PITTSBURGH, PA — Federal health inspectors found Highland Hills Post Acute failed to protect the confidentiality of residents' personal and medical records during a complaint investigation concluded on December 30, 2025. The facility was cited for 4 total deficiencies, including a violation of federal privacy protections under regulatory tag F0583.
Confidential Records Left Unprotected
The inspection, triggered by a formal complaint, determined that Highland Hills Post Acute did not adequately keep residents' personal and medical records private and confidential. Under federal nursing home regulations, facilities are required to maintain strict safeguards over all resident information, including diagnoses, treatment plans, medication lists, and personal identifying details.
The privacy deficiency was classified as Scope/Severity Level D, meaning it was isolated in nature and did not result in documented actual harm. However, inspectors determined there was potential for more than minimal harm to residents — a designation that signals real risk, not merely a procedural technicality.
Federal regulations under 42 CFR §483.10(h) are explicit: nursing home residents have the right to personal privacy and confidentiality of their personal and medical records. This includes the right to approve or refuse the release of records to any individual outside the facility, except when required by law or third-party payment contracts.
Why Medical Record Privacy Matters in Long-Term Care
Breaches of medical record confidentiality in nursing homes carry consequences that extend well beyond paperwork failures. When protected health information is exposed — whether through improper storage, unauthorized access, or careless handling — residents face tangible risks.
Exposed medical records can reveal psychiatric diagnoses, substance abuse history, HIV status, and other sensitive conditions that residents may not want shared with other residents, visitors, or even certain staff members. For residents with cognitive impairment who cannot advocate for themselves, these protections are especially critical.
A privacy breach can also lead to discrimination, emotional distress, and erosion of trust between residents and the facility staff they depend on for daily care. When residents or their families lose confidence that sensitive information is being handled properly, they may withhold important health details from caregivers — a dynamic that can directly compromise the quality of medical treatment.
Under HIPAA and corresponding federal nursing home standards, facilities must implement administrative, physical, and technical safeguards. These include restricting access to records to authorized personnel only, securing physical charts in locked areas, and ensuring electronic health records have proper access controls and audit trails.
Four Deficiencies Signal Broader Compliance Concerns
While the privacy violation drew specific attention, it was one of four deficiencies identified during the complaint investigation. Multiple citations during a single inspection often indicate systemic issues with facility oversight, staff training, or administrative protocols rather than a single isolated lapse.
The complaint-driven nature of this inspection is also notable. Unlike routine annual surveys, complaint investigations are initiated when specific concerns are reported to state or federal regulators — meaning someone identified a problem serious enough to warrant formal review.
Highland Hills Post Acute reported correcting the deficiency as of January 28, 2026, approximately four weeks after the inspection. The facility's compliance plan would typically need to include staff retraining on privacy protocols, updated policies for record handling, and verification measures to prevent recurrence.
Industry Standards for Record Protection
Properly run nursing facilities maintain multiple layers of protection for resident records. Physical charts are stored in secured areas accessible only to authorized clinical staff. Electronic records require individual login credentials with role-based access permissions. Staff receive regular training on privacy obligations, and facilities conduct periodic audits to detect unauthorized access.
When deficiencies are identified, best practice calls for a root cause analysis — determining whether the breach resulted from a single staff member's error, a gap in training, or a systemic failure in the facility's privacy infrastructure. The corrective action should address the underlying cause, not merely the specific incident identified by inspectors.
Families with loved ones at Highland Hills Post Acute may wish to review the full inspection report, available through the Centers for Medicare & Medicaid Services' [Care Compare](https://www.medicare.gov/care-compare/) database, for complete details on all four deficiencies cited during this investigation.
Full Inspection Report
The details above represent a summary of key findings. View the complete inspection report for Highland Hills Post Acute from 2025-12-30 including all violations, facility responses, and corrective action plans.