Group Practice Tech

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we give group practice owners a heads up about upcoming changes to the HIPAA Security Rule.

We discuss what the focus of these rule changes will be; why the changes are happening; steps you can take to be proactive about HIPAA changes; and PCT's practical tools to help you get on top of things in a manageable way.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Vital Signs: Digital Health Law Update | Winter 2024 | JD Supra

• 2024 Update: Regulators Use "Carrots and Sticks" to Incentivize Healthcare Sector Cybersecurity Compliance

• 3 ways to prepare for impending HIPAA Security Rule updates

• HHS Unveils Healthcare Cybersecurity Strategy

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• PCT's Group Practice PCT Way HIPAA Compliance Manual & Materials -- comprehensive customizable HIPAA Security Policies & Procedure and materials templates specifically for mental health group practices. with a detailed step-by-step project plan and guided instructions for adopting & implementing efficiently **includes policy prohibition on use of BCC and CC; workforce forwarding emails from their practice email account to personal email account; data entry checking/not using autofill suggestions for recipients -- the P&P components that address the email gone awry situations we discussed in the podcast episode

• Policies & Procedures include:

• Customizable templates that address each of the HIPAA Security Rule Standards. Ready for plug-and-play real practice application.

• Computing Devices and Electronic Media Technical Security Policy

• Bring Your Own Device (BYOD) Policy

• Communications Security Policy

• Information Systems Secure Use Policy

• Risk Management Policy

• Contingency Planning Policy

• Device and Document Transport and Storage Policy

• Device and Document Disposal Policy

• Security Training and Awareness Policy

• Passwords and Other Digital Authentication Policy

• Software and Hardware Selection Policy

• Security Incident Response and Breach Notification Policy

• Security Onboarding and Exit Policy

• Sanction Policy Policy

• Release of Information Security Policy

• Remote Access Policy

• Data Backup Policy

• Facility/Office Access and Physical Security Policy

• Facility Network Security Policy

• Computing Device Acceptable Use Policy

• Business Associate Policy

• Access Log Review Policy

• Forms & Logs include:

• Workforce Security Policies Agreement

• Security Incident Report

• PHI Access Determination

• Password Policy Compliance

• BYOD Registration & Termination

• Data Backup & Confirmation

• Access Log Review

• Key & Access Code Issue and Loss

• Third-Party Service Vendors

• Building Security Plan

• Security Schedule

• Equipment Security Check

• Computing System Access Granting & Revocation

• Training Completion

• Mini Risk Analysis

• Security Incident Response

• Security Reminder

• Practice Equipment Catalog

• + Workforce Security Manual & Leadership Security Manual -- the role-based practical application oriented distillation of the formal Policies & Procedures

• + 2 complimentary seats of the Security Officer Endorsement Training Program (1 for Security Officer; 1 for Deputy (or future Deputy) Security Officer.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we share ways to be proactive in light of the news that random HIPAA audits are returning.

We discuss why there's still no HIPAA police; the function of these random audits; where the gaps in compliance have been historically; what auditors will likely be looking for; the importance of risk analyses, risk mitigation plans, and policies & procedures; how many HIPAA covered entities were audited the last time the program was active; and PCT's resources to help you get started with formal compliance in a shame-free way.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Results of prior audit period

• HHS Notice in the Federal Register

• JD Supra article: Never Say Never Again: HHS Signals the Return of HIPAA Audit Program

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• PCT's Group Practice PCT Way HIPAA Compliance Manual & Materials -- comprehensive customizable HIPAA Security Policies & Procedure and materials templates specifically for mental health group practices. with a detailed step-by-step project plan and guided instructions for adopting & implementing efficiently **includes policy prohibition on use of BCC and CC; workforce forwarding emails from their practice email account to personal email account; data entry checking/not using autofill suggestions for recipients -- the P&P components that address the email gone awry situations we discussed in the podcast episode

• Policies & Procedures include

• Customizable templates that address each of the HIPAA Security Rule Standards. Ready for plug-and-play real practice application.

• Computing Devices and Electronic Media Technical Security Policy

• Bring Your Own Device (BYOD) Policy

• Communications Security Policy

• Information Systems Secure Use Policy

• Risk Management Policy

• Contingency Planning Policy

• Device and Document Transport and Storage Policy

• Device and Document Disposal Policy

• Security Training and Awareness Policy

• Passwords and Other Digital Authentication Policy

• Software and Hardware Selection Policy

• Security Incident Response and Breach Notification Policy

• Security Onboarding and Exit Policy

• Sanction Policy Policy

• Release of Information Security Policy

• Remote Access Policy

• Data Backup Policy

• Facility/Office Access and Physical Security Policy

• Facility Network Security Policy

• Computing Device Acceptable Use Policy

• Business Associate Policy

• Access Log Review Policy

• Forms & Logs include:

• Workforce Security Policies Agreement

• Security Incident Report

• PHI Access Determination

• Password Policy Compliance

• BYOD Registration & Termination

• Data Backup & Confirmation

• Access Log Review

• Key & Access Code Issue and Loss

• Third-Party Service Vendors

• Building Security Plan

• Security Schedule

• Equipment Security Check

• Computing System Access Granting & Revocation

• Training Completion

• Mini Risk Analysis

• Security Incident Response

• Security Reminder

• Practice Equipment Catalog

• + Workforce Security Manual & Leadership Security Manual -- the role-based practical application oriented distillation of the formal Policies & Procedures

• + 2 complimentary seats of the Security Officer Endorsement Training Program (1 for Security Officer; 1 for Deputy (or future Deputy) Security Officer.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we explain why smart notebooks cannot be used in therapy practices.

We discuss why smart notebooks are popular; how smart notebooks work and why they're in HIPAA's scope; risk exposure; device security and hardening; communicating to clinicians that these devices are not HIPAA compatible; ways to support documentation processes that are HIPAA compatible; and what to do if you find out a clinician has been using a smart notebook.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we discuss the recent Change Healthcare cyber attack and its impact for group practices.

We cover what we know and what we don't know yet; resources to help you take practical steps; how many people are impacted by this breach; the ongoing investigations; ransomware attacks; who is liable for this incident; maintaining operational continuity; and the importance of being proactive in your security practices.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Change Healthcare Status Update Page

• HHS Statement Regarding Cyberattack on Change Healthcare

• TherapyNotes Change Healthcare Incident FAQ

• HealthIT Security article: Understanding the Impact of the Change Healthcare Cyberattack on Providers

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we summarize what group practice owners should know about the Office of Civil Rights Annual Reports to Congress and explain how understanding them can inform risk management.

We discuss the compliance report from the Office of Civil Rights (OCR); how complaints filed were resolved; compliance reviews vs. audits; reframing the (very common) fear of HIPAA complaints; the unsecured PHI report from the OCR; risk management for avoiding large breaches; the importance of reporting breaches; and the primary sources of breaches and ways to minimize them.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Annual Report to Congress on Breaches of Unsecured Protected Health Information

• Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

• PCT's Group Practice PCT Way HIPAA Compliance Manual & Materials -- comprehensive customizable HIPAA Security Policies & Procedure and materials templates specifically for mental health group practices. with a detailed step-by-step project plan and guided instructions for adopting & implementing efficiently **includes policy prohibition on use of BCC and CC; workforce forwarding emails from their practice email account to personal email account; data entry checking/not using autofill suggestions for recipients -- the P&P components that address the email gone awry situations we discussed in the podcast episode

• Policies & Procedures include:

• Customizable templates that address each of the HIPAA Security Rule Standards. Ready for plug-and-play real practice application.

• Computing Devices and Electronic Media Technical Security Policy

• Bring Your Own Device (BYOD) Policy

• Communications Security Policy

• Information Systems Secure Use Policy

• Risk Management Policy

• Contingency Planning Policy

• Device and Document Transport and Storage Policy

• Device and Document Disposal Policy

• Security Training and Awareness Policy

• Passwords and Other Digital Authentication Policy

• Software and Hardware Selection Policy

• Security Incident Response and Breach Notification Policy

• Security Onboarding and Exit Policy

• Sanction Policy Policy

• Release of Information Security Policy

• Remote Access Policy

• Data Backup Policy

• Facility/Office Access and Physical Security Policy

• Facility Network Security Policy

• Computing Device Acceptable Use Policy

• Business Associate Policy

• Access Log Review Policy

• Forms & Logs include:

• Workforce Security Policies Agreement

• Security Incident Report

• PHI Access Determination

• Password Policy Compliance

• BYOD Registration & Termination

• Data Backup & Confirmation

• Access Log Review

• Key & Access Code Issue and Loss

• Third-Party Service Vendors

• Building Security Plan

• Security Schedule

• Equipment Security Check

• Computing System Access Granting & Revocation

• Training Completion

• Mini Risk Analysis

• Security Incident Response

• Security Reminder

• Practice Equipment Catalog

• + Workforce Security Manual & Leadership Security Manual -- the role-based practical application oriented distillation of the formal Policies & Procedures

• + 2 complimentary seats of the Security Officer Endorsement Training Program (1 for Security Officer; 1 for Deputy (or future Deputy) Security Officer.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we're exploring what group practice owners should know about cross-jurisdictional practice in the age of teletherapy.

We discuss the shifting landscape of cross-jurisdictional practice; different licensure compacts to be aware of; applying for privileges to practice under licensure compacts; telehealth training requirements; service and payment parity; payment parity advocacy; states that restrict teletherapy based on provider location; temporary practice provisions; and our upcoming CE training event on March 1 that will dive deeper into this topic.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

Psychology Interjurisdictional Compact (PSYPACT) Map

Apply for Authority to Practice Interjurisdictional Telepsychology (APIT)

Counseling Compact Map

Counseling Compact FAQs

Social Work Licensure Compact Map

Center for Connected Health Policy -- Parity

California Temporary Practice Permission

• CE course: Legal-Ethical Cross-Jurisdictional Practice in the Age of Teletherapy & Licensure Compacts, 2024 Edition (2 legal-ethical CE hours)

• PCT's Group Practice Telemental Health Program

• PCT's Telemental Health Certificate Program (for individual clinicians)

• PCT's Teletherapy Practice Rules by State Tool

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we're covering the fundamentals of texting in group practice.

We discuss HIPAA compliance as a process, not a product; secure and non-secure text messaging; client requested alternative communications; how to use SMS texting in a compliance compatible way; what to have in place with your phone service provider; what to do about personal phone services; phone service providers we recommend (and don't recommend) for teams; and how to document text messages.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• PCT's Free Sample Forms:

• Request for Non-Secure Communications

• Communication Policy (Client Facing)

• Email & Texting Risk Questionnaire

• PCT's free Group Practice Service Selection Workbook & Worksheets Step 1 of the PCT Way -- support for selecting HIPAA-secure, effective, and economical services to meet your practice's functionality and operational needs, including phone and texting (SMS and secure texting)

• CE course: Smooth and Secure Use of Phone, Text, Email, and Video to Meet Modern Clients Where They Are: Legal-Ethical and Real-World Considerations (3 legal-ethical CE credit hours)

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we explain how and why to get Safe Harbor in place on your group practice devices.

We discuss what Safe Harbor means; the HIPAA Breach Notification Rule; the security measures that are the cornerstones of Safe Harbor; different ways PHI can end up on devices, even when using cloud based services; and the PCT resources available to help secure your practice devices.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Group Practice Care Premium

• weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

• + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)

• + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

• PCT article: Easy Safe Harbor from HIPAA Breach Notification: Now on Your Computer and Smartphone

• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we're covering what you need to know about HIPAA and your smartwatch.

We discuss common questions we get from group practice leaders about smartwatches; the limitations of smartwatch security; whether smartwatches should be included as BYOD registered devices; potential issues with smartwatch notifications; and security measures to put in place for Apple Watches and Android smartwatches.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

From Apple: Apple Watch System Security

From Apple: Apple Watch Notification Settings -- See "Customize Your Apple Watch Notification Settings" and "Keeping Notifications Private" sections in particular

Google Pixel Watch: How to Enable/Modify/Disable Screen Lock

Google Pixel Watch: Notification Settings

From Samsung: Set a Security Lock on Your Samsung Smart Watch

From Samsung: Manage Notifications on Your Samsung Smart Watch

Group Practice Care Premium

weekly (live & recorded) direct support & consultation service, Group Practice Office Hours

+ assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing documenting personal & practice-provided devices (for *all* team members at no per-person cost)

+ assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing documenting Remote Workspaces(for *all* team members at no per-person cost) + more

HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices -- care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we talk about ways to prevent HIPAA email breaches in a group practice setting.

We discuss common email-related breaches we see for group practices; email and PHI; large vs. small breaches; the implications of having a HIPAA breach; policies and procedures to mitigate email errors; how to send mass client notifications securely; settings to have in place in your email service; and what makes an email service HIPAA compliant.

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• PCT's Google Workspace Configuration Learning Center (see part 9, 'the sharing and the forwarding', for tutorial on managing forwarding settings)

• Free CE course: Introduction to HIPAA Security for Group Practice Leaders (1 legal-ethical CE course)

• OCR Breach Report Questions -- know the contents of what is asked/what you need to provide *before* starting the breach report in the OCR's online portal for breach reporting

• CE course: HIPAA Security Incidents & Breaches: Investigation, Documentation, And Reporting (1.5 legal-ethical CE credit hours)

• Group Practice Care Premium for weekly (live & recorded) direct support & consultation, Group Practice Office Hours, with the PCT team + Eric Ström, JD PhD LMHC (monthly)

• PCT's Group Practice PCT Way HIPAA Compliance Manual & Materials -- comprehensive customizable HIPAA Security Policies & Procedure and materials templates specifically for mental health group practices. with a detailed step-by-step project plan and guided instructions for adopting & implementing efficiently **includes policy prohibition on use of BCC and CC; workforce forwarding emails from their practice email account to personal email account; data entry checking/not using autofill suggestions for recipients -- the P&P components that address the email gone awry situations we discussed in the podcast episode

• Policies & Procedures include:

• Customizable templates that address each of the HIPAA Security Rule Standards. Ready for plug-and-play real practice application.

• Computing Devices and Electronic Media Technical Security Policy

• Bring Your Own Device (BYOD) Policy

• Communications Security Policy

• Information Systems Secure Use Policy

• Risk Management Policy

• Contingency Planning Policy

• Device and Document Transport and Storage Policy

• Device and Document Disposal Policy

• Security Training and Awareness Policy

• Passwords and Other Digital Authentication Policy

• Software and Hardware Selection Policy

• Security Incident Response and Breach Notification Policy

• Security Onboarding and Exit Policy

• Sanction Policy Policy

• Release of Information Security Policy

• Remote Access Policy

• Data Backup Policy

• Facility/Office Access and Physical Security Policy

• Facility Network Security Policy

• Computing Device Acceptable Use Policy

• Business Associate Policy

• Access Log Review Policy

• Forms & Logs include:

• Workforce Security Policies Agreement

• Security Incident Report

• PHI Access Determination

• Password Policy Compliance

• BYOD Registration & Termination

• Data Backup & Confirmation

• Access Log Review

• Key & Access Code Issue and Loss

• Third-Party Service Vendors

• Building Security Plan

• Security Schedule

• Equipment Security Check

• Computing System Access Granting & Revocation

• Training Completion

• Mini Risk Analysis

• Security Incident Response

• Security Reminder

• Practice Equipment Catalog

• + Workforce Security Manual & Leadership Security Manual -- the role-based practical application oriented distillation of the formal Policies & Procedures

• + 2 complimentary seats of the Security Officer Endorsement Training Program (1 for Security Officer; 1 for Deputy (or future Deputy) Security Officer.