Group Practice Tech

Hosted by Person Centered Tech

Business

Website RSS feed

Episodes

100

Latest episode

Oct 2026

Language

About the show

Group Practice Tech by Person Centered Tech: a podcast where we help mental health group practice owners ethically and effectively leverage tech to improve their practices.

Listen to episodes

60 recent

October 30, 2026Episode 3430 min

Episode 634: Beware Email Tricks That Look Like Treats! A PSA For Your Practice

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share an important warning for practice owners about increasingly sophisticated phishing attacks for you and your staff to be aware of. We discuss: How phishing attacks are now using legitimate services like DocuSign, Google Calendar, and more What these phishing attacks typically look like and things to watch out for How scammers access these trusted platforms What adversary-in-the-middle phishing attacks are and how they can circumvent MFA Combining technical and behavioral security measures What to do if your practice experiences a phishing attack What this means for HIPAA security compliance, risk management, and practice protection Best practices for managing this risk, and practical protections to put in place Our soon to be updated training that will cover this exact topic Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources HIPAA Security Awareness Grab-Bag — Three short, on-demand staff security awareness trainings covering stopping phishing and social engineering, avoiding inappropriate disclosures of PHI, and protecting PHI in public. A practical resource for strengthening your team's security awareness right now. Group Practice Care Premium — Includes weekly Group Practice Office Hours for direct support and consultation with PCT experts, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC. Also includes the Device Security Suite and Remote Workspace Security Suite, with assignable staff trainings, step-by-step security tutorials, and tools to document device and workspace security for all team members at no additional per-person cost. Coming Soon: Updated Phishing Security Awareness Training — We're developing dedicated trainings for practice staff and practice leaders/Security Officers addressing sophisticated phishing attacks involving DocuSign, Google Workspace file sharing, calendar invitations, adversary-in-the-middle attacks, and session hijacking. Stay tuned for more information! Resources DocuSign Safety Center: Current Fraud Alerts — Regularly updated alerts about phishing campaigns exploiting DocuSign, including fraudulent invoices, EFT remittance notices, and malicious documents distributed through legitimate DocuSign envelopes. DocuSign: Phishing Scams Using Fake Blurred Documents to Gain Device Access — A real-world example of attackers using legitimate DocuSign notifications to trick recipients into downloading malicious software to supposedly reveal a blurred document. Google Calendar Help: Manage Invitations and Prevent Unsolicited Events — Instructions for controlling which invitations automatically appear on your calendar. Consider selecting "When I respond to the invitation in email" under Settings → Event settings → Add invitations to my calendar, rather than automatically adding invitations from known contacts whose accounts could potentially be compromised. Microsoft: Identity Protection Risk Detections — Technical guidance on account security threats, including adversary-in-the-middle phishing and stolen session tokens that may allow attackers to access accounts even when conventional multifactor authentication is enabled. HHS OCR: Social Engineering – Searching for Your Weakest Link — Official guidance on social engineering, phishing, workforce security awareness, and protecting electronic protected health information (ePHI). HHS OCR: HIPAA Cybersecurity Guidance and Resources — Cybersecurity resources to help HIPAA-covered entities and business associates understand security risks, implement safeguards, and prepare for security incidents. HHS OCR: HIPAA Breach Notification Rule — Official guidance on assessing potential breaches of unsecured PHI and understanding breach notification obligations. A reminder that containing an account compromise is not the same as completing an incident investigation and determining whether a reportable breach occurred.

October 16, 2026Episode 3342 min

Episode 633: Supporting Your Team & Protecting Your Practice -- with Niki Ramirez of HR Answers

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we interview Niki Ramirez of HR Answers about how human resources plays a role in effective leadership and a successful group practice. We discuss: Skills that make clinicians effective leaders, and common friction points for clinician leaders How Niki helps group practice leaders develop effective communication skills Progressive discipline, directive coaching, and non-directive coaching The importance of clear expectations and policies Shared knowledge leading to shared vision and aligned action Course correcting if you don't have HR pieces in place HR foundations to have in place when launching a practice How HIPAA compliance and risk management and HR components work together Managing offboarding and employment transitions How to work with Niki and HR Answers Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website.

October 9, 2026Episode 3214 min

Episode 632: Device Termination: How to Retire a Device That Won't Turn On

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share how we recommend behavioral health practices safely and appropriately dispose of devices that won't turn on. We discuss: Why smashing devices with lithium-ion batteries is a safety hazard Documentation for disposing of devices that won't turn on Making sure the device actually won't turn on Devices that are safe to physically destroy Electronic device recycling programs Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources Group Practice Care Premium — Practical tools, staff training, and ongoing support to help group practice leaders secure and document the devices and workspaces their teams use. Premium includes: Device Security Suite: Assignable staff HIPAA Security Awareness: Bring Your Own Device training, plus access to the Device Security Center with step-by-step, device-specific tutorials and registration forms for securing and documenting all personally owned and practice-provided devices—for all team members, at no per-person cost. Remote Workspace Security Suite: Assignable staff HIPAA Security Awareness: Remote Workspaces training, plus access to the Remote Workspace Center with step-by-step tutorials and registration forms for securing and documenting remote workspaces— for all team members, at no per-person cost. Direct support and consultation: Weekly live and recorded Group Practice Office Hours , including a monthly session featuring therapist and attorney Eric Ström, JD, PhD, LMHC , plus additional direct support and consultation resources. Solo Practice Care Premium — Practical resources and ongoing support to help solo clinicians secure their devices and workspaces and make informed decisions as practice questions arise. Premium includes: Device Security Instruction Center: Step-by-step tutorials and registration forms for securing and documenting personally owned and practice-provided devices. Home & Mobile Workspace Security Instruction Center: Step-by-step tutorials and registration forms for securing and documenting home and mobile workspaces. Direct support and consultation: Weekly live and recorded Office Hours , including a monthly session featuring therapist and attorney Eric Ström, JD, PhD, LMHC .

October 2, 2026Episode 311 hr 2 min

Episode 631: Supporting the Whole Client: Physiology, Mental Health, and GLP-1s with Dr. Kristen Allott

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we chat with Dr. Kristen Allott about how mental health providers can support client well-being by looking at the foundational aspects of wellness. We discuss: How mental health is impacted when the power supply for the body (food, sleep, exercise, breathing) isn't adequate Our primary attachment being to our body The impact of adrenaline in the body, and how that impacts folks with complex trauma, especially if they don't eat regularly How understanding wellness and the nervous system can help mental health professionals serve clients better The toolkit Dr. Allott would provide for every mental health practitioner Therapist wellness and why therapist burnout is so severe Self-care vs. self-neglect Dr. Allott's upcoming training on GLP-1s and mental health with PCT Why therapists are uniquely situated to provide care for people managing the effects of GLP-1 medications Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Live (and recorded) CE training: GLP-1s: Mental Health, Addiction, and Disordered Eating — What Therapists Need to Know Join Dr. Kristen Allott, ND LAc, for this three-credit-hour training, presented live on October 30, 2026, with on-demand self-study CE course access also included. This training will help therapists understand how GLP-1 medications may be supporting or compromising a client's well-being and provide a framework for navigating client conversations, setting realistic expectations, and "tipping the scales" toward safety and efficacy — all while remaining within their scope of practice. Resources from Dr. Kristen Allott To learn more about Dr. Kristen Allott, visit KristenAllott.com . The homepage links to all of her free handouts and videos, which you can share with your clients. You can also sign up for the Dynamic Brains Learning Collective , a free monthly virtual meeting where you can ask Dr. Allott your questions and she dives deeply into hot topics. You can learn more about her workbook , Fuel Your Brain, Not Your Anxiety , which walks you through the steps she uses to identify the physical causes of mental health challenges. Be sure to follow Dr. Allott on social media: Instagram: @KristenAllott Facebook: @DynamicPaths Finally, a quick note: Dr. Allott can only see individuals as patients if they live in Washington state. However, she is available to be contracted as a consultant for mental health professionals who want to engage more deeply with their clients and care for the whole body. She is also available for individualized seminars.

September 25, 2026Episode 3017 min

Episode 630: "I Have to Report This, Right?" Mandatory Reporting and the Risk of Future Harm

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we're discussing a topic that's come up frequently in the wake of the Clancy case: mandated reporting. We cover: Misconceptions around mandated reporting Mandatory reporting vs. other legal and ethical duties that apply What a clinician needs to evaluate when there is concern harm may occur Permission to disclose vs. duty to protect Tarasoff duties and liabilities Determining what is required and what is permitted under applicable law The framework that Eric Strom and Liath presented in the related CE course to determine what to do in these situations Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources On-demand CE course: "I Have to Report This, Right?" Law and Ethics of Mandatory Reporting, Tarasoff Liability, and the Limits of Confidentiality When a client reveals possible abuse or a risk of harm, how do you determine whether a report is required, a disclosure is permitted, or another protective action is needed? In this three-hour legal-ethical CE course (APA and NBCC approved,) attorney and clinician Eric Ström and PCT's Liath Dalton work through these distinctions and their implications, real-world scenarios, differing state laws, and the decisions clinicians face when confidentiality and safety intersect. The course includes the PAUSE framework and worksheet to help you reach and document a proportionate, client-centered response. "This was one of the better, more involved and detailed CE's I have ever attended" "After working 40 years as a therapist, and 25+ of those years in private practice, this is the FIRST time 'Tarasoff' (its hx and utility) was made clear!" On-demand CE course: Legal-Ethical Cross-Jurisdictional Telemental Health in 2026 For clinicians practicing across state or national borders, this course examines how client location, clinician location, and licensure jurisdictions can affect confidentiality, mandatory reporting, emergency response, and other obligations. 3 legal-ethical CE credit hours. APA and NBCC approved. Direct Support and Consultation: Group Practice Care Premium — For group practice leaders who want support as questions arise, Premium includes weekly live and recorded Group Practice Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. Solo Practice Care Premium — For solo clinicians who want support as practice questions arise, Premium includes weekly live and recorded Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. Additional resources HHS: HIPAA Privacy Rule and Sharing Information Related to Mental Health — Guidance on when HIPAA permits mental health information to be shared, including circumstances involving safety concerns. HHS: Disclosure When a Patient Presents a Serious Danger — Explains HIPAA's permission to disclose information to someone reasonably able to prevent or lessen a serious and imminent threat, when the applicable conditions are met. Child Welfare Information Gateway: Mandatory Reporting of Child Abuse and Neglect — An overview of reporting requirements and how they vary across states.

September 18, 2026Episode 2928 min

Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation. We discuss: Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles Opportunistic vs. forced TLS Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace What HIPAA actually requires for email security Where NIST (National Institute for Standards of Technology) guidance fits in The actual risk analysis for legacy TLS Benefits of secure email services, and when it might make sense to cancel Data to gather from your secure email service to do your own risk analysis Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Episode 623: Now You Can Secure Outbound Email in Google Workspace Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management. PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know PCT's detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate. PCT's Free Google Workspace Configuration Help Center Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS. PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice PCT's framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources 45 C.F.R. § 164.312 — HIPAA Security Rule Technical Safeguards The regulation itself, including the Transmission Security standard at § 164.312(e). HHS: Are Covered Entities Required to Use NIST Guidance Documents? HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule. HHS: Is the Use of Encryption Mandatory in the Security Rule? HHS explains the Security Rule's risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards. Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections Google's current documentation on Gmail's support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable. NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations NIST's technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.

September 11, 2026Episode 2829 min

Episode 628: HIPAA Security Officer: Who Leads, Who Does the Work, and Who's Liable?

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we go over some common questions we get at PCT about the HIPAA designated Security Officer role. We discuss: The primary purpose of the Security Officer's role What is actually required of the person in this role Determining the right person for this role in your practice Tasks that can be passed off to a Deputy Security Officer Operational structure for Security Officers and Deputy Security Officers Whether the Security Officer or Deputy Security Officer hold individual liability in the event of a breach Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training PCT's Security Officer Endorsement Program – A foundational training for anyone who finds themself in the Security Officer role, including 10 CEs across three separate trainings.

September 4, 2026Episode 2723 min

Episode 627: Key Takeaways from Day One of the 2026 NIST–OCR HIPAA Security Conference: Security Rule Updates & Risk Analysis

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we recap what behavioral health practice owners should know from day one of the HIPAA Security Conference. We discuss: The timeline for proposed Security Rule changes What practices must have documented in writing according to the current Security Rule Encryption being reasonable and appropriate in almost every practice environment Expanding risk analysis enforcement initiative to include risk management Why risk analyses are foundational, and what they have to include that a gap analysis doesn't Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Episode 618: HIPAA Security Rule Update—What We Know, What We Don't, and What You Should Do Right Now — Our previous update on the proposed HIPAA Security Rule changes, the regulatory uncertainty surrounding them, and why practices should continue strengthening their security under the current rule while the rulemaking process unfolds. Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources HIPAA Security Rule Notice of Proposed Rulemaking Fact Sheet — The Office for Civil Rights' summary of the proposed Security Rule modifications, including greater specificity for Risk Analysis, written documentation requirements, defined compliance intervals, and proposed changes to "addressable" implementation specifications. Unified Agenda Entry for the HIPAA Security Rule — The current federal regulatory agenda lists the rulemaking as a long-term action with final action anticipated in July 2027. This is a planning estimate rather than a legal deadline or guaranteed publication date. HHS OCR Guidance on Risk Analysis — Official guidance explaining the required scope and elements of a HIPAA Security Risk Analysis, why "addressable" does not mean optional, and how Risk Analysis provides the foundation for an organization's risk-management decisions. HHS OCR Security Rule Guidance Materials — A collection of official Security Rule resources, including OCR presentations on Risk Management and Recognized Security Practices, educational papers, and links to relevant NIST publications.

August 28, 2026Episode 2614 min

Episode 626: Is Google Search Console HIPAA-Friendly? What Therapy Practices Can Learn Without Google Analytics

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a HIPAA-friendly way for therapy practice owners to get useful information about how their websites are performing, via Google Search Console. We discuss: What Google Search Console can tell you about your website The crucial differences between Google Analytics and Google Search Console Why Search Console is permissible for therapy practice websites Caveats and what to consider when configuring Search Console Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Podcast: Episode 625: Google Analytics for Therapy Practice Websites—The HIPAA Risks Explained — The companion episode explaining why Google Analytics is not appropriate for therapy-practice websites and how individually identifiable website activity can become protected health information. PCT CE course: Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD, PhD, LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements. PCT's Google Workspace Configuration Help Center — Includes step-by-step, video-based guidance for securing, configuring and leveraging Google Workspace appropriately for a therapy practice Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles : For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Resources Google Search Console — Google's free tool for understanding how a public website performs in Google Search, including the search terms that result in a website appearing, impressions, clicks, search position, indexing issues, and website-health information. Google Search Console Performance Report: Dimensions and Data Groupings — Google's explanation of the search-query, page, country, and device information available through Search Console. It also explains that some queries are omitted from reports to protect searcher privacy. Google Search Console: Verify Your Site Ownership — Google's instructions for verifying ownership through methods such as a DNS record or HTML file or tag. Google Analytics and Google Tag Manager are optional verification methods and do not need to be enabled to use Search Console. Google Search Console: Managing Owners, Users, and Permissions — Guidance for limiting Search Console access and periodically reviewing who has owner- or user-level access to a practice's website data. Google Search Console: Remove Information From Your Website From Google Search — Google's guidance for keeping sensitive, authenticated, or otherwise inappropriate pages out of search results and removing pages that have already been indexed.

August 21, 2026Episode 2528 min

Episode 625: Google Analytics for Therapy Practice Websites – The HIPAA Risks Explained

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we unpack the reasoning, step by step, behind PCT's position on Google Analytics for therapy practices. We discuss: Can website activity constitute Protected Health Information? HIPAA's definition of healthcare operations vs. HIPAA's definition of marketing Business Associates, and how there is no BAA available for Google Analytics The disclosures required for HIPAA authorization for marketing activity Cases where collecting PHI without a BAA has gone awry The risk context in an increasingly AI world The takeaway: is it permissible for therapy practices to use Google Analytics on their practice websites? Uniting as an industry to demand BAAs for Google Analytics Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD PhD LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements. Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite : assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more HIPAA Risk Analysis & Risk Mitigation Planning service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT's Comprehensive HIPAA Security Compliance Program (discounted) bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training Resources HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — OCR's current guidance on how the HIPAA Privacy, Security, and Breach Notification Rules apply to website and app tracking technologies. It addresses when website activity may constitute PHI, tracking on authenticated and unauthenticated webpages, Business Associate Agreements, marketing disclosures, HIPAA authorization, and risk analysis. Google: HIPAA and Google Analytics — Google's own guidance for HIPAA-regulated organizations. Google states that regulated entities must not expose Google Analytics to PHI and that Google does not offer Business Associate Agreements for Google Analytics. American Hospital Association v. Becerra — June 20, 2024 Court Decision — The federal court decision that partially vacated OCR's tracking-technology guidance regarding an IP address combined with a visit to an unauthenticated health-related webpage. The decision is important for understanding what may—and may not—constitute individually identifiable health information in the context of website tracking. HHS: Business Associates — HHS guidance on when a person or company becomes a HIPAA Business Associate, including when a vendor performs data analysis or other functions involving PHI on behalf of a covered entity. HHS: Marketing and the HIPAA Privacy Rule — Guidance on HIPAA's specific definition of marketing, the exceptions to that definition, and when written individual authorization is required for uses or disclosures of PHI for marketing. FTC: BetterHelp Health Data and Advertising Enforcement Action — The FTC's action concerning BetterHelp's disclosure of sensitive consumer health information to third parties for advertising purposes. Importantly, this was FTC consumer privacy enforcement, not HIPAA enforcement, but it provides a real-world example of the risks associated with health-related information flowing into advertising and tracking ecosystems.