Group Practice Tech

Episode 611: The Real Risks of Using Non-Vetted AI Platforms with Client Information

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we continue our series on AI use within therapy practices by sharing how to explain to your team members why using non-vetted AI platforms is not permissible. We discuss: What counts as Protected Health Information and a breakdown of the often misunderstood 18th identifier under HIPAA How therapy progress notes and clinical notes are inherently identifying AI re-identification risk and why this is possible Why AI use involving client information must be vetted and HIPAA compliance-compatible What happens when you input data into personal AI platforms What we mean by AI governance, and why personal AI platforms can't be governed Why lack of AI governance is a significant liability Impermissible disclosures under HIPAA Why proving low probability of compromise is difficult after the fact, and what this means for your ability to mitigate risk Managing the emotional pieces of identifying risk and risk mitigation in your practice Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website.

Episode 610: Don't Panic - But Do Pay Attention: What the Darksword iPhone Exploit Actually Means

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share information about the recent Darksword iPhone exploit, and what that means for therapy practice owners regarding device security. We discuss: What you need to know about this exploit Device hardening within your security circle Device security gaps we see in everyday practice Pairing technical security measures with behavioral security measures PCT's resources around risk management and device security Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite:  assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite:  assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more PCT's Comprehensive HIPAA Security Compliance Program (discounted) bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training HIPAA Risk Analysis & Risk Mitigation Planning service for mental health group practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks. Resources Wired Article: Apple Will Push Out Rare 'Backported' Patches to Protect iOS 18 Users From DarkSword Hacking Tool PC Mag Article: 'DarkSword' Attack Is Now Targeting Vulnerable iPhones Via Phishing Emails Malwarebytes Labs Article: [updated] A DarkSword hangs over unpatched iPhones

Episode 609: Update: HHS Releases Model NPP for Part 2 Changes — What It Means for Your Practice

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we discuss HHS's new model Notice of Privacy Practice for Part 2 programs, what has changed, and what that means for your practice.  We cover: The Part 2 Final Rule from 2024 Why the Feb. 16th enforcement deadline has been so confusing The model Part 2 NPP and Patient Notice from HHS, and the function of each document Who is considered a lawful holder and what that means Whether you need to switch to the HHS templates What to do if you already used our decision guide and resources ahead of the deadline Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources Updated HHS Model Notice of Privacy Practices Model Part 2 Patient Notice HHS Part 2 Final Rule Fact Sheet PCT decision guide and sample language resource Additional PCT Resources Episode 605: 42 CFR Part 2, HIPAA NPPs, and the February 16 Deadline: What Actually Needs to Change Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

Episode 608: AI Isn't the Problem, Lack of Governance Is – A PSA for Group Practice Leadership

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a PSA for group practice owners to address unauthorized AI use within your practice. We discuss: What we mean by governance What counts as Protected Health Information (PHI) The standard we use at PCT to determine if something is PHI Why AI tools like ChatGPT are inappropriate for PHI De-identification standards under HIPAA Ethical standards and informed consent for clinical use of AI Concrete next steps to take as a practice leader to address AI use in your practice Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources: Article + 18 Identifier List: De-Identified or Not? The Truth About HIPAA, AI, and Client Data In this article, Person Centered Tech breaks down one of the most misunderstood concepts in HIPAA compliance: de-identification. It clarifies the difference between simply "removing identifiers" and meeting HIPAA's strict legal standards for de-identification (Safe Harbor or Expert Determination). The piece explains why narrative clinical information is often inherently identifying, why a session transcript cannot realistically be considered de-identified, and how AI systems introduce heightened risks of re-identification. It reinforces a critical takeaway for practice leaders: HIPAA sets the floor—not the ceiling—for protecting client information, and governance must keep pace with emerging technologies. PCT CE Course: Law & Ethics of the Clinical Use of Artificial Intelligence: Implications in Clinical Practice If you're wanting a deeper, structured framework for evaluating AI in clinical practice, this 3-credit legal-ethical on-demand training with Eric Ström, JD, PhD, LMHC, walks through the evolving legal standards, HIPAA considerations, and ethics code guidance that apply to AI use in behavioral health. You'll gain practical strategies for assessing new technologies, understanding emerging standards of care, and implementing AI tools in a way that is legally defensible and ethically sound. PCT CE Course: Modern Progress Notes: Considerations for Teletherapy, Insurance Audits, and Artificial Intelligence (AI) If your clinicians are feeling the pull to use AI for documentation, this 1.5-credit legal-ethical training with Dr. Maelisa McCaffrey (Hall) provides a grounded, practical framework for evaluating that decision. The course addresses how AI is currently being used in progress notes and introduces a clear thought rubric for determining the ethical risks, compliance implications, and appropriateness of integrating AI into documentation workflows. It also reinforces core documentation principles—like medical necessity and audit risk reduction—so that efficiency never comes at the expense of defensibility. A strong next step for practice leaders who want to move from reactive prohibition to thoughtful, structured governance. (Useful for all clinicians) Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more

Episode 607: HIPAA After Retirement – How to Close Your Practice the Right Way

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we discuss the HIPAA responsibilities for therapy practice owners when closing their practice or retiring. We cover: Common assumptions about responsibilities after retirement What determines your record retention length How long you must remain contactable after closing your practice and why The key functionalities you need to maintain, and the most economical ways to DIY them Outsourcing to an executor service as an alternative to the DIY approach Common mistakes that are made when shutting down a practice and how to avoid them Practice closure planning as part of client care planning Action steps to take if retirement is on the horizon Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources Retirement Record Retention Checklist a clear, practical guide to HIPAA compliance after retirement or practice closure. Learn what record retention laws require, how to honor clients' Right of Access, and which secure systems you need to maintain for the full retention period — so you can close your practice with confidence and integrity. PCT CE Course: Preparing For The Worst – A Professional Will Is Not Enough: Ensuring Continuity of Care In Event of Retirement, Death, or Disability Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more Resources TheraClosure (Professional Executor Services) — A therapist-founded service offering retirement and executor support for clinicians, including options for ongoing record retention and practice closure management. We mention them as one available option for outsourcing post-retirement HIPAA responsibilities. PCT has no affiliate relationship with TheraClosure and does not specifically endorse their services; clinicians should perform their own due diligence when evaluating vendors.