Stop Avoiding Talking About Compliance

Tiff and Kristy take a look at patient privacy and the regulatory compliance associated with that privacy, including HIPAA and OSHA. They touch on their own experiences with compliance, how to better educate your practice, what not to do, and more.

Episode resources:

Subscribe to The Dental A-Team podcast

Schedule a Practice Assessment

Leave us a review

Transcript: 

The Dental A Team (00:01)

Hello, Dental A Team listeners. We are so excited to be here with you today. I have Kristy on crew with me. We have a slew of podcasts we're recording and just some really, really exciting information. We're gonna make it as exciting as we can, at least, that we wanna get out to you. We are more than halfway through the year, which is pretty massive. And so we're gonna be talking about...

 

a ton about how to end the year, things and pieces to look forward to, things you should be doing now to wrap up for the end of the year, and realistically things to look forward to for the upcoming year, which at this point of recording is 2026. So no matter what year you're listening to us, a lot of this should still be incredibly valuable. Kristy, I am so excited you're here with me today. Thank you so much for clearing your schedule, being here.

 

being open to this and just always coming with some really invaluable information for our listeners. How are you today, Kristy?

 

DAT Kristy (01:00)

It's a good summer day and a good day to be with you as well. So happy to do it.

 

The Dental A Team (01:04)

Thank you,

 

thank you. And for those of you who may not know, Kristy, Kristy lived in Arizona a long time ago. she originally, like her formative years were here, but then she left Arizona for quite a little while and she's recently relocated back to the desert. And she decided to come right at the beginning of summer, which I used to tell people like,

 

don't move here in the summer, like come in different months. But then I started realizing, I'm like, well, if you move here in the summer, you get the worst of the worst. And then the rest of the year is like icing on top of the cake. So Kristy, I actually think you did it in the right direction. And I keep telling you, I think you brought some awesome weather with you this year because we have not broken record heat this year for like the first time ever.

 

Honestly, we keep breaking records every year and I'm like, these are records we don't need to break. And this year, I think the record has been that it's been so nice. Like it truly, truly has been really light summer. So Kristy, thanks for bringing your weather with you and giving us a little reprieve here in Arizona. So I told you we're going to make these as fun as we possibly can. You guys, we always aim for that fun is actually one of our core values. So it's something we work really, really hard for.

 

I say that today because I really wanted to talk to you guys about some regulatory compliances, which just even in those words sounds like womp womp, right? Like we're just, how do you make that exciting? Well, with the Dental A Team, Dental A Team can make anything exciting. We can have fun with whatever we want in everything. We truly believe that if we're not having fun, why are we even doing it? So it doesn't mean that things aren't hard, things aren't difficult, that you won't have to push through hard things. It just means that there should be fun on the other side.

 

and it shouldn't be, you know, tears of pain the whole way through. So here we are, regulatory compliance. You guys know that this is actually really important in the dental industry. You guys have all heard of OSHA. So we'll dive into a little bit on the OSHA, but you guys have also heard of HIPAA. And I have to say, and Kristy, you can tell me what your thoughts are as well, I have to say that when I was in practice, like physically working in an office, we never talked about HIPAA.

 

We talked about OSHA constantly, like OSHA is going to come in and you've got to have everything six inches from the ceiling and off these certain walls. And you've got to have so many fire extinguishers and the fire escape plans and like all of these, you know, barriers and masks and gloves and don't wear gloves outside the door. All of these pieces for OSHA safety compliance, but

 

I never heard about HIPAA. I knew as a front office team member that patients had to sign the HIPAA forms and that they had to update them every so often, but I didn't actually know what it was. And when patients would ask me like, oh, what am I signing? I'm like, ah, it just says we're not going to give away your information. Right. And I'm like, I don't know if that's what it says or not, but like, that's what I heard someone say. And so I'm just repeating it. Right. So Kristy, I don't know if you had a different experience in office, but I really truly felt like until

 

I had to train people on it until I had to be like, no, you have to do HIPAA in the office. And until as a company, we had to start taking our own HIPAA courses every year. I had no idea exactly what it meant for a dental office. And Kristy, you may have had a different experience, but tell me what was your experience when it came to HIPAA in your dental practices that you've worked in?

 

DAT Kristy (04:36)

Yeah, my experience

 

was actually you made me laugh. It was very similar to yours. I think it was what around 2013 that those forms came out and it was pretty funny because when it first started even patients were funny about it. Like I remember this big long form and you'd hand it to patients and say the same thing. ⁓ it just means we're not going to sell your information or give it to anybody and patients would start reading it and they're crossing things out. And then I'm asking my doctor like how

 

The Dental A Team (04:50)

Yeah.

 

Yeah.

 

DAT Kristy (05:06)

can they just rewrite it?" And he's like, it doesn't matter. It is what it is. It's just a form. And yeah, so really I started the same place you did. And then later years, ⁓ we ended up doing more formal training on HIPAA. But yeah, started in the same place.

 

The Dental A Team (05:23)

Yeah, I remember

 

those sheets. They were like longer than it was. It was like a car contract.

 

where was like you had to fold it a certain way, like they were longer than the rest of the sheets and my patients did the same thing. They're like, well, I don't really agree with this. Like, and they just cross it off and then initial it. And I'm like, all right, like whatever, I just need to scan it into your document center. Like that's all I've got here, right? And if it's like in the paper folder, I had to like fold it so that it would fit. yeah, it was around 2013 and it was like so odd. And then every year they had updates to it. And I was like, I don't know what any of this means, except I did know at the bottom.

 

them it said, if we were to release your information, who would you want it released to? So my point of that is it's

 

2025 right now, I don't know what year you're gonna listen to this. 2013 we started this and it took many years for any of us to really learn and understand what it meant, let alone our patience even know and understand what it means. But it is incredibly invaluable and I'm not here to teach you HIPAA by all means, that is never my gig ⁓ or OSHA, but I do know that there are plenty of courses and even just like online forums or...

 

whatever that will go through it. There are two sides to it and they're incredibly important, especially for business owners. So doctors and owners out there, my doctor too, I was like, what is this? Just like Kristy, what you said, can they do this? He's like, I don't know. Just like, it's just a new form that they told us we need to do. So just do it. And I'm like, okay. He had no idea what it meant either. He just knew it was really important. So.

 

Doctors go get versed in it. We actually have to take a compliance course every year. All of us do for HIPAA compliance on the medical side, but then also on the business side. And that comes down, it boils down to really privacy, right? And what that looks like. And it actually will take you through what it looks like as far as electronic privacy, verbal privacy, ⁓ patient charts, like how long do you have to keep things? Where should they be kept? Like certain

 

certain things that honestly and truly your front office is looking up all the time. I don't know how many times I asked like wait a second how long do we have to keep these x-rays for? Wait how long do we have to keep these boxes of files for? Like we're going digital which crazily enough there's still plenty plenty of practices out there that are not digital. ⁓

 

I know some near and to my heart that are not digital. So like, I remember, but it's just these, these file boxes that you get from Staples and you put them together and we're putting the files in there and we're marking the year that we put them in there so that we could wait the right amount of time. But still in the back of my head, I'm like, is this even right? Like, am I waiting enough time? We would put the date that we boxed it and then the date that it could be destroyed, like, you know, destroy date.

 

But still I was like...

 

⁓ this is still kind of scary. Like, am I doing this right? So my suggestion is to always make sure that you take those courses and that you're well versed in it, especially as a business owner. And I'm saying this after you're three of having to take the HIPAA course online for business compliance for our company, because it's really hard, you guys. I'm not gonna lie. When I go through it, it's like, Karen, I have this game that we play on who's going to get the better score. And to truth be told, like, it's like a barely

 

passing score and we're like how did how am I still not getting this we read through the stuff we tell we watch the videos and we get to the end and we're like what the heck I still didn't understand it so go take those courses it's just online it's super easy I'm sure we can throw you over a link if you want it so HIPAA I actually wanted to spend some time instilling in you the importance because I think the only thing we hear in dentistry is OSHA and we know so much of the OSHA stuff

 

But with that said, you also need to focus in on the OSHA. And Kristy, I don't know if you guys had this one too. I had that big red OSHA book that always went in the same spot up above the dental assistance computer so that we always knew where it was. We had the OSHA one, we had the MSDS sheets, and it was like, you did not mess with these books. They were always updated, the, you know, needle stick protocol. But still, you'd go in there and you're like somebody, somebody stuck themselves and you're just like,

 

frazzle and you're like I don't know what to do even though we've got this OSHA book that tells us what to do it was still a lot so Kristy how did how did you guys do HIPAA and OSHA within your practices like how did you make sure that we you guys had everything that you needed and then how do you train offices to do that now?

 

DAT Kristy (10:06)

Yeah, that's

 

It's a good thing that you're touching on it because it's one of those things that I think even offices tend to not do because it's so complex. I will say ⁓ we just made it part of our yearly routine. And this is perfect timing because we're coming to the end of the year. And as we're future planning for next year, even setting our goals for the practice and all of that, looking at the calendar and making sure those days are marked out, just like you would your CPI.

 

The Dental A Team (10:14)

Yeah.

 

DAT Kristy (10:37)

are, you know, make sure your OSHA is booked every year in your ⁓ HIPAA training because they are serious, right? And they're one of those things, especially like OSHA, it could shut you down if you weren't compliant. So it is very necessary, but I would say do it as part of your yearly planning and just make sure it's booked on your schedule every year.

 

The Dental A Team (11:02)

I totally agree with you. And I think one piece with that is to make sure you guys understand it too. I know that for us, in my practice, we always stressed about the OSHA because we were like, if they ever come in. And that's like one space of it, right? For sure, you want to be compliant. You want to have the right spaces. If they were to come in, you want to have everything you were supposed to have for sure. But on the flip side of that, like the reason that they do that isn't because they want to come in and like give you a bad grade or get you

 

in trouble, right? They do it because they actually want you utilizing the information. They want you knowing it and they want it to be helpful in keeping your business safe. And so

 

not only making sure that you're compliant for the passing grade, but that you're compliant in the fact that you understand it and you're able to use it because it really is truly beneficial for your practice. And there are actually some really valuable pieces in there, just like CPR. Like we have to take CPR to be compliant, but the day that you have to use it is the day you're like, thank God that they made me do that. Right. Like, gosh, this could have been really bad. Right. The day that my son

 

bless his freaking four-year-old heart at the time, decided to put gummy worms in his frozen yogurt and they turn into rocks and he's choking on it in the middle of the frozen yogurt store and I, thank God, knew what to do to...

 

pull it out of his mouth and make sure he doesn't have to resuscitate him, all of these pieces, right? We undervalue things because we think we have to do it because someone's telling us to. And if we don't, we're gonna get a bad grade or we're gonna get a slap on the wrist or whatever. Yes and. Like, Kristy, I love when you say yes and. This is a yes and situation. Yes, get the good letter grade, don't get a slap on the wrist, don't get a fine and.

 

save lives with this information too. HIPAA, you're not going to save a life, but guess what? It's better to be super safe because, I mean, honestly, cybersecurity is wild. And I have had many practices while consulting that have been hacked. And I don't know if you all remember a couple of years ago now, was it last year maybe? Yeah, all of the insurances got hacked and we were without insurance payments for three or four months. We couldn't even submit claims. Like it was wild.

 

these things do happen and if you're not HIPAA compliant, if you don't know what it means, things aren't stored correctly, you just you have a lot of patients that could be in a lot of trouble. So not only are you going to get in trouble from a business standpoint with you know the regulatory compliance people,

 

but you're putting your patient's information and your own information at risk. You've got payroll documents on there. You've got your team's information on there. There's a lot of very sensitive information that's stored on there. So OSHA is incredibly valuable. Know it, train on it. I know we used to do quarterly training for OSHA. We'd add it into our monthly team meeting. We'd do a two hour monthly team meeting and at least 30 minutes of that once a quarter would be OSHA training. And so it would be training on a

 

certain subject from the OSHA book. They literally give it all to you ⁓ and then what I would do now is actually add in some of that HIPAA training with it like quarterly, monthly, however you guys want to do it and yearly, especially making sure that we're all reviewing it, that we're all up to date, that we all understand it and we understand any changes because they change them at the drop of a dime and Kristy, I don't know if you've ever received a letter from OSHA saying, hey, these are the updates but I have not.

 

I've never seen anything that was just like, guess what? We've updated and changed. So you guys have to go out and look for that information on your own.

 

Kristy, how did you handle, I know in my practice we had two people. We had one that was responsible for OSHA and then one that was responsible for HIPAA, which at that point, you know, just made sure that we did the sheets. Now we know there's much more involved to it, but how did you handle that in your practice as far as someone like the accountability piece to it? And I never wanted the accountability myself, my doctor.

 

He's a very busy man. Personally, professionally very busy. I ran his schedule ragged. He was constantly on the move. There's no way on this earth.

 

that he was ever going to be able to hold anything accountable, especially Osher or HIPAA. So I never made him the owner of that. And then as the office manager, I tried to stay out of that lane as well because I didn't want it to get mixed up in other pieces. But Kristy, how did you handle it in your practice and how do you see practices now handling that kind of responsibility and accountability piece?

 

DAT Kristy (15:46)

Yeah. ⁓

 

Honestly going back to what you said, it's it's having a champion, right? It doesn't mean that they're the only one responsible but somebody that is the point person that ⁓ Is checking on those things and reporting back? You know how it kind of makes me think of when you go into a restroom at a chain store one of those and they have those Checklists about they check the bathroom at a certain time using something like that to know

 

The Dental A Team (16:15)

Yeah.

 

DAT Kristy (16:18)

⁓ Because even your fire drills guys we're supposed to have fire drills and make sure team right on Boarding did we teach them where the I wash station is did we show them our? Meetup area if something happens, so It's important and like I said have that point person that can report back

 

The Dental A Team (16:22)

Yeah.

 

DAT Kristy (16:38)

Potentially in one of your team meetings just check on it. Just make sure it's like we do our checklist and chart audits ⁓ I was gonna circle back to you too because I won't name names But we all heard of the corporate entity that also got hacked, right? It's maybe been a couple years now, but you know Think of that they they're a big nationwide chain lots of money, right? And so even if they it happened to them like us as little

 

The Dental A Team (16:40)

Yeah.

 

Yeah.

 

DAT Kristy (17:08)

guys that don't have that kind of money to spend, we have to be very diligent. I would also do like chart audit type thing. Maybe not necessarily chart, but listen, listen to your admin people. Are they breaching HIPAA in conversations? You know, are they checking IDs? Are we even getting photo IDs from patients?

 

The Dental A Team (17:18)

Yeah.

 

No, most places

 

are not getting photo IDs.

 

DAT Kristy (17:34)

Yeah.

 

And a lot of people, you know, they look, well, we want to know who's coming in. So we want to get your photo. No, don't share your secrets. But on the same token, like it is part of compliance. And if, if you guys have ever heard of red flag rule, if you're accepting insurance, you have a due diligence to make sure that that person is who they say they are. And I have experienced where somebody came in portraying they're somebody else. So ⁓ they're little things, but they can be.

 

big things and just like that corporate entity it was flashed all over the news and so it's also about saving our reputation those things are hard to come back from.

 

The Dental A Team (18:16)

I totally agree. That's a really great point. And I don't think I know many practices, maybe a handful, that really truly understand the value of the ID portion of it. And I do hear that too, like, we want to know who's coming in. Yeah, but your ID is not going to... A lot of practices will use it for both, and I think that's great. But my picture on my ID, you're never going to know that it's me, right? But at least you took it. It's got my information. It's got my statistics, my demographics that match up

 

within my insurance card because that does happen constantly.

 

constantly patients or practices are reporting that they've had patients that come in with the insurance, but it's not actually the person who's on the insurance card. happens a lot. And as you're taking payments as well, like, you know, I'm, I'm surprised we don't get asked more often for our credit cards, but when, or for our ID with our credit cards, but when I do, I'm always like thrown off. But then at the same time, I'm like, actually, thank you for caring enough about my safety, right? My electronic safety that someone's not using my credit card. Who's not actually them. Cause that has happened.

 

I have had those charges pop up that my credit card is like someone's at Circle K trying to use $5 and they're just like testing it, right? So I do appreciate that and I value it and I think our patients would too. But it is a piece of the record keeping that you're supposed to have if you are going to accept insurance from those patients. So it is a massive piece. that was a great, great point, Kristy. Biggest takeaway today, you guys, two biggest takeaways. Go figure out what HIPAA is if you don't know what it is, medical and

 

and business like standing business HIPAA, go figure both of those things out. Make sure that you're OSHA compliant, that you've got your book, you've got your sheets, you've got everything that you're supposed to have and that you're training on both of those because those make them compliant as well. And then make sure you've got point people to ensure that these trainings are happening to ensure that we're up to date with everything we're supposed to have. So super easy, you guys, you just you got to dig in and do the work. And I challenge you guys to go take that HIPAA test. It's hard.

 

Even after taking the course that leads up to it, it is not easy. and I both have struggled with that sucker. So I challenge you to go take that ding test and tell me you know anything about HIPAA. HIPAA? OSHA? K?

 

Just be compliant, you guys, and figure out an easy way. Like Kristy said, schedule it every year. Schedule it out. You've got your Ops manual update, so do your Ops manual update, your OSHA update, your HIPAA updates, and then make sure that you've got a point person probably for each of those, and they should be three separate people in my opinion if you've got the capacity within your staffing to do it. Kristy, thank you so much for your nuggets and for letting me probe questions over to you about your past as well. You have always, always amazing points.

 

So thank you for being here with us. Is there anything else you can think of that I missed in that wrap up that they should be doing?

 

DAT Kristy (21:09)

No, I think you hit it all. The only thing we didn't touch on was make sure you're doing PCI compliance because you mentioned credit cards and taking them. There's still a ton of practices that I go in and they're writing down cards. Guys, get rehearsed. You could be putting yourself into ⁓ some situations by doing that. So that would be the only other one that I would add in the mix.

 

The Dental A Team (21:15)

there.

 

That's a that's actually a really good point. And I've had a couple of practices text me some office managers and be like, what does this mean this PCI like people don't know what that means. And they don't know what that is. So make sure your office managers do know what that is. It goes right along with HIPAA. And those two go hand in hand. So just make sure, again, that you're not running the team that's like, I don't know, we're just supposed to sign this that they actually know what they're for. Because with a reason behind it, things get done. So that was massive, Kristy, thank you for remembering the PCI compliance. Alright, guys, go do

 

the things they're not really that hard except for that HIPAA test and I do challenge you to go take it because I just want to hear from you on how fun it was. But go do the things if you ever need anything you guys know where to find us [email protected] we are here to help you I know that we do the HIPAA test every year you guys know especially if you're my clients I don't actually know

 

the link for that, we can get it for you. So [email protected]. We can send you the information for the company that we utilize within our team and our company. Just let us know. And as always, drop a five star review. We'd love to hear what you thought about this. And if you have any regulatory information or things that you'd like to share, put it in that review because people really do read through those and they'll catch it as well. Thanks so much, guys. We'll catch you next time.