wavePod

Episode 76: Tips for Having HIPPA Peace of Mind for Private Practitioners Part 1 - Private Practice Startup Podcast | Wave AI Podcast Notes

Back to Private Practice Startup Podcast

Episode 76: Tips for Having HIPPA Peace of Mind for Private Practitioners Part 1

Private Practice Startup Podcast

Sat Mar 10 2018

Roy Huggins

Summary

PRIVATE PRACTICE STARTUP PODCAST | EPISODE 76
Tips for Having HIPAA Peace of Mind for Private Practitioners – Part 1
Hosts: Dr. Kate Campbell & Katie Lemieux
Guests: Roy Huggins (“The HIPAA Guru”) & Laeth Dalton | Person Centered Tech
Date: March 10, 2018

Episode Overview

This episode tackles one of private practice’s most anxiety-provoking topics: HIPAA compliance. Hosts Kate and Katie welcome Roy Huggins and Laeth Dalton of Person Centered Tech to demystify HIPAA—addressing common practitioner fears, clarifying who HIPAA applies to, what it actually requires, and why non-covered entities should still pay attention. The discussion is empathetic, informal, and practical, arming mental health professionals with a mindset for compliance (and sanity) as digital technology becomes ever more integrated into clinical work.

Key Discussion Points and Insights

1. Why HIPAA Is So Stressful for Therapists (05:55–08:56)

Katie shares personal anxiety about email, social media, and HIPAA panic, capturing the collective unease many therapists feel.
Roy is introduced as "the HIPAA guru" who has a talent for reassuring clinicians.
The importance of this episode: “If I'm freaking out about it, there's many other people freaking out about it...this podcast is going to bring you some peace of mind and ease.” (Katie, 02:31)

2. Meet the Experts: Roy Huggins & Laeth Dalton (06:02–08:56)

Roy: Tech background, web developer turned therapist, fluent in Japanese, now blends both worlds in his work.
Notable Moment: "You cannot escape [tech]...and so here I am." (Roy, 07:16)
Laeth: Religious studies grad student, developed into deputy director for Person Centered Tech via collaboration with Roy.

3. HIPAA: What It Is and Why It Matters (09:04–11:57)

HIPAA’s origins: 1996 act aimed to solve expensive, inefficient insurance billing, insurance portability, and to leverage emerging internet technologies.
Why it affects practices today: "HIPAA settled that up. The act was in 1996. The first rules came out...in 2003 for the privacy rule.” (Roy, 11:03)
HIPAA is about standardizing insurance communication, but its privacy rules have major implications for practice management and digital records.

4. Privacy Rule vs. Security Rule (12:03–16:36)

Privacy: Concerns clients’ rights to control, access, and understand their information. “HIPAA was like, no, that’s just the way it is. Americans have their rights to this information.” (Roy, 13:14)
Security: The practical/technical methods to maintain privacy—locked cabinets in the past, now encryption and digital safeguards.
Memorable Analogy: “Therapists and spies, we talk like that.” (Roy, 15:50), on how therapists are good at confidentiality techniques.

5. The Basic HIPAA Musts: Privacy Rule (16:36–20:52)

Every provider needs a Notice of Privacy Practices (NPP)—and must actually know its content. “When therapists do get in trouble with HIPAA, one of the big causes is they don’t know what their NPP says.” (Roy, 17:19)
You must have internal policies: release of records, accounting for disclosures, and more—even if you’re solo or small.
Special provision: Psychotherapy/process notes can be kept separate and are not part of regular records releases.

6. Are You A Covered Entity? The Insurance Link (21:09–24:23)

Covered entity = anyone conducting insurance billing transactions electronically.
“If you’re Kate and I, completely private pay...never bill insurance, then you’re not a covered entity.” (Katie, 22:55)
Many therapists discover they don’t officially have to follow HIPAA (but see below…).

7. Why Follow HIPAA Anyway? Standard of Care & Legal Risk (24:23–31:24)

Even non-covered entities may be judged against HIPAA standards in malpractice/legal proceedings.
“Standard of care is not highest level… it’s very C.” (Roy, 24:37) — meaning, keep up with the general, not exceptional, standard.
HIPAA’s security rule is widely referenced because it specifies reasonable safeguards, even if ethics codes are vague.
State-to-state variability: Some states may use HIPAA as the legal standard, some may not, but for most, it’s the most defensible position regardless.

8. Main Takeaways – Part 1 (30:09–31:24)

Figure out if you’re a covered entity—if unsure, consult a lawyer.
Even if not a covered entity, “HIPAA standards are still a strong guideline...if you just use HIPAA as your guide for how you manage your security…you’re going to cover these standards, you’re going to cover state laws for the most part.” (Roy, 31:13)

Notable Quotes and Memorable Moments

On therapist anxiety:
“If I’m freaking out about it, there’s many other people freaking out about it.”
— Katie, 02:21
On HIPAA’s impact:
“HIPAA was like, no, that’s just the way it is. Americans have their rights to this information.”
— Roy, 13:14
On HIPAA entities:
“If you’re Kate and I, completely private pay...never bill insurance, then you’re not a covered entity.”
— Katie, 22:55
On compliance culture:
“Standard of care is not highest level… it’s very C. You can do a lot better than standard of care...”
— Roy, 24:37
On therapist skills:
“Therapists are really good at security...we just don’t realize it.”
— Roy, 15:55
On applying HIPAA:
“HIPAA—your how-to-avoid-legal-problems and malpractice suits guide.”
— Roy, 31:08

Timestamps for Key Segments

00:00–03:27 – Intros, previous episode recap, context for HIPAA anxiety
05:55–08:56 – Roy’s backstory, transition from tech to therapy
09:04–11:57 – HIPAA 101: What, why, and when
12:03–16:36 – The privacy rule vs. the security rule, therapist as “spy”
16:41–20:52 – HIPAA compliance basics: Forms and policies
21:09–24:23 – The insurance link: Who's a HIPAA covered entity
24:23–31:24 – Standard of care, legal strategies, ethics codes and HIPAA
30:09–31:24 – Main takeaways/summary for practitioners
31:24–32:18 – Preview for Part 2 and conclusion

Tone and Style

The episode is approachable, humorous, and deeply empathetic. Roy relieves anxiety with technical clarity and analogies, while Kate and Katie consistently re-focus conversation on what private practitioners really need to know. Listeners are left empowered and more at ease about HIPAA compliance.

Up Next

Part 2 will dive into the nuts and bolts of tech: email, cell phones, telehealth, and real-world scenarios for implementing these HIPAA principles.

For more resources, check the show notes or the Private Practice Startup Facebook group, where Roy will be responsive to listener follow-up questions.

Loading summary...

Transcript

A (0:03)

Welcome to the Private Practice Startup where we inspire you from startup to mastery. We chat with entrepreneurs, experts in the mental health and business arenas, and successful private practitioners to give you the tools needed to make your dream practice a reality. Visit theprivatepracticestartup.com for awesome resources, free trainings and so much more. Here are your hosts, Dr. Kate Campbell and Katie Lemieux.

B (0:26)

Hey there Startup Nation. Welcome back to another episode of the Private Practice Startup podcast. I am one of your co hosts, Katie Lemieux, here with my friend and business partner.

A (0:35)

What's up guys? Kate Campbell here.

B (0:38)

We hope you guys enjoyed our show from last week where we spoke to the very passionate Phil Singleton all about SEO Deep Dive where he really focused a lot on Google reviews, the importance of that, but then how to really take content and utilize it and duplicate it in many ways. So you'll definitely want to listen to that as well as check out the show notes for that page because there was a ton of resour from that podcast. If you're a first time listener, we wanted to say welcome and we wanted to roll out the virtual red carpet for you. And we have a special gift for you. We want you to head over to privatepracticestartup.com head over to the resources tab and download your A to Z cheat sheet. All the essentials for building and growing your dream practice. If you're a loyal member of Startup Nation family already and listener, we wanted to say hi and thank you so much for tuning in yet again. And of course you can always find us hanging out on Facebook. If you join our Facebook group community at the Private Practice Startup, there you'll be able to interact with ourselves as well as thousands of other practitioners across the globe. So today we are talking about a very important topic in the therapy world which is hipaa. And I decided to seek out probably the guy who knows most about it, the HIPAA guru. The HIPAA guru Roy Huggins. And he's also joined by Laeth Dalton. They're going to be talking to us a lot about hipaa. So much that we're doing part one and part two. So today we're recording and you're list and we've also gathered a lot of your questions as well. And the reason that I had reached out to Roy is probably months ago now is that I was noticing sometimes clients would email me and I'm not a big proponent of emailing, but some clients would email me because it's just easy and convenient. They have your email address and then they start Emailing you, right? And then I noticed I went on Facebook, and then Facebook was suggesting them as a friend, and I was, like, freaked out, weirded out. I'm like, but I signed a BAA with Google. I thought, that's what I'm supposed to do. And then, of course, I got in this panic because Kate and I actually teach laws, ethics, rules, medical errors. And then I'm, oh, my God, I'm not doing something right. And I was, like, undercover trying to figure out all this stuff and learning about virtue and encryption and this and that. And then I remember listening to a podcast with Joe Sanock and Roy, and honestly, like, just them talking about it, like, Roy just totally put me at ease. I stopped freaking out. I was like, we just need to contact him and get him on the podcast. Because if I'm freaking out about it, there's many other people freaking out about it. So I'm going to say it's okay to freak out, but we're going to give you some tips, tools to freak out less, get you HIPAA compliant. And that was good. And actually, this all started, I think I had a conversation with someone from a HIPAA company, and he started sharing with me. He's like, a lot of therapists think they're HIPAA compliant, but they're really not. And then he started sharing with me all of the tech side, and I was like, ah. So hopefully this podcast is going to bring you some peace of mind and ease, and you're probably going to really want to sit down and pay attention to this podcast specifically, so you can implement all of the things that Roy's going to talk about.

C (9:04)

Well, okay, so imagine you're a little group of people called Congress and it's 1996, so you have big hair and probably shoulder pads in your suit because you know it's 1996. So just to paint a picture, but. Well, so basically you figure out that healthcare in United States is way more. It's extremely expensive. That part did not get fixed, obviously, but it's extremely expensive compared to other nations. And people lose their insurance when they move jobs. When they're not employed, they lose insurance. A lot of the expense comes from the fact that every insurance company has their own billing system. And so there's a lot of expense just in medical billing. And also Senator Gore just invented this cool Internet thing. And so we should probably figure out maybe some cool way to use that. So basically, I don't remember who proposed the act. Maybe I should know that. They said we want to make this thing where an act that's going to try to standardize insurance billing and making sure so we can bring costs down by making insurance billing happen a particular way, a standardized way. And we want to set up a system where insurance billing can happen electronically using that cool Internet superhighway thing that just came out that no one knows how to use, but we know we can move information over, et cetera. And so they made the Health Insurance Portability and Accountability act because they don't know phonics. So it has two A's instead of two P's. And it basically does what these things often do, which is to kind of say, okay, that agency of the government is charged with making administrative rule, which you guys, I'm sure are familiar with. You guys teach ethics. So you gotta. People gotta know about administrative rule versus statute and law and all that. And you're making administrative rule to accomplish all these tasks. And the tasks are allowing people to keep their insurance between employers. That failed, didn't happen. It just didn't end up in the final version you have standardized insurance. That did happen. If you got a HCFA form. HIPAA defines what's in a HCAA form. That is all from hipaa, right? And we're gonna do the national Assurance billing system through the Internet. And definitely we have that big time. The early, most popular way of using that was office ally was like one of the early things set up to use that. Now everything from office outlet to your practice management system interfaces with that so that you can do your billing electronically. And of course it's how the insurance companies want you to do it because it's a lot less expensive. So HIPAA settled that up. The act was in 1996. The first rules came out. Well, they came into effect in 2003 for the privacy rule. And then the security rule came into effect in 2005, and somewhere there was a transaction rule which defines all those insurance. And then there's, you know, other things that happened since then. But that's the basic idea. And I'm sure you're gonna have more questions, so go ahead.

C (12:37)

So Parvey Laioth will talk to you while I fight this bear that happens to be in the vault before we talk about privacy. Yeah, so like, if, you know, if Laeth and I wanted to have a private conversation, we'd perform privacy. We would whisper because there's these two people on the computer that can hear me through this microphone. Or we'd get out of the vaults, which we can't do because of the bomb, you know, whatever. So the privacy is a thing you perform, and it's also an issue of rights and privileges. So, like, for example, our clients have rights to get copies of their records, which before HIPAA in mental health was not an assumed thing by any means and was very controversial and difficult to talk about. HIPAA was like, no, that's just the way it is. Americans have their rights to this information. The 2009 Hitech act updated HIPAA and they made it real serious when they finally made rules based on the Hitech act in 2013. Like they said, we are super serious about this whole people have their own rights to their information thing. Release of records is super important under hipaa, and that's a privacy thing. Rights to your information, rights to gain it, rights to know what information is being kept about you, rights to know who gets to hear it. Rights to. Rights to say who gets to hear it to a certain extent. For example, there's limits. Like if you're suicidal or homicidal, there's limits to that. That kind of thing. That's privacy. And so we often just Use the word confidentiality very broadly in our business. And one, there's many models of how confidentiality relates to privacy. But one that I find is useful in this context is to say that confidentiality is our ethical and legal duty to maintain client privacy choices to the limits of confidentiality. You know, for example, privacy, self harm, other harm, those kinds of things. Abuse of children or other vulnerable populations, you know, there's limits. Then my duty of confidentiality goes out the window. And have different duties, but without those limits, my duty of confidentiality says I got to protect the privacy choices of my client. I say choices on purpose. Right. Because clients can do all kinds of stuff with that that we can't do. It's their choice. Right. So security is how you do that. It's just the logistical. Everyday nitty gritty is just how do you go about doing that privacy thing? And so in a digital world where information is getting slung about the Internet all over the place and through different servers and machines and stuff like that, suddenly security can get more complex. That used to be a lot easier. You know, put in a locked cabinet and locked room. And then we have. We know our ethical standards for behavioral security techniques. Like, for example, if I asked one of you that, like, if I said to you, okay, if I asked one of you guys to tell me about Sam Smith, your client, Sam Smith, and you don't have a client called Sam Smith, would you say to me, oh, no, I, Sam Smith is not my client. You've got the wrong therapist. Would you say that to me?

C (17:59)

Yeah, you're very welcome. It used to be the Medicare folks, the cms, they used to do it. Yeah. And OCR took over in 2009 with the high Tech Act. I don't know why, but I guess Medicare was like, we're tired of this. I don't know. But yeah, so that's. Yeah, that's the npp. That's your basic. But you'll notice if you read your npp, it says you have a bunch of these policies, so you need to make those policies. Now sometimes for a lot of therapists, they just know what the MPP says and you may be able to Wing it. But ideally, you want a policy for how you release records. Like, how does someone request a release of records? What's your policy for? Like, how do you keep an accounting of disclosures? Right. Like, for example, if I tell somebody else about the client, if I disclose information to another client, which I'm only going to do with the release from the client, I have to keep track of who I've disclosed that information to and essentially what I disclosed. And the reason being that that's me taking care of the client's right to know what I'm saying about them. Like, if I'm going to be saying something about a client, they get to ask me, what are you saying about me? And so I need to have a log of that. It's called the accounting of disclosures. You know, and there's. There's other things in the privacy rule that get deeper that, you know, as much as we're big on trying to make sure people really understand how compliance works, most therapists could probably run without compliance, like defining exactly what's in a designated record set. Probably not necessary, because it's probably just whatever is in your record anyways. And there's also psychotherapy notes. But the thing about the privacy rule is that a lot of it is sort of things you need to do in certain circumstances or opportunities, like the psychotherapy notes principle, which is kind of a way that HIPAA allows mental health clinicians specifically to keep our process notes about the process of what's occurring separate from the record. So that when a client asks for a release of records, we don't have to give them our process notes. We just have to give them the main record with the usual kind of stuff that medical folks would think of as charting. You know, we need to give. That's what we need to give them. We don't necessarily have to give them our process notes, as long as they keep.

C (25:58)

Right. What has to happen is like I have to prove, or someone has to prove that you are not living up to standard of care, that you weren't acting the standard of care. So how do we determine that? So let's say the OCR calls you because I complained and you say, sorry, ocr, I'm not a HIPAA covered entity. Kick bricks. Except you're much nicer than that because they're actually pretty nice people at the ocr. They aren't HIPAA police. They're actually mostly helpful people. So, you know, and they're like, oh, okay, well, never mind. Have a nice day. You're not a covered entity. We don't have the jurisdiction to do this. Wow. So I go, right, oh, sorry, yes, I went to the feds. I should have gone to your licensing board. That's what I should have done. Or I should have gone to the courts for a malpractice suit to get money out of you and your insurance company. You know, this is what I should be doing. Right. And either in the case of the licensing board, I'd have to prove that you're violating licensing board rules. Right. In the case of a malpractice suit, I have to prove that you're negligent. Right. Which means you are not working to standard of care. That's what I would have to prove. Right. So the first thing my lawyer has to do is establish what is the standard of care for therapist in Florida in your case, who, in terms of keeping emails secure from security breaches, what's the standard of care? So when we're going to look for things that define standard of care, what do we got? Well, Florida does have data breach laws, but those are going to apply to you either way. And in fact, I could probably try to take some action under that law as well, but generally the data breach laws aren't going to benefit me. I can't sue you. I can just tell the Florida Attorney General you had a data breach and if it only impacted one or two people, it may not be a big deal. Right. They may not really do anything about it. But I went from suing you and doing something else. And so my attorney is going to have to look for something that explicitly states that you explicitly describe something you didn't do and you should have done. Right. Okay. About all we got is hipaa. Like, HIPAA would describe what you should have done and didn't do, ostensibly. Assuming you assume you didn't just get really unlucky. Right. With this, with this breach, you know, assuming it's because you did do something like reuse passwords or something silly like that. Right. So if you go to HIPAA and HIPAA standards, they're gonna say, okay, so, you know, Katie. Sorry, Katie. Katie was, was negligent. Because there's a standard out here that says this is how you take care of the security of email programs. And she didn't do it. You know, she should. She. That's unprofessional. That's, that's, that's substandard care. She's negligent. We want five bazillion dollars. And so the judge has.