The privacy breach centered on the facility's rehabilitation program coordination. When residents needed specialized restorative nursing care, staff would send group text messages to personal phones with patient identifiers and care details.
A restorative nursing assistant told inspectors on September 11 that she regularly received text messages on her personal cell phone from the rehabilitation department. The messages included resident names and room numbers for patients who needed to join the specialized RNA program.
The physical therapist confirmed the practice during a separate interview the same morning. When residents required restorative nursing assistance, the therapist would send group text messages to multiple staff members' personal phones. Recipients included the director of rehabilitation, physical therapist, occupational therapist, director of staff development, and the restorative nursing assistant.
These messages contained resident names, room numbers, and specific details about which RNA program each patient needed. The physical therapist explained the purpose was "for the group to know that there is an RNA program for the resident."
The breach extended beyond the rehabilitation team. A certified nursing assistant told inspectors she received text messages on her personal phone that included resident names, required care details, and room numbers.
When confronted about the practice, the facility's director of nursing acknowledged the violation. "Personal phones should not be used when the patients' name and room number are included," the director stated during an afternoon interview on September 11. She added that staff should not "transmit resident information to staff personal phone" due to HIPAA privacy protections.
The facility's own policies prohibited exactly what was happening. Kennedy Care Center's employee cell phone policy, reviewed in April, allowed personal phone use only during meal and break periods, with devices required to remain off or silent during all other work hours.
More significantly, the facility maintained a detailed privacy policy acknowledging its obligation to protect resident health information. The policy stated that Kennedy Care Center "complies with the laws governing privacy, security, and breach notification of protected health information set forth in the Health Insurance Portability and Accountability Act and other privacy and security rules."
The same policy indicated that "personnel are trained in the policies and practices that protect the privacy, confidentiality and security of resident-identifiable information throughout the facility."
Despite these written protections, multiple staff members across different departments were routinely sending protected health information to personal devices that fall outside the facility's security controls.
Personal cell phones present particular privacy risks in healthcare settings. Unlike facility-controlled communication systems, personal devices may lack encryption, could be accessed by family members or friends, and create permanent digital records of patient information in uncontrolled environments.
The group text messaging system meant that sensitive patient information was distributed to multiple personal devices simultaneously, multiplying the potential exposure points for each resident's private health details.
Federal inspectors classified the violation as having "minimal harm or potential for actual harm" but noted it affected "few" residents. However, the systemic nature of the texting practice suggests the privacy breach was ongoing and widespread among rehabilitation staff.
The violation represents a fundamental breakdown in the facility's information security protocols. While staff claimed the text messages served a legitimate care coordination purpose, federal privacy laws require healthcare facilities to use secure, controlled communication methods when transmitting patient information.
Kennedy Care Center's practice of sending resident identifiers to personal phones violated basic HIPAA requirements that healthcare providers implement administrative, physical, and technical safeguards to protect patient information from unauthorized access or disclosure.
The inspection occurred following a complaint, suggesting someone reported concerns about the facility's privacy practices to state regulators. The violation was documented on September 12, 2025, following interviews with multiple staff members who confirmed the ongoing practice.
Full Inspection Report
The details above represent a summary of key findings. View the complete inspection report for Kennedy Care Center from 2025-09-12 including all violations, facility responses, and corrective action plans.