G1028: Protection Of Records
CMS level: Standard Moderate. On this site, a condition-level citation is labeled Serious, a standard-level citation Moderate, and an element-level citation Minor. What the labels mean · How to choose an agency
Data from CMS inspection reports (Form 2567), 2018-01-02 to 2026-10-15, downloaded 2026-10-21; CMS agency list file dated 2026-09-21. CMS source file. What the labels mean
Where it was cited
- California39
- Nevada36
- Indiana35
- Michigan17
- Iowa4
- Illinois4
- New Mexico4
- Oklahoma3
- Texas3
- West Virginia3
- Alabama2
- Arizona2
- Florida2
- Missouri2
- Montana2
- Pennsylvania2
- Virginia2
- Wyoming2
- Connecticut1
- Idaho1
- Maine1
- Minnesota1
- Nebraska1
- New Hampshire1
- Ohio1
- Puerto Rico1
- Rhode Island1
- South Carolina1
- Utah1
Most recent citations
The 20 most recent of 175 citations. Newest inspection first.
Dina Sova Home Health Care, Inc.
The Home Health Agency (HHA – an organization that delivers skilled nursing and other therapeutic services to a patient's personal residence) failed to ensure that two of seven sample patients (Patient 6 and Patient 7) clinical records were secured and confidential information are protected.
Medlife Homecare Inc
The agency failed to ensure 2 (P-1 and P-2) of 2 patients' information was properly stored and safeguarded, resulting in the potential for unauthorized use of patient information.
Adoration Home Health
The agency failed to ensure the Information Security Department provided the State surveyors with access to the Electronic Health Records (EHR) in a timely fashion as requested.
Tiffco CARE2 LLC
No longer in CMS listThe agency failed to ensure the patient’s clinical records were protected against loss for 1 of 1 home health agencies.
Gibraltar Home Health Services LLC
Therapeutic services and aide services directly to patients in their homes) failed to ensure patient care records were safeguarded against unauthorized use for four of ten sampled patients (Patient 6, Patient 7, Patient 9, and Patient 10).
Ready and Willing 2 Help Healthcare LLC
No longer in CMS listThe agency failed to ensure access controls preventing unauthorized access to patient records and failed to automatically terminate access to a former employee, allowing deletion of patient records and unauthorized access for 1 of 1 agency.
Interim Health Care of Morgantown
The agency failed to ensure the Information Security Department provided the State surveyors with access to the Electronic Health Records (EHR) in a timely fashion as requested.
Dependable Healthcare Services LLC
This Element is NOT MET as evidenced by: Based on record review and staff interview, it has been determined the Agency failed to develop, implement, and maintain policies and procedures specific to the way in which patient records are protected for loss, theft, or unauthorized use.
Eprimetec Health Services
The agency failed to protect the clinical records - its contents and the patient information contained therein- for 1 of 1 discharged patients (patient #1), from loss or unauthorized use in the office setting in that the agency provided the clinical records of 1 of 1 discharged patients to a…
Servant's Heart Home Health Services, Inc
No longer in CMS listThe agency failed to keep clinical records secured when not in use for 2 of 2 locations with paper clinical records and failed to protect patient information while in patients’ homes for 2 of 4 home visit observations (Patients #1 ,2).
Intense Home Health Inc
The Home Health Agency (HHA) failed to ensure patient health records were safeguarded for seven of seven sampled patients (Patient 1, Patient 2, Patient 3, Patient 4, Patient 5, Patient 6, and Patient 7).
Excelacare Home Health
The Home Health Agency (HHA) failed to monitor, manage, and maintain the equipment used to access the web-based electronic medical record (EMR).
Legacy Home Health, Inc
The facility failed to ensure patients clinical records were stored in locked, waterproof file cabinets in a designated clinical records room in accordance with the facility’s policies and procedure.
Simple Touch Home Health Care, Inc
No longer in CMS listThe Home Health Agency failed to ensure the safeguarding of clinical records against unauthorized access or loss for five of five sampled patients (Patient 8, Patient 9, Patient 10, Patient 11, and Patient 12).
Activ-Care Home Health Services, Inc
The agency failed to ensure patient's protected health information was appropriately stored and safeguarded, resulting in the potential for unauthorized use.
Green Valley Home Health Services, Inc
The facility failed to ensure patients clinical records are stored in a locked, waterproof file cabinet in a designated clinical record room in accordance with the facility’s policies and procedures.
Sweetgrace Home Health Services, LLC
The facility failed to ensure patients clinical records are stored in a locked, waterproof file cabinet in a designated clinical record room in accordance with the facility’s policies and procedures.
Good Shepherd Home Health Services
The Home Health Agency (HHA) failed to monitor, manage, and maintain the equipment used to access the web-based electronic medical record (EMR).
Holistic Home Care Home Health, LLC
The agency failed to ensure paper clinical records were securely stored for all patients.
Bridges Home Health, Inc
The hospice must be in compliance with the Department's rules regarding personal health information as set out at 45 CFR parts 160 and 164. This STANDARD is NOT MET as evidenced by: Based on interview, review of facility policies and procedures and review of medical records, the Department has…