In this episode, we share concrete steps to take if you’ve discovered staff members using non-approved AI platforms in your practice.

We discuss:

The misconceptions around what constitutes PHI (and why information used to write a progress note absolutely is PHI)
Why this is a reportable HIPAA breach
Why reporting a HIPAA breach is nowhere near as scary or impactful as you may fear
The difference between a large breach and a small breach, and reporting deadlines for each
Client notification deadlines for breaches
How state law can impact or add to reporting deadlines
Steps to take after discovering non-compliant AI use in your practice
What to investigate, how to document, how to mitigate, how to notify clients, and when to consult an attorney

In our latest episode, we explain why free email providers are inherently not HIPAA compliance compatible.

We discuss:

Why it’s necessary to have a Business Associate Agreement with your email service provider
Why clients can’t opt out of HIPAA
What requests for alternative or non-secure communication actually mean under the HIPAA Privacy Rule
What counts as Protected Health Information (PHI)
Why a free email address might be a red flag for prospective clients
How to get a BAA protected email, with a domain name or without

In our latest episode, we continue our series on AI use within therapy practices by sharing how to explain to your team members why using non-vetted AI platforms is not permissible.

We discuss:

What counts as Protected Health Information and a breakdown of the often misunderstood 18th identifier under HIPAA
How therapy progress notes and clinical notes are inherently identifying
AI re-identification risk and why this is possible
Why AI use involving client information must be vetted and HIPAA compliance-compatible
What happens when you input data into personal AI platforms
What we mean by AI governance, and why personal AI platforms can’t be governed
Why lack of AI governance is a significant liability
Impermissible disclosures under HIPAA
Why proving low probability of compromise is difficult after the fact, and what this means for your ability to mitigate risk
Managing the emotional pieces of identifying risk and risk mitigation in your practice

In our latest episode, we share information about the recent Darksword iPhone exploit, and what that means for therapy practice owners regarding device security.

We discuss:

What you need to know about this exploit
Device hardening within your security circle
Device security gaps we see in everyday practice
Pairing technical security measures with behavioral security measures
PCT’s resources around risk management and device security

In our latest episode, we discuss HHS’s new model Notice of Privacy Practice for Part 2 programs, what has changed, and what that means for your practice.

We cover:

The Part 2 Final Rule from 2024
Why the Feb. 16th enforcement deadline has been so confusing
The model Part 2 NPP and Patient Notice from HHS, and the function of each document
Who is considered a lawful holder and what that means
Whether you need to switch to the HHS templates
What to do if you already used our decision guide and resources ahead of the deadline

In our latest episode, we share a PSA for group practice owners to address unauthorized AI use within your practice.

We discuss:

What we mean by governance
What counts as Protected Health Information (PHI)
The standard we use at PCT to determine if something is PHI
Why AI tools like ChatGPT are inappropriate for PHI
De-identification standards under HIPAA
Ethical standards and informed consent for clinical use of AI
Concrete next steps to take as a practice leader to address AI use in your practice

v2.10.0

Scheduled Maintenance

We will be temporarily taking the website offline at 10:00 PM Pacific (1:00 AM Eastern) tonight, July 6, in order to make some improvements. We plan to be back online by midnight Pacific (3:00 AM Eastern). We apologize for any inconvenience this may cause. Dismiss