That QR Code in the Parking Lot Is a Trap
You pull into a downtown parking spot. The meter has a QR code on it: "Scan to pay." You scan, a payment page appears, ...
What Do We Do in the First 24 Hours After a Breach at a Mental Health Practice?
The first day, in order. Containment, preservation, assessment, then planning the notice. Disconnect the affected device from the network, but do not power it off....
Is Our Telehealth Setup Actually HIPAA Compliant?
Seven checks covering the platform, the configuration, the room, and the device. Probably not entirely, and the gap is usually not the video platform. Most...
Can Our Clinicians Use Personal Phones and Laptops for Client Notes?
What is generally fine, what needs controls, and what should never happen. Yes, with controls. HIPAA does not prohibit personal devices. What it requires is...
Switching IT Providers Without Disrupting Client Appointments
How a transition is sequenced around a clinical calendar. A well run IT transition costs a practice zero appointments. The records platform never goes down,...
What Does 42 CFR Part 2 Require That HIPAA Does Not?
Where 42 CFR Part 2 goes further than HIPAA for substance use disorder records. 42 CFR Part 2 protects substance use disorder treatment records more...
How Do I Pass a HIPAA Security Risk Analysis at a Small Practice?
The nine areas a ...
How Fast Does IT Need to Respond When Your Records Platform Goes Down During Client Appointments?
Billable clinical hours lost per hour of records platform downtime, by practice size. A practice with eight clinicians seeing clients back to back loses roughly...
What Happens to Your Passwords and Documentation When You Change IT Providers?
What a practice should receive, and when, after giving notice to an outgoing IT provider. Your network documentation, passwords, licenses, and account ownership belong to...
Does My Therapy Practice Need a BAA With Its IT Provider, and What Should It Cover?
What HIPAA requires in a Business Associate Agreement, and what a practice should add. Yes. If your IT provider can reach any system that holds...
