Group Practice Tech

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we chat with Dr. Kristen Allott about how mental health providers can support client well-being by looking at the foundational aspects of wellness.

We discuss:

• How mental health is impacted when the power supply for the body (food, sleep, exercise, breathing) isn't adequate
• Our primary attachment being to our body
• The impact of adrenaline in the body, and how that impacts folks with complex trauma, especially if they don't eat regularly
• How understanding wellness and the nervous system can help mental health professionals serve clients better
• The toolkit Dr. Allott would provide for every mental health practitioner
• Therapist wellness and why therapist burnout is so severe
• Self-care vs. self-neglect
• Dr. Allott's upcoming training on GLP-1s and mental health with PCT
• Why therapists are uniquely situated to provide care for people managing the effects of GLP-1 medications

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Live (and recorded) CE training: GLP-1s: Mental Health, Addiction, and Disordered Eating — What Therapists Need to Know
  • Join Dr. Kristen Allott, ND LAc, for this three-credit-hour training, presented live on October 30, 2026, with on-demand self-study CE course access also included. This training will help therapists understand how GLP-1 medications may be supporting or compromising a client's well-being and provide a framework for navigating client conversations, setting realistic expectations, and "tipping the scales" toward safety and efficacy — all while remaining within their scope of practice.

• To learn more about Dr. Kristen Allott, visit KristenAllott.com. The homepage links to all of her free handouts and videos, which you can share with your clients.
• You can also sign up for the Dynamic Brains Learning Collective, a free monthly virtual meeting where you can ask Dr. Allott your questions and she dives deeply into hot topics.
• You can learn more about her workbook, Fuel Your Brain, Not Your Anxiety, which walks you through the steps she uses to identify the physical causes of mental health challenges.
• Be sure to follow Dr. Allott on social media:
  • Instagram: @KristenAllott
  • Facebook: @DynamicPaths
• Finally, a quick note: Dr. Allott can only see individuals as patients if they live in Washington state. However, she is available to be contracted as a consultant for mental health professionals who want to engage more deeply with their clients and care for the whole body. She is also available for individualized seminars.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we're discussing a topic that's come up frequently in the wake of the Clancy case: mandated reporting.

We cover:

• Misconceptions around mandated reporting
• Mandatory reporting vs. other legal and ethical duties that apply
• What a clinician needs to evaluate when there is concern harm may occur
• Permission to disclose vs. duty to protect
• Tarasoff duties and liabilities
• Determining what is required and what is permitted under applicable law
• The framework that Eric Strom and Liath presented in the related CE course to determine what to do in these situations

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• On-demand CE course: "I Have to Report This, Right?" Law and Ethics of Mandatory Reporting, Tarasoff Liability, and the Limits of Confidentiality
  • When a client reveals possible abuse or a risk of harm, how do you determine whether a report is required, a disclosure is permitted, or another protective action is needed? In this three-hour legal-ethical CE course (APA and NBCC approved,) attorney and clinician Eric Ström and PCT's Liath Dalton work through these distinctions and their implications, real-world scenarios, differing state laws, and the decisions clinicians face when confidentiality and safety intersect. The course includes the PAUSE framework and worksheet to help you reach and document a proportionate, client-centered response.
    • "This was one of the better, more involved and detailed CE's I have ever attended"
    • "After working 40 years as a therapist, and 25+ of those years in private practice, this is the FIRST time 'Tarasoff' (its hx and utility) was made clear!"
• On-demand CE course: Legal-Ethical Cross-Jurisdictional Telemental Health in 2026
  • For clinicians practicing across state or national borders, this course examines how client location, clinician location, and licensure jurisdictions can affect confidentiality, mandatory reporting, emergency response, and other obligations.
  • 3 legal-ethical CE credit hours. APA and NBCC approved.
• Direct Support and Consultation:
  • Group Practice Care Premium — For group practice leaders who want support as questions arise, Premium includes weekly live and recorded Group Practice Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC.
  • Solo Practice Care Premium — For solo clinicians who want support as practice questions arise, Premium includes weekly live and recorded Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC.

• HHS: HIPAA Privacy Rule and Sharing Information Related to Mental Health — Guidance on when HIPAA permits mental health information to be shared, including circumstances involving safety concerns.
• HHS: Disclosure When a Patient Presents a Serious Danger — Explains HIPAA's permission to disclose information to someone reasonably able to prevent or lessen a serious and imminent threat, when the applicable conditions are met.
• Child Welfare Information Gateway: Mandatory Reporting of Child Abuse and Neglect — An overview of reporting requirements and how they vary across states.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation.

We discuss:

• Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles
• Opportunistic vs. forced TLS
• Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace
• What HIPAA actually requires for email security
• Where NIST (National Institute for Standards of Technology) guidance fits in
• The actual risk analysis for legacy TLS
• Benefits of secure email services, and when it might make sense to cancel
• Data to gather from your secure email service to do your own risk analysis

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Episode 623: Now You Can Secure Outbound Email in Google Workspace
• Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management.
• PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know
  • PCT's detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate.
• PCT's Free Google Workspace Configuration Help Center
  • Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS.
• PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice
• PCT's framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context.
• HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks.
• PCT's Comprehensive HIPAA Security Compliance Program bundles:
  • For Group Practices
  • For Solo Practitioners
  • Comprehensive HIPAA Security Policies & Procedures
  • Forms and logs for documenting the implementation and maintenance of Policies & Procedures
  • Device & Workspace Security Suites
  • Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC
  • HIPAA Risk Analysis & Risk Mitigation Planning service and tool
  • HIPAA Security & Privacy Ethics training
• Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources.

• 45 C.F.R. § 164.312 — HIPAA Security Rule Technical Safeguards
  • The regulation itself, including the Transmission Security standard at § 164.312(e).
• HHS: Are Covered Entities Required to Use NIST Guidance Documents?
  • HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule.
• HHS: Is the Use of Encryption Mandatory in the Security Rule?
  • HHS explains the Security Rule's risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards.
• Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections
  • Google's current documentation on Gmail's support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable.
• NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations
  • NIST's technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we go over some common questions we get at PCT about the HIPAA designated Security Officer role.

We discuss:

• The primary purpose of the Security Officer's role
• What is actually required of the person in this role
• Determining the right person for this role in your practice
• Tasks that can be passed off to a Deputy Security Officer
• Operational structure for Security Officers and Deputy Security Officers
• Whether the Security Officer or Deputy Security Officer hold individual liability in the event of a breach

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks.
• PCT's Comprehensive HIPAA Security Compliance Program bundles:
  • For Group Practices
  • For Solo Practitioners
  • Comprehensive HIPAA Security Policies & Procedures
  • Forms and logs for documenting the implementation and maintenance of Policies & Procedures
  • Device & Workspace Security Suites
  • Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC
  • HIPAA Risk Analysis & Risk Mitigation Planning service and tool
  • HIPAA Security & Privacy Ethics training
• PCT's Security Officer Endorsement Program – A foundational training for anyone who finds themself in the Security Officer role, including 10 CEs across three separate trainings.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we recap what behavioral health practice owners should know from day one of the HIPAA Security Conference.

We discuss:

• The timeline for proposed Security Rule changes
• What practices must have documented in writing according to the current Security Rule
• Encryption being reasonable and appropriate in almost every practice environment
• Expanding risk analysis enforcement initiative to include risk management
• Why risk analyses are foundational, and what they have to include that a gap analysis doesn't

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks.
• PCT's Comprehensive HIPAA Security Compliance Program bundles:
  • For Group Practices
  • For Solo Practitioners
  • Comprehensive HIPAA Security Policies & Procedures
  • Forms and logs for documenting the implementation and maintenance of Policies & Procedures
  • Device & Workspace Security Suites
  • Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC
  • HIPAA Risk Analysis & Risk Mitigation Planning service and tool
  • HIPAA Security & Privacy Ethics training
• Episode 618: HIPAA Security Rule Update—What We Know, What We Don't, and What You Should Do Right Now — Our previous update on the proposed HIPAA Security Rule changes, the regulatory uncertainty surrounding them, and why practices should continue strengthening their security under the current rule while the rulemaking process unfolds.
• Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources.

• HIPAA Security Rule Notice of Proposed Rulemaking Fact Sheet — The Office for Civil Rights' summary of the proposed Security Rule modifications, including greater specificity for Risk Analysis, written documentation requirements, defined compliance intervals, and proposed changes to "addressable" implementation specifications.
• Unified Agenda Entry for the HIPAA Security Rule — The current federal regulatory agenda lists the rulemaking as a long-term action with final action anticipated in July 2027. This is a planning estimate rather than a legal deadline or guaranteed publication date.
• HHS OCR Guidance on Risk Analysis — Official guidance explaining the required scope and elements of a HIPAA Security Risk Analysis, why "addressable" does not mean optional, and how Risk Analysis provides the foundation for an organization's risk-management decisions.
• HHS OCR Security Rule Guidance Materials — A collection of official Security Rule resources, including OCR presentations on Risk Management and Recognized Security Practices, educational papers, and links to relevant NIST publications.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we share a HIPAA-friendly way for therapy practice owners to get useful information about how their websites are performing, via Google Search Console.

We discuss:

• What Google Search Console can tell you about your website
• The crucial differences between Google Analytics and Google Search Console
• Why Search Console is permissible for therapy practice websites
• Caveats and what to consider when configuring Search Console

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Podcast: Episode 625: Google Analytics for Therapy Practice Websites—The HIPAA Risks Explained — The companion episode explaining why Google Analytics is not appropriate for therapy-practice websites and how individually identifiable website activity can become protected health information.
• PCT CE course: Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD, PhD, LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements.
• PCT's Google Workspace Configuration Help Center — Includes step-by-step, video-based guidance for securing, configuring and leveraging Google Workspace appropriately for a therapy practice
• Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources.
• HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks.
• PCT's Comprehensive HIPAA Security Compliance Program bundles:
  • For Group Practices
  • For Solo Practitioners
  • Comprehensive HIPAA Security Policies & Procedures
  • Forms and logs for documenting the implementation and maintenance of Policies & Procedures
  • Device & Workspace Security Suites
  • Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC
  • HIPAA Risk Analysis & Risk Mitigation Planning service and tool
  • HIPAA Security & Privacy Ethics training

• Google Search Console — Google's free tool for understanding how a public website performs in Google Search, including the search terms that result in a website appearing, impressions, clicks, search position, indexing issues, and website-health information.
• Google Search Console Performance Report: Dimensions and Data Groupings — Google's explanation of the search-query, page, country, and device information available through Search Console. It also explains that some queries are omitted from reports to protect searcher privacy.
• Google Search Console: Verify Your Site Ownership — Google's instructions for verifying ownership through methods such as a DNS record or HTML file or tag. Google Analytics and Google Tag Manager are optional verification methods and do not need to be enabled to use Search Console.
• Google Search Console: Managing Owners, Users, and Permissions — Guidance for limiting Search Console access and periodically reviewing who has owner- or user-level access to a practice's website data.
• Google Search Console: Remove Information From Your Website From Google Search — Google's guidance for keeping sensitive, authenticated, or otherwise inappropriate pages out of search results and removing pages that have already been indexed.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we unpack the reasoning, step by step, behind PCT's position on Google Analytics for therapy practices.

We discuss:

• Can website activity constitute Protected Health Information?
• HIPAA's definition of healthcare operations vs. HIPAA's definition of marketing
• Business Associates, and how there is no BAA available for Google Analytics
• The disclosures required for HIPAA authorization for marketing activity
• Cases where collecting PHI without a BAA has gone awry
• The risk context in an increasingly AI world
• The takeaway: is it permissible for therapy practices to use Google Analytics on their practice websites?
• Uniting as an industry to demand BAAs for Google Analytics

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD PhD LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements.
• Group Practice Care Premium
  • weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC
  • Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)
  • Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks.
• PCT's Comprehensive HIPAA Security Compliance Program (discounted) bundles:
  • For Group Practices
  • For Solo Practitioners
    • Comprehensive HIPAA Security Policies & Procedures
    • Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice
    • Device & Workspace Security Suites
    • Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library)
    • Includes the Risk Analysis & Risk Mitigation Planning service + tool
  • HIPAA Security & Privacy Ethics training

• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — OCR's current guidance on how the HIPAA Privacy, Security, and Breach Notification Rules apply to website and app tracking technologies. It addresses when website activity may constitute PHI, tracking on authenticated and unauthenticated webpages, Business Associate Agreements, marketing disclosures, HIPAA authorization, and risk analysis.
• Google: HIPAA and Google Analytics — Google's own guidance for HIPAA-regulated organizations. Google states that regulated entities must not expose Google Analytics to PHI and that Google does not offer Business Associate Agreements for Google Analytics.
• American Hospital Association v. Becerra — June 20, 2024 Court Decision — The federal court decision that partially vacated OCR's tracking-technology guidance regarding an IP address combined with a visit to an unauthenticated health-related webpage. The decision is important for understanding what may—and may not—constitute individually identifiable health information in the context of website tracking.
• HHS: Business Associates — HHS guidance on when a person or company becomes a HIPAA Business Associate, including when a vendor performs data analysis or other functions involving PHI on behalf of a covered entity.
• HHS: Marketing and the HIPAA Privacy Rule — Guidance on HIPAA's specific definition of marketing, the exceptions to that definition, and when written individual authorization is required for uses or disclosures of PHI for marketing.
• FTC: BetterHelp Health Data and Advertising Enforcement Action — The FTC's action concerning BetterHelp's disclosure of sensitive consumer health information to third parties for advertising purposes. Importantly, this was FTC consumer privacy enforcement, not HIPAA enforcement, but it provides a real-world example of the risks associated with health-related information flowing into advertising and tracking ecosystems.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we chat with Julie Herres of GreenOak Accounting about how there's still good money to be made in private practice, and what you need to know to make it.

We discuss:

• Profitability and intentionality, and what it takes to stay on track
• Rate changes and cost of living changes impacting group practices
• How Julie would respond to practice owners who are feeling the squeeze right now
• Setting up the financials for a healthy practice
• Compensation for pre-licensed vs. fully licensed clinicians
• Julie and Liath's predictions for the trend to swing away from VC-backed therapy platforms and back to smaller group practices
• What group practices can bring to the table that these platforms can't
• Metrics to track to be able to make informed and aligned decisions in the short, medium, and long-term
• The value, in time, money, and cognitive overhead, in outsourcing to a trusted expert
• Julie's upcoming event in September for group practice owners, Group Practice Con

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Therapy for Your Money Podcast — Hosted by Julie Herres, founder and CEO of GreenOak Accounting, this podcast helps private practice owners understand their finances, improve profitability, and make confident, data-informed business decisions.
• GreenOak Accounting for Mental Health Professionals — Specialized accounting and financial guidance for therapists and mental health practices, with services designed to support solo practitioners, group practices, and practice owners navigating growth and expansion.
• Profit First for Therapists by Julie Herres — Julie's practical, therapist-specific adaptation of the Profit First framework, designed to help practice owners build profitability into their financial systems, pay themselves appropriately, and create a more sustainable practice.
• Group Practice Con 2026 (Sold Out!) — A tactical, growth-focused conference for established group practice owners, co-hosted by Julie Herres and Joshua Brummel. The 2026 event takes place September 9–11 in Chicago and is currently sold out, but practice owners can join the waitlist through the conference website.

• Group Practice Care Premium
• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC
• Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)
• Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks.
• PCT's Comprehensive HIPAA Security Compliance Program (discounted) bundles:
• For Group Practices
• For Solo Practitioners
• Comprehensive HIPAA Security Policies & Procedures
• Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice
• Device & Workspace Security Suites
• Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library)
• Includes the Risk Analysis & Risk Mitigation Planning service + tool
• HIPAA Security & Privacy Ethics training

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we have an exciting update about how to make your Google Workspace email HIPAA-secure.

We discuss:

• The encryption mechanism, TLS, and how it fits into HIPAA Security Rule standards
• Ways that behavioral health practices typically manage email security
• Escrow style email
• The transmission security standard under HIPAA
• Google's transparency report about safer email
• HIPAA-friendly conventional email vs. HIPAA secure email
• Two limitations to be aware of and a risk management and ethics perspective
• How to set up this configuration in Google Workspace

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know
  • Read PCT's complete explanation of the global routing rule, what enforced TLS changes for mental health practices, what it does and does not protect, and the steps practices should take before relying on it for email containing protected health information.
• PCT's Free Google Workspace Configuration Help Center
  • Access PCT's video tutorial demonstrating how to configure the global outbound routing rule, along with additional step-by-step guidance for configuring Google Workspace for HIPAA-compatible use.
• Office Hours for Solo Practitioners
  • Get direct consultation and ongoing support for applying HIPAA requirements to the particular needs of your practice—including email, client communication, technology selection, policies, and implementation.
• Group Practice Office Hours
  • Practice leaders can receive direct support with developing communication systems and workflows that are HIPAA-compatible, effective, efficient, and workable for the practice, its team, and its clients.
• Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice
  • Learn about PCT's framework for distinguishing among conventional email, TLS-secured email, and escrow or portal-style secure messaging—and choosing the option that fits the information, workflow, and client circumstances involved.

• Google Workspace Admin Help: Send Email Over a Secure TLS Connection
  • Google's instructions for requiring TLS when sending email to specified recipients and preventing delivery when a secure connection cannot be established.
• Google Transparency Report: Email Encryption in Transit
  • View Google's current data on the percentage of email sent and received by Gmail that is encrypted while traveling between email providers.
• HHS: Does the Security Rule Allow for Sending Electronic PHI in an Email?
  • HHS guidance explaining how the HIPAA Security Rule applies when electronic protected health information is transmitted by email.
• HHS: Does the HIPAA Privacy Rule Permit Providers to Use Email With Patients?
  • HHS guidance addressing email communication with patients, reasonable safeguards, and patients' requests to communicate through alternative means.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we debunk myths around documentation and fraud with Dr. Maelisa McCaffrey.

We discuss:

• A recent article that is causing concern about whether submitting insurance claims before notes are complete constitutes fraud
• Fraud vs. mistakes, and consequences for mistakes in billing
• What constitutes fraud under the False Claims Act, with context from Eric Ström, HIPAA and mental health law attorney and practicing clinician
• Whether there are rules about when notes are supposed to be completed
• Maelisa's research on whether "late" notes can impact audits or a fraud case
• Claims vs. superbills and what provider obligations are with superbills
• PCT's training with Maelisa on How Auditors Think
• Changing or amending notes, and what that looks like in practice
• Doing notes on paper if you struggle with overthinking your notes
• Just doing the documentation, and how you can always amend them later if needed
• Why private practice isn't for everyone, and that's okay
• How effective policies and procedures around documentation (and more) can help with hiring and retention for group practices

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• PCT CE Course (on-demand) Dealing with Insurance: How Auditors Think and Why
  • 3 CE credit hour training (including 1 legal-ethical CE hour) taught by Dr. Maelisa McCaffrey (QA Prep). This updated-and-expanded 2026 training demystifies medical necessity, clarifies what auditors and payers are actually looking for (and why), and helps clinicians document with more confidence and less stress. Includes real examples, sample note review, and practical tools you can use immediately — covering informed consent language for clients using insurance, treatment planning that supports insurance requirements without sacrificing clinical judgment, and self-auditing techniques to spot red flags before anyone else does. Includes handouts/resources such as diagnosis justification statements, common treatment goals, progress statement formulas and examples, sample progress notes, and a client file review tool.
• Special Office Hours & Group Practice Office Hours direct support and consultation session with guest expert and co-facilitator Dr. McCaffrey: August 6th, 2026. Accessible to Practice Care Premium members/subscribers.