Petitioner to avoid liability.  By definition, abuse and invasion of privacy aren’t actions that are within the scope of employees’ normal duties.  But, abuse and invasion of privacy are explicitly prohibited by regulations governing skilled nursing facilities’ participation in Medicare.  Such actions are remediable even if not within the scope of facility staffs’ duties.

In fact, nearly all noncompliance with Medicare participation requirements ultimately emanates from employees’ actions.  In a skilled nursing facility, staff provides literally every act of care.  A facility participates in Medicare only by virtue of its staff’s actions.  Consequently, actions by employees that contravene regulatory requirements – even actions by “rogue” employees – are actions for which a skilled nursing facility bears responsibility.  The regulations governing participation would be meaningless if that were not so.  Springhill Senior Residence, DAB No. 2513 at 13-14 (2013); North Carolina State Veterans Nursing Home, Salisbury, DAB No. 2256 at 10-12 (2009); Life Care Ctr. of Gwinnett, DAB No. 2240 at 12-13 (2009).

Petitioner argues that the scope and severity level of its noncompliance initially assessed by the State survey agency inappropriately charges Petitioner with having caused actual harm to its residents.  It contends that the scope and severity of its noncompliance must be reduced.  As support for this argument, Petitioner asserts that the state agency reduced

Page 5

the scope and severity determination after Petitioner participated in an independent dispute resolution proceeding at the state level, although CMS subsequently reinstated the original determination.  Petitioner’s brief at 7.

I find this argument to be outside of the ambit of my authority to hear and decide issues, and I do not address it.  Ordinarily, the scope and severity findings attaching to findings of noncompliance are not reviewable.  NMS Healthcare of Hagerstown, DAB No. 2603 at 6-7 (2014).There are exceptions to this rule that do not apply here. Scope and severity findings may be reviewable where there is a finding of immediate jeopardy level noncompliance or where imposition of a remedy causes a facility to lose authority to conduct nurse aide competency training. 42 C.F.R. § 498.3(b)(14) and (d)(10)(i),(ii).  As I shall discuss, the per-instance civil money penalty that CMS determined to impose is justified by regulatory criteria that do not depend on findings of scope and severity.

Petitioner asserts that it timely reported the allegations of abuse and invasion of privacy once it learned about them.  Petitioner’s brief at 8.  It acknowledges that its management waited two days – from October 18 until October 20, 2017 – before reporting the abusive publication of the photograph to relevant state authorities.  Id.  It argues, however, that its management first received a report about the photograph and its publication from an individual who was not affiliated with Petitioner.  It contends that its management did not know whether the photograph was actually taken at its facility and whether the picture involved one of its residents.  It wasn’t until October 19, according to Petitioner, that its management was able to ascertain the facts surrounding the photograph.  Id.  It argues that it should not be held to a requirement to report possible abuse before it verifies that its staff and premises were actually involved in a reported incident.

Petitioner’s argument notwithstanding, Petitioner’s failure to promptly report possible abuse upon receiving allegations from the nursing instructor violated regulatory requirements.  First, Petitioner’s own policy required it to report allegations “immediately, but not later than 2 hours” after receiving allegations or not later than 24 hours if the allegations do not involve abuse or result in serious bodily injury.  CMS Ex. 1 at 10-11.  That statement is consistent with regulatory requirements governing abuse reporting.  42 C.F.R. § 483.12(c).  The reporting requirements – either as stated in Petitioner’s own policy or in the regulations – do not hinge on the source of allegations of abuse.  Nor is the deadline for reporting allegations held in suspense while a facility verifies the allegations.  There is an absolute requirement in the regulation that a facility report allegations even if it has not verified their accuracy.

This requirement is critical to protecting the welfare of facility residents.  The purpose of the reporting requirement is to ensure that an independent entity be apprised of abuse allegations and has the opportunity to investigate those allegations even before the

Page 6

facility resolves them.  I take notice that, historically, not all skilled nursing facilities have been forthcoming about abuse allegations.  Allegations of abuse certainly can affect a facility’s reputation and its profits.  For that reason, there is incentive for unscrupulous facilities to sweep such allegations under the rug, leaving abuse unremedied and leaving residents exposed to additional abuse.  Strict reporting requirements provide some assurance that this will not happen.  Those requirements apply to all skilled nursing facilities, even those that act in good faith to address allegations of abuse.

I note, furthermore, that the evidence belies Petitioner’s assertion that its management did not know until October 19, 2017, that the allegations concerning the photograph involved its premises and its resident.  The nursing instructor who reported the incident sent Petitioner an e-mail attachment on October 18, 2017, including a screenshot of the culpable nursing assistant’s Facebook page.  That information established that Petitioner employed the nursing assistant.  CMS Ex. 1 at 15-16; CMS Ex. 7 at 2.  Thus, Petitioner knew on October 18 that this was an incident involving its staff and its resident.

The civil money penalty that CMS determined to impose is a per-instance civil money penalty of $10,000.  CMS may impose a per-instance penalty for each regulatory violation.  Authority exists to impose a penalty here based on Petitioner’s noncompliance with even a single regulation.  Authority to impose a per-instance penalty in this case therefore exists even if Petitioner is liable for only one regulatory violation.

Petitioner did not contest the penalty amount aside from asserting that any penalty is unreasonable.  I find that the penalty in this case is not only authorized but is reasonable as well.

The penalty amount of $10,000 is within the range of civil money penalties authorized for per-instance noncompliance.  42 C.F.R. § 488.430(a).  There are regulatory criteria that must be used to evaluate the reasonableness of a penalty falling within an authorized range.  These criteria, stated at 42 C.F.R. §§ 488.438(f)(1)-(4) and 488.404 (incorporated by reference into 42 C.F.R. § 488.438(f)(3)), allow a penalty amount to be justified by factors that include the seriousness of a facility’s noncompliance.

I find that the seriousness of Petitioner’s noncompliance certainly justified the penalty amount.  The potential exists for serious and perhaps irreparable harm to any resident humiliated by the type of conduct that took place here.  The resident in question, for example, had suffered the effects of a terrible stroke that left her incapable of using the left side of her body.  Her residence at Petitioner’s facility was not her choice but was the inescapable consequence of her incapacitation.  She was anxious and depressed, and her emotional state clearly was fragile.  One can easily imagine the personally devastating consequences that would have resulted had the publicized photograph been connected to her.  That it was not is fortuitous, but Petitioner’s good fortune doesn’t gainsay the potential for harm in this case.

Page 7

In finding the penalty amount to be reasonable, I have taken into account that the incident occurred despite Petitioner’s anti-abuse policies and the training that it provided to its employees.  The fact that Petitioner had “robust” policies in place does not serve as a basis for reducing the penalty amount.  Petitioner had a duty to assure that an incident such as the type that occurred here did not occur.  That such an incident did occur is proof that Petitioner’s policies were, in the final analysis, inadequate.