Resident #32 told federal inspectors on December 20 that when staff gave report to one another, she could hear other residents' health information. She understood what protected health information included, she explained, because of her nursing background.
She wasn't alone. Two other residents with intact mental capacity reported the same problem during a resident council meeting four days earlier.
Resident #68 told the December 16 meeting that he knew diagnoses and medications of other residents because he overheard nurses and nurse aides talking. He said he had been accused of knowing too much about other patients' conditions. When he told staff their conversations violated federal privacy laws, nothing changed.
Resident #27 also spoke up during the meeting. She knew medical information about other residents, including some of their medications, from overhearing staff discussions.
All three residents scored 14 or 15 on cognitive assessments, indicating intact mental function and reliable testimony about what they witnessed.
The privacy breaches occurred during shift reports at nurses stations throughout the 92-bed facility. Licensed Practical Nurse #3 confirmed the obvious when inspectors interviewed her on December 20: shift report happened at the nurses' station, and she was sure residents overheard protected health information.
"She knew it was a HIPAA violation all day long," according to the inspection report.
The facility's Director of Nursing acknowledged that nurses completed shift reports at nurses stations but claimed each station had an office area or medication room for private meetings. She said she wouldn't have expected nurses to discuss residents' illnesses or medications where others could overhear.
If other residents' information was overheard, she admitted, it was a HIPAA violation.
The Administrator echoed similar expectations when interviewed December 21, stating she expected staff to keep medical information confidential.
Their expectations didn't match reality on the nursing floors.
The facility's own policy, titled "Dignity" and revised in February 2021, specifically required staff to protect confidential clinical information. The policy included clear examples: verbal staff-to-staff communication, such as change of shift reports, must be conducted outside the hearing range of residents and the public.
Yet residents continued overhearing private medical discussions about their neighbors' diagnoses, medications, and health conditions during routine shift changes.
The violation affected all 92 residents at the facility, according to federal inspectors. Anyone receiving care at ARC at Cincinnati faced the potential for their private health information to be disclosed to other residents during nursing shift reports.
Resident #68's complaint to staff about HIPAA violations went unheeded. His knowledge of other residents' medical conditions continued growing as nurses and aides discussed patient information within earshot of his room.
The former nurse, Resident #32, recognized the legal implications immediately. Her professional background made clear what many residents might not understand: federal law strictly prohibits the disclosure of protected health information to unauthorized individuals.
Resident #27's awareness of other patients' medications demonstrated how detailed the overheard information had become. These weren't vague references to medical care, but specific knowledge about prescription drugs and health conditions affecting her neighbors.
The Licensed Practical Nurse's admission that she knew the conversations violated HIPAA "all day long" revealed staff awareness of the problem. Despite knowing federal privacy laws were being broken during every shift change, the practice continued.
The Director of Nursing's claim about available private spaces highlighted the gap between policy and practice. While the facility may have had offices or medication rooms for confidential discussions, staff weren't using them for shift reports containing sensitive patient information.
Federal inspectors cited the facility for failing to ensure staff provided verbal reports in a manner that protected residents' health information. The violation stemmed from a complaint investigation, suggesting residents or families had formally reported the privacy breaches.
The citation carried minimal harm designation but affected the entire facility population. Every resident at ARC at Cincinnati faced potential disclosure of their private medical information during routine nursing operations.
Three residents with intact cognition had become unwilling repositories of their neighbors' medical secrets, overhearing diagnoses and medications that federal law requires be kept confidential. Their complaints to staff and facility leadership had produced no changes to the practice that violated their neighbors' privacy daily.
Full Inspection Report
The details above represent a summary of key findings. View the complete inspection report for Arc At Cincinnati from 2025-12-23 including all violations, facility responses, and corrective action plans.