Group Practice Tech
Group Practice Tech by Person Centered Tech: a podcast where we help mental health group practice owners ethically and effectively leverage tech to improve their practices.
info_outline
Episode 633: Supporting Your Team & Protecting Your Practice -- with Niki Ramirez of HR Answers
10/16/2026
Episode 633: Supporting Your Team & Protecting Your Practice -- with Niki Ramirez of HR Answers
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we interview Niki Ramirez of HR Answers about how human resources plays a role in effective leadership and a successful group practice. We discuss: Skills that make clinicians effective leaders, and common friction points for clinician leaders How Niki helps group practice leaders develop effective communication skills Progressive discipline, directive coaching, and non-directive coaching The importance of clear expectations and policies Shared knowledge leading to shared vision and aligned action Course correcting if you don’t have HR pieces in place HR foundations to have in place when launching a practice How HIPAA compliance and risk management and HR components work together Managing offboarding and employment transitions How to work with Niki and HR Answers Listen here: For more,
/episode/index/show/grouppracticetech/id/43315324
info_outline
Episode 632: Device Termination: How to Retire a Device That Won't Turn On
10/09/2026
Episode 632: Device Termination: How to Retire a Device That Won't Turn On
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share how we recommend behavioral health practices safely and appropriately dispose of devices that won’t turn on. We discuss: Why smashing devices with lithium-ion batteries is a safety hazard Documentation for disposing of devices that won’t turn on Making sure the device actually won’t turn on Devices that are safe to physically destroy Electronic device recycling programs Listen here: For more, PCT Resources — Practical tools, staff training, and ongoing support to help group practice leaders secure and document the devices and workspaces their teams use. Premium includes: Device Security Suite: Assignable staff HIPAA Security Awareness: Bring Your Own Device training, plus access to the Device Security Center with step-by-step, device-specific tutorials and registration forms for securing and documenting all personally owned and practice-provided devices—for all team members, at no per-person cost. Remote Workspace Security Suite: Assignable staff HIPAA Security Awareness: Remote Workspaces training, plus access to the Remote Workspace Center with step-by-step tutorials and registration forms for securing and documenting remote workspaces—for all team members, at no per-person cost. Direct support and consultation: Weekly live and recorded Group Practice Office Hours, including a monthly session featuring therapist and attorney Eric Ström, JD, PhD, LMHC, plus additional direct support and consultation resources. — Practical resources and ongoing support to help solo clinicians secure their devices and workspaces and make informed decisions as practice questions arise. Premium includes: Device Security Instruction Center: Step-by-step tutorials and registration forms for securing and documenting personally owned and practice-provided devices. Home & Mobile Workspace Security Instruction Center: Step-by-step tutorials and registration forms for securing and documenting home and mobile workspaces. Direct support and consultation: Weekly live and recorded Office Hours, including a monthly session featuring therapist and attorney Eric Ström, JD, PhD, LMHC.
/episode/index/show/grouppracticetech/id/43228138
info_outline
Episode 631: Supporting the Whole Client: Physiology, Mental Health, and GLP-1s with Dr. Kristen Allott
10/02/2026
Episode 631: Supporting the Whole Client: Physiology, Mental Health, and GLP-1s with Dr. Kristen Allott
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we chat with Dr. Kristen Allott about how mental health providers can support client well-being by looking at the foundational aspects of wellness. We discuss: How mental health is impacted when the power supply for the body (food, sleep, exercise, breathing) isn’t adequate Our primary attachment being to our body The impact of adrenaline in the body, and how that impacts folks with complex trauma, especially if they don’t eat regularly How understanding wellness and the nervous system can help mental health professionals serve clients better The toolkit Dr. Allott would provide for every mental health practitioner Therapist wellness and why therapist burnout is so severe Self-care vs. self-neglect Dr. Allott’s upcoming training on GLP-1s and mental health with PCT Why therapists are uniquely situated to provide care for people managing the effects of GLP-1 medications Listen here: For more, Resources for Listeners PCT Resources Live (and recorded) CE training: Join Dr. Kristen Allott, ND LAc, for this three-credit-hour training, presented live on October 30, 2026, with on-demand self-study CE course access also included. This training will help therapists understand how GLP-1 medications may be supporting or compromising a client’s well-being and provide a framework for navigating client conversations, setting realistic expectations, and “tipping the scales” toward safety and efficacy — all while remaining within their scope of practice. Resources from Dr. Kristen Allott To learn more about Dr. Kristen Allott, visit . The homepage links to all of her free handouts and videos, which you can share with your clients. You can also sign up for the , a free monthly virtual meeting where you can ask Dr. Allott your questions and she dives deeply into hot topics. You can learn more about her workbook, , which walks you through the steps she uses to identify the physical causes of mental health challenges. Be sure to follow Dr. Allott on social media: Finally, a quick note: Dr. Allott can only see individuals as patients if they live in Washington state. However, she is available to be contracted as a consultant for mental health professionals who want to engage more deeply with their clients and care for the whole body. She is also available for individualized seminars.
/episode/index/show/grouppracticetech/id/43127578
info_outline
Episode 630: “I Have to Report This, Right?” Mandatory Reporting and the Risk of Future Harm
09/25/2026
Episode 630: “I Have to Report This, Right?” Mandatory Reporting and the Risk of Future Harm
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we’re discussing a topic that’s come up frequently in the wake of the Clancy case: mandated reporting. We cover: Misconceptions around mandated reporting Mandatory reporting vs. other legal and ethical duties that apply What a clinician needs to evaluate when there is concern harm may occur Permission to disclose vs. duty to protect Tarasoff duties and liabilities Determining what is required and what is permitted under applicable law The framework that Eric Strom and Liath presented in the related CE course to determine what to do in these situations Listen here: For more, Resources for Listeners PCT Resources On-demand CE course: When a client reveals possible abuse or a risk of harm, how do you determine whether a report is required, a disclosure is permitted, or another protective action is needed? In this three-hour legal-ethical CE course (APA and NBCC approved,) attorney and clinician Eric Ström and PCT’s Liath Dalton work through these distinctions and their implications, real-world scenarios, differing state laws, and the decisions clinicians face when confidentiality and safety intersect. The course includes the PAUSE framework and worksheet to help you reach and document a proportionate, client-centered response. “This was one of the better, more involved and detailed CE’s I have ever attended” “After working 40 years as a therapist, and 25+ of those years in private practice, this is the FIRST time ‘Tarasoff’ (its hx and utility) was made clear!” On-demand CE course: For clinicians practicing across state or national borders, this course examines how client location, clinician location, and licensure jurisdictions can affect confidentiality, mandatory reporting, emergency response, and other obligations. 3 legal-ethical CE credit hours. APA and NBCC approved. Direct Support and Consultation: — For group practice leaders who want support as questions arise, Premium includes weekly live and recorded Group Practice Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. — For solo clinicians who want support as practice questions arise, Premium includes weekly live and recorded Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. Additional resources — Guidance on when HIPAA permits mental health information to be shared, including circumstances involving safety concerns. — Explains HIPAA’s permission to disclose information to someone reasonably able to prevent or lessen a serious and imminent threat, when the applicable conditions are met. — An overview of reporting requirements and how they vary across states.
/episode/index/show/grouppracticetech/id/43025663
info_outline
Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know
09/18/2026
Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation. We discuss: Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles Opportunistic vs. forced TLS Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace What HIPAA actually requires for email security Where NIST (National Institute for Standards of Technology) guidance fits in The actual risk analysis for legacy TLS Benefits of secure email services, and when it might make sense to cancel Data to gather from your secure email service to do your own risk analysis Listen here: For more, Resources for Listeners PCT Resources Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management. PCT Article: PCT’s detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate. Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS. PCT Article: PCT’s framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context. — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT’s Comprehensive HIPAA Security Compliance Program bundles: Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources The regulation itself, including the Transmission Security standard at § 164.312(e). HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule. HHS explains the Security Rule’s risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards. Google’s current documentation on Gmail’s support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable. NIST’s technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.
/episode/index/show/grouppracticetech/id/42945333
info_outline
Episode 628: HIPAA Security Officer: Who Leads, Who Does the Work, and Who’s Liable?
09/11/2026
Episode 628: HIPAA Security Officer: Who Leads, Who Does the Work, and Who’s Liable?
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we go over some common questions we get at PCT about the HIPAA designated Security Officer role. We discuss: The primary purpose of the Security Officer’s role What is actually required of the person in this role Determining the right person for this role in your practice Tasks that can be passed off to a Deputy Security Officer Operational structure for Security Officers and Deputy Security Officers Whether the Security Officer or Deputy Security Officer hold individual liability in the event of a breach Listen here: For more, PCT Resources — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT’s Comprehensive HIPAA Security Compliance Program bundles: Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training – A foundational training for anyone who finds themself in the Security Officer role, including 10 CEs across three separate trainings.
/episode/index/show/grouppracticetech/id/42860560
info_outline
Episode 627: Key Takeaways from Day One of the 2026 NIST–OCR HIPAA Security Conference: Security Rule Updates & Risk Analysis
09/04/2026
Episode 627: Key Takeaways from Day One of the 2026 NIST–OCR HIPAA Security Conference: Security Rule Updates & Risk Analysis
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we recap what behavioral health practice owners should know from day one of the HIPAA Security Conference. We discuss: The timeline for proposed Security Rule changes What practices must have documented in writing according to the current Security Rule Encryption being reasonable and appropriate in almost every practice environment Expanding risk analysis enforcement initiative to include risk management Why risk analyses are foundational, and what they have to include that a gap analysis doesn’t Listen here: For more, PCT Resources — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT’s Comprehensive HIPAA Security Compliance Program bundles: Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training — Our previous update on the proposed HIPAA Security Rule changes, the regulatory uncertainty surrounding them, and why practices should continue strengthening their security under the current rule while the rulemaking process unfolds. — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources — The Office for Civil Rights’ summary of the proposed Security Rule modifications, including greater specificity for Risk Analysis, written documentation requirements, defined compliance intervals, and proposed changes to “addressable” implementation specifications. — The current federal regulatory agenda lists the rulemaking as a long-term action with final action anticipated in July 2027. This is a planning estimate rather than a legal deadline or guaranteed publication date. — Official guidance explaining the required scope and elements of a HIPAA Security Risk Analysis, why “addressable” does not mean optional, and how Risk Analysis provides the foundation for an organization’s risk-management decisions. — A collection of official Security Rule resources, including OCR presentations on Risk Management and Recognized Security Practices, educational papers, and links to relevant NIST publications.
/episode/index/show/grouppracticetech/id/42734660
info_outline
Episode 626: Is Google Search Console HIPAA-Friendly? What Therapy Practices Can Learn Without Google Analytics
08/28/2026
Episode 626: Is Google Search Console HIPAA-Friendly? What Therapy Practices Can Learn Without Google Analytics
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a HIPAA-friendly way for therapy practice owners to get useful information about how their websites are performing, via Google Search Console. We discuss: What Google Search Console can tell you about your website The crucial differences between Google Analytics and Google Search Console Why Search Console is permissible for therapy practice websites Caveats and what to consider when configuring Search Console Listen here: For more, Resources for Listeners PCT Resources Podcast: — The companion episode explaining why Google Analytics is not appropriate for therapy-practice websites and how individually identifiable website activity can become protected health information. PCT CE course: — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD, PhD, LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements. — Includes step-by-step, video-based guidance for securing, configuring and leveraging Google Workspace appropriately for a therapy practice — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT’s Comprehensive HIPAA Security Compliance Program bundles: Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Resources — Google’s free tool for understanding how a public website performs in Google Search, including the search terms that result in a website appearing, impressions, clicks, search position, indexing issues, and website-health information. — Google’s explanation of the search-query, page, country, and device information available through Search Console. It also explains that some queries are omitted from reports to protect searcher privacy. — Google’s instructions for verifying ownership through methods such as a DNS record or HTML file or tag. Google Analytics and Google Tag Manager are optional verification methods and do not need to be enabled to use Search Console. — Guidance for limiting Search Console access and periodically reviewing who has owner- or user-level access to a practice’s website data. — Google’s guidance for keeping sensitive, authenticated, or otherwise inappropriate pages out of search results and removing pages that have already been indexed.
/episode/index/show/grouppracticetech/id/42578220
info_outline
Episode 625: Google Analytics for Therapy Practice Websites – The HIPAA Risks Explained
08/21/2026
Episode 625: Google Analytics for Therapy Practice Websites – The HIPAA Risks Explained
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we unpack the reasoning, step by step, behind PCT’s position on Google Analytics for therapy practices. We discuss: Can website activity constitute Protected Health Information? HIPAA’s definition of healthcare operations vs. HIPAA’s definition of marketing Business Associates, and how there is no BAA available for Google Analytics The disclosures required for HIPAA authorization for marketing activity Cases where collecting PHI without a BAA has gone awry The risk context in an increasingly AI world The takeaway: is it permissible for therapy practices to use Google Analytics on their practice websites? Uniting as an industry to demand BAAs for Google Analytics Listen here: For more, PCT Resources — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD PhD LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements. weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training Resources — OCR’s current guidance on how the HIPAA Privacy, Security, and Breach Notification Rules apply to website and app tracking technologies. It addresses when website activity may constitute PHI, tracking on authenticated and unauthenticated webpages, Business Associate Agreements, marketing disclosures, HIPAA authorization, and risk analysis. — Google’s own guidance for HIPAA-regulated organizations. Google states that regulated entities must not expose Google Analytics to PHI and that Google does not offer Business Associate Agreements for Google Analytics. — The federal court decision that partially vacated OCR’s tracking-technology guidance regarding an IP address combined with a visit to an unauthenticated health-related webpage. The decision is important for understanding what may—and may not—constitute individually identifiable health information in the context of website tracking. — HHS guidance on when a person or company becomes a HIPAA Business Associate, including when a vendor performs data analysis or other functions involving PHI on behalf of a covered entity. — Guidance on HIPAA’s specific definition of marketing, the exceptions to that definition, and when written individual authorization is required for uses or disclosures of PHI for marketing. — The FTC’s action concerning BetterHelp’s disclosure of sensitive consumer health information to third parties for advertising purposes. Importantly, this was FTC consumer privacy enforcement, not HIPAA enforcement, but it provides a real-world example of the risks associated with health-related information flowing into advertising and tracking ecosystems.
/episode/index/show/grouppracticetech/id/42499120
info_outline
Episode 624: The Math Has to Math: Building a Sustainable, Profitable Group Practice in 2026 — with Julie Herres of GreenOak Accounting
08/14/2026
Episode 624: The Math Has to Math: Building a Sustainable, Profitable Group Practice in 2026 — with Julie Herres of GreenOak Accounting
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we chat with Julie Herres of GreenOak Accounting about how there’s still good money to be made in private practice, and what you need to know to make it. We discuss: Profitability and intentionality, and what it takes to stay on track Rate changes and cost of living changes impacting group practices How Julie would respond to practice owners who are feeling the squeeze right now Setting up the financials for a healthy practice Compensation for pre-licensed vs. fully licensed clinicians Julie and Liath’s predictions for the trend to swing away from VC-backed therapy platforms and back to smaller group practices What group practices can bring to the table that these platforms can’t Metrics to track to be able to make informed and aligned decisions in the short, medium, and long-term The value, in time, money, and cognitive overhead, in outsourcing to a trusted expert Julie’s upcoming event in September for group practice owners, Group Practice Con Listen here: For more, Resources: — Hosted by Julie Herres, founder and CEO of GreenOak Accounting, this podcast helps private practice owners understand their finances, improve profitability, and make confident, data-informed business decisions. — Specialized accounting and financial guidance for therapists and mental health practices, with services designed to support solo practitioners, group practices, and practice owners navigating growth and expansion. — Julie’s practical, therapist-specific adaptation of the Profit First framework, designed to help practice owners build profitability into their financial systems, pay themselves appropriately, and create a more sustainable practice. (Sold Out!) — A tactical, growth-focused conference for established group practice owners, co-hosted by Julie Herres and Joshua Brummel. The 2026 event takes place September 9–11 in Chicago and is currently sold out, but practice owners can join the waitlist through the conference website. PCT Resources: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training
/episode/index/show/grouppracticetech/id/42432095
info_outline
Episode 623: Now You Can Secure Outbound Email in Google Workspace
08/07/2026
Episode 623: Now You Can Secure Outbound Email in Google Workspace
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we have an exciting update about how to make your Google Workspace email HIPAA-secure. We discuss: The encryption mechanism, TLS, and how it fits into HIPAA Security Rule standards Ways that behavioral health practices typically manage email security Escrow style email The transmission security standard under HIPAA Google’s transparency report about safer email HIPAA-friendly conventional email vs. HIPAA secure email Two limitations to be aware of and a risk management and ethics perspective How to set up this configuration in Google Workspace Listen here: For more, PCT Resources: Article: Read PCT’s complete explanation of the global routing rule, what enforced TLS changes for mental health practices, what it does and does not protect, and the steps practices should take before relying on it for email containing protected health information. Access PCT’s video tutorial demonstrating how to configure the global outbound routing rule, along with additional step-by-step guidance for configuring Google Workspace for HIPAA-compatible use. Get direct consultation and ongoing support for applying HIPAA requirements to the particular needs of your practice—including email, client communication, technology selection, policies, and implementation. Practice leaders can receive direct support with developing communication systems and workflows that are HIPAA-compatible, effective, efficient, and workable for the practice, its team, and its clients. Article: Learn about PCT’s framework for distinguishing among conventional email, TLS-secured email, and escrow or portal-style secure messaging—and choosing the option that fits the information, workflow, and client circumstances involved. Resources: Google’s instructions for requiring TLS when sending email to specified recipients and preventing delivery when a secure connection cannot be established. View Google’s current data on the percentage of email sent and received by Gmail that is encrypted while traveling between email providers. HHS guidance explaining how the HIPAA Security Rule applies when electronic protected health information is transmitted by email. HHS guidance addressing email communication with patients, reasonable safeguards, and patients’ requests to communicate through alternative means.
/episode/index/show/grouppracticetech/id/42349325
info_outline
Episode 622: Must You Complete the Note Before Submitting the Claim? Fraud, Mistakes, and the Rules That Actually Apply
07/24/2026
Episode 622: Must You Complete the Note Before Submitting the Claim? Fraud, Mistakes, and the Rules That Actually Apply
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we debunk myths around documentation and fraud with Dr. Maelisa McCaffrey. We discuss: A recent article that is causing concern about whether submitting insurance claims before notes are complete constitutes fraud Fraud vs. mistakes, and consequences for mistakes in billing What constitutes fraud under the False Claims Act, with context from Eric Ström, HIPAA and mental health law attorney and practicing clinician Whether there are rules about when notes are supposed to be completed Maelisa’s research on whether “late” notes can impact audits or a fraud case Claims vs. superbills and what provider obligations are with superbills PCT’s training with Maelisa on How Auditors Think Changing or amending notes, and what that looks like in practice Doing notes on paper if you struggle with overthinking your notes Just doing the documentation, and how you can always amend them later if needed Why private practice isn’t for everyone, and that’s okay How effective policies and procedures around documentation (and more) can help with hiring and retention for group practices Listen here: For more, PCT Resources: PCT CE Course (on-demand) 3 CE credit hour training (including 1 legal-ethical CE hour) taught by Dr. Maelisa McCaffrey (QA Prep). This updated-and-expanded 2026 training demystifies medical necessity, clarifies what auditors and payers are actually looking for (and why), and helps clinicians document with more confidence and less stress. Includes real examples, sample note review, and practical tools you can use immediately — covering informed consent language for clients using insurance, treatment planning that supports insurance requirements without sacrificing clinical judgment, and self-auditing techniques to spot red flags before anyone else does. Includes handouts/resources such as diagnosis justification statements, common treatment goals, progress statement formulas and examples, sample progress notes, and a client file review tool. Special Office Hours & Group Practice Office Hours direct support and consultation session with guest expert and co-facilitator Dr. McCaffrey: August 6th, 2026. members/subscribers.
/episode/index/show/grouppracticetech/id/42198175
info_outline
Episode 621: Beyond CBT, Documenting the Therapy You Actually Practice with Dr. Maelisa McCaffrey
07/10/2026
Episode 621: Beyond CBT, Documenting the Therapy You Actually Practice with Dr. Maelisa McCaffrey
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we chat with Dr. Maelisa McCaffrey about how to properly document your therapy sessions. We discuss: Normalizing why documentation is such a struggle for clinicians Dispelling the myth that it is necessary to translate what you’re doing into CBT language for insurance reimbursement and why The danger of only considering insurance when documenting Documenting what actually happened in session Acknowledging that progress notes are never going to fully capture the depth of therapeutic transformation AI documentation: is it better? What fundamentals need to be in place for AI to be clinically useful Mistakes Maelisa has seen AI make in clinical documentation Maelisa’s upcoming CE training on documentation, featuring live coaching demos to help with skill-building Listen here: For more, PCT Resources: New CE Training: Presented by Dr. Maelisa McCaffrey | 3 CE Credit Hours | Live (7/hours 27) and On-Demand This workshop is designed for therapists who want their documentation to reflect the work they're actually doing. Participants will learn a practical framework for connecting contemporary therapeutic interventions to medical necessity, develop personalized intervention language for treatment plans and progress notes, and watch live documentation coaching sessions that demonstrate the documentation process in real time. Includes downloadable worksheets, intervention templates, and on-demand self-study CE course access following the live event. Dr. Maelisa McCaffrey is one of the leading educators on ethical, clinically meaningful documentation for mental health professionals. Explore her complete collection of PCT continuing education courses on progress notes, treatment plans, medical necessity, insurance audits, contemporary documentation practices, and the ethical use of AI in clinical work. Resources: Dr. McCaffrey's book: Dr. McCaffrey's company: Want to continue learning from Dr. Maelisa McCaffrey? Visit QA Prep, her educational platform dedicated to helping mental health professionals create documentation that is clinically meaningful, ethical, efficient, and far less stressful. Explore free resources, self-paced courses, consultation, practical tools, and her Stress-Free Documentation book covering progress notes, treatment planning, medical necessity, AI, supervision, and more.
/episode/index/show/grouppracticetech/id/42028040
info_outline
Episode 620: Choosing the Right Business Entity for Your Practice: LLCs, PLLCs, PCs & S-Corps Explained (with Dan Pepitone)
07/03/2026
Episode 620: Choosing the Right Business Entity for Your Practice: LLCs, PLLCs, PCs & S-Corps Explained (with Dan Pepitone)
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we interview attorney Dan Pepitone about how to choose the right business entity for your group practice. We discuss: Building a strong business foundation to reduce risk and exposure to liability The distinctions between different business entities, and tax implications for each Why some states like New York and California require behavioral health care providers to practice under a professional entity like a PC or PLLC When you need to register your business in other states where you plan to practice, and what to consider before expanding into other states Considerations when choosing a business entity for your practice When to revisit the entity you’ve chosen for your practice What ongoing legal maintenance is required for preserving your business entity Listen here: For more, Resources: Attorney Dan Pepitone's PCT Resources: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training
/episode/index/show/grouppracticetech/id/41938265
info_outline
Episode 619: Public Wi-Fi: Is It Still a Security Risk? What Therapists Need to Know About Untrusted Networks
06/26/2026
Episode 619: Public Wi-Fi: Is It Still a Security Risk? What Therapists Need to Know About Untrusted Networks
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share what you need to know about public wi-fi networks & the security risks they pose to your devices and information. We discuss: The difference between privacy and security How the risks posed by public wi-fi networks have changed over time What security risks public wi-fi networks actually pose to your device How to use a risk analysis lens to put simple, accessible safeguards in place Listen here: For more, Resources: Reader's Digest Article: Security Magazine Article: Forbes Article: AP News: Zimperium Article: PCT Resources: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training
/episode/index/show/grouppracticetech/id/41807710
info_outline
Episode 618: HIPAA Security Rule Update: What We Know, What We Don't, and What You Should Do Right Now
06/19/2026
Episode 618: HIPAA Security Rule Update: What We Know, What We Don't, and What You Should Do Right Now
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share what we know about the proposed HIPAA Security Rule and steps to take to safeguard your practice in the meantime until we know more. We discuss: The current status of the proposed HIPAA Security Rule How regulatory uncertainty does not equal security uncertainty Takeaways from OCR Director Paula Stannard’s comments at the National HIPAA Summit that give insight into the rationale behind the proposed rule Risk analysis, encryption, reasonable and appropriate safeguards, and meaningful protection of client information Our recommendation for building your compliance strategy Four steps practice owners should take right now to safeguard your practice PCT resources that can help you take those steps Listen here: For more, Resources: Article: PCT Resources: PCT's Wondering whether your practice's safeguards are reasonable and appropriate for today's threat landscape? Our free Mini Risk Analysis Tool provides a quick, practical way to evaluate your security circle, identify potential gaps, and determine where to focus your attention next. While not a substitute for a full HIPAA Security Risk Analysis, it's an excellent place to begin. service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
/episode/index/show/grouppracticetech/id/41693735
info_outline
Episode 617: CAQH is Now DataSpring: Why Therapists Should Pay Attention
06/12/2026
Episode 617: CAQH is Now DataSpring: Why Therapists Should Pay Attention
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we have an important update for practice owners who bill insurance. We discuss: Why the change from CAQH to DataSpring is not just an administrative rebrand, as DataSpring is trying to position it Why this change is a big deal for practice owners who bill insurance The action steps recommended by The Group Practice Exchange Additional PCT-recommended action steps Who owns the infrastructure that healthcare depends on? Looking at this change from a risk management perspective Listen here: For more, Resources: PR Newswire article: PCT Resources for practice optimization & fortification: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training service for mental health group practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks.
/episode/index/show/grouppracticetech/id/41617685
info_outline
Episode 616: Licensure Compacts & Portability Update
06/05/2026
Episode 616: Licensure Compacts & Portability Update
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we have exciting updates for cross-jursidictional and multi-jurisdictional practice. We discuss: The Counseling Compact, and the states in which it is live The ETA for the Social Work Licensure Compact going live Access MFT’s licensure portability effort Portability-friendly laws and how they differ from rights for temporary practice PSYPACT updates Physical location restrictions and requirements for providers under compacts Details of our upcoming CE training: Legal-Ethical Cross-Jurisdictional Telemental Health in 2026: Interstate, International, and Complex Practice Considerations Listen here: For more, PCT Resources: New on-demand CE training: Presented by Eric Ström, JD, PhD, LMHC and Liath DaltonA 3-hour legal-ethical CE training for clinicians navigating the realities of modern telemental health practice, where clients travel, relocate, attend college out of state, split time between households, or receive care while physically located somewhere other than the clinician’s primary licensing jurisdiction. This updated training moves beyond a basic “am I allowed to practice there?” analysis into advanced practical application. Participants examine practice-authority pathways, temporary practice allowances, PSYPACT, the Counseling Compact, the Social Work Licensure Compact, MFT portability developments, clinician-location versus client-location issues, international practice considerations, payer and malpractice concerns, emergency planning, confidentiality and mandatory reporting conflicts, minor consent and parent/guardian access issues, and documentation of due diligence. Participants also receive practical worksheets to support jurisdictional verification, international due diligence, and mapping applicable laws, risks, and practice implications — helping clinicians move from identifying a possible permission pathway to evaluating the conditions, conflicts, capacity, documentation, and risk-management steps needed to make a grounded practice decision. Recommended for any clinician providing teletherapy, as well as practice owners, supervisors, clinical directors, compliance leads, and other practice leadership responsible for supporting cross-jurisdictional care decisions. This training can also be assigned to team members through PCT’s free team training management system ( basic.) As one participant shared: “Thank you for an absolutely excellent presentation! The presentation is a home run, and I will recommend it to my colleagues… I have a somewhat unique perspective on teletherapy and licensure mobility from working on these issues at the state, national, and international regulatory levels. The information that you provided is clear, direct, easy to follow, and accurate.” PCT's free (!) Whenever teletherapy sessions occur when the client -- or therapist -- are physically located outside the state of the clinician's licensure at the time of session, cross-jurisdictional practice is occurring. It is necessary to answer the question of whether it is permissible for you to work with that client in that state, regardless of whether the presence in another jurisdiction is temporary or not.In addition to the fundamental question of whether practice is permitted, and the particulars of how it is permitted, it is important to identify rules of practice, and training requirements, in order to be equipped with the information you need to follow for navigating legal-ethical cross-jurisdictional practice.This tool is a supportive resource to help you identify that information, link you to the authoritative source, and document your performance of due diligence when conducting cross-jurisdictional practice within the United States. PCT’s PCT’s PCT’s service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. If you’re navigating filing a breach report and you haven’t completed a documented “thorough and accurate” HIPAA Security Risk Analysis that meets the foundational Security Rule requirements, this is something you want/need to do so it can be reflected in your breach report to the OCR (HIPAA regulators) PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training Resources:
/episode/index/show/grouppracticetech/id/41541060
info_outline
Episode 615: Your Data is Not Your Own: Why VC-Owned Healthcare Wants Your Information
05/08/2026
Episode 615: Your Data is Not Your Own: Why VC-Owned Healthcare Wants Your Information
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a cautionary tale about a Talkspace client whose healthcare information was weaponized against them. We discuss: Venture capital firms buying therapy practices, monetizing, and weaponizing client data to make more money A recent case where a Talkspace client’s data was read aloud in court Platforms using client communication to train LLMs and AI platforms How these platforms are profoundly detrimental to clients, therapists, and the profession Why when something seems too easy and convenient, you are often the product (and your clients are the product) How these companies operate outside of HIPAA Security Rule standards The importance of vetting platforms and having BAAs for safeguarding client information Listen here: For more, Resources PCT Resources Live (and recorded) PCT CE Course: is a 4-hour legal-ethical CE training co-presented by Dr. Maelisa McCaffrey and Liath Dalton, designed to help clinicians move beyond fear and guesswork into confident, responsible AI use. The course provides a structured, real-world framework for integrating AI into clinical workflows while upholding HIPAA requirements, ethical standards, and clinical standards of care. Participants will learn how to evaluate AI tools, understand what constitutes PHI (and the limits of de-identification), implement appropriate policies and safeguards, and maintain documentation quality and clinical integrity. With practical tools, decision-making frameworks, and implementation strategies, this training supports clinicians in making informed, defensible decisions about AI use in practice. Live Webinar Presentation on May 8th, 2026 Registration for live training includes receiving ownership of and perpetual access to the on-demand self-study CE training produced from recording of live presentation. Get both the content *and* the CE, even if you can’t join live. PCT's recommended/curated collection of , including HIPAA and Privacy Ethics for clinical staff, admins; leadership trainings; clinical staff teletherapy training; director/supervisor training; and topical trainings on documentation, rights of access, suicidality, accessibility, countertransference, and much more. Nationally respected, role-based HIPAA and privacy ethics and teletherapy training built for mental health staff On-demand trainings are accessible in perpetuity and do not expire. APA, NBCC, and multiple state licensing board CE provider approvals mean that CE courses count towards licensure renewal requirements for your clinical team. weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training
/episode/index/show/grouppracticetech/id/41210545
info_outline
Episode 614: AI Is Just The Latest Example - Why Training Matters For Every New Tool
05/01/2026
Episode 614: AI Is Just The Latest Example - Why Training Matters For Every New Tool
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we talk about the importance of proficiency and competency with any tool or modality used in your practice. We discuss: Why training is necessary with any tool or modality used in your practice, not just AI What the professional ethics codes say about competence and proficiency for tools and modalities used How PCT evolved to help clinicians manage the advent of new technology Our upcoming CE training on how to evaluate AI and incorporate it into your practice and workflow ethically and effectively How training can set you apart and strengthen the therapeutic alliance Listen here: For more, PCT Resources: Live (and recorded) PCT CE Course: is a 4-hour legal-ethical CE training co-presented by Dr. Maelisa McCaffrey and Liath Dalton, designed to help clinicians move beyond fear and guesswork into confident, responsible AI use. The course provides a structured, real-world framework for integrating AI into clinical workflows while upholding HIPAA requirements, ethical standards, and clinical standards of care. Participants will learn how to evaluate AI tools, understand what constitutes PHI (and the limits of de-identification), implement appropriate policies and safeguards, and maintain documentation quality and clinical integrity. With practical tools, decision-making frameworks, and implementation strategies, this training supports clinicians in making informed, defensible decisions about AI use in practice. Live Webinar Presentation on May 8th, 2026 Registration for live training includes receiving ownership of and perpetual access to the on-demand self-study CE training produced from recording of live presentation. Get both the content *and* the CE, even if you can’t join live. PCT's recommended/curated collection of , including HIPAA and Privacy Ethics for clinical staff, admins; leadership trainings; clinical staff teletherapy training; director/supervisor training; and topical trainings on documentation, rights of access, suicidality, accessibility, countertransference, and much more. Nationally respected, role-based HIPAA and privacy ethics and teletherapy training built for mental health staff On-demand trainings are accessible in perpetuity and do not expire. APA, NBCC, and multiple state licensing board CE provider approvals mean that CE courses count towards licensure renewal requirements for your clinical team. weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training
/episode/index/show/grouppracticetech/id/41081115
info_outline
Episode 613: You Discovered Non-Compliant AI Use in Your Practice. Now What?
04/24/2026
Episode 613: You Discovered Non-Compliant AI Use in Your Practice. Now What?
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share concrete steps to take if you’ve discovered staff members using non-approved AI platforms in your practice. We discuss: The misconceptions around what constitutes PHI (and why information used to write a progress note absolutely is PHI) Why this is a reportable HIPAA breach Why reporting a HIPAA breach is nowhere near as scary or impactful as you may fear The difference between a large breach and a small breach, and reporting deadlines for each Client notification deadlines for breaches How state law can impact or add to reporting deadlines Steps to take after discovering non-compliant AI use in your practice What to investigate, how to document, how to mitigate, how to notify clients, and when to consult an attorney Listen here: For more, PCT Resources: PCT CE Course (on-demand): If you’re navigating exactly what we’re talking about in this episode, our on-demand CE training, , provides a clear, structured walkthrough of what to do when something goes wrong. It covers how to determine whether an incident is a breach, how to investigate and document appropriately, and how to handle client notification and reporting requirements—along with strategies to reduce risk going forward. This is a practical, real-world roadmap designed specifically for mental health practices, so you’re not left guessing about next steps when a breach situation arises. : If you want to understand what breach reporting actually looks like in practice, this resource walks you through the exact information required when submitting a report to the Office for Civil Rights (OCR). It outlines the specific details you’ll need to gather — such as the type and scope of the breach, the number of individuals affected, what kind of PHI was involved, and what actions you’ve taken in response — so you can approach reporting with clarity and confidence rather than guesswork. Reviewing these questions ahead of time can also help guide your investigation and documentation process, ensuring you’re collecting the right information from the start. Live (and recorded) PCT CE Course: is a 4-hour legal-ethical CE training co-presented by Dr. Maelisa McCaffrey and Liath Dalton, designed to help clinicians move beyond fear and guesswork into confident, responsible AI use. The course provides a structured, real-world framework for integrating AI into clinical workflows while upholding HIPAA requirements, ethical standards, and clinical standards of care. Participants will learn how to evaluate AI tools, understand what constitutes PHI (and the limits of de-identification), implement appropriate policies and safeguards, and maintain documentation quality and clinical integrity. With practical tools, decision-making frameworks, and implementation strategies, this training supports clinicians in making informed, defensible decisions about AI use in practice. Live Webinar Presentation on May 8th, 2026 Registration for live training includes receiving ownership of and perpetual access to the on-demand self-study CE training produced from recording of live presentation. Get both the content *and* the CE, even if you can’t join live. service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. If you're navigating filing a breach report and you haven't completed a documented "thorough and accurate" HIPAA Security Risk Analysis that meets the foundational Security Rule requirements, this is something you want/need to do so it can be reflected in your breach report to the OCR (HIPAA regulators) PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training Article + 18 Identifier List: In this article, Person Centered Tech breaks down one of the most misunderstood concepts in HIPAA compliance: de-identification. It clarifies the difference between simply “removing identifiers” and meeting HIPAA’s strict legal standards for de-identification (Safe Harbor or Expert Determination). The piece explains why narrative clinical information is often inherently identifying, why a session transcript cannot realistically be considered de-identified, and how AI systems introduce heightened risks of re-identification. It reinforces a critical takeaway for practice leaders: HIPAA sets the floor — not the ceiling — for protecting client information, and governance must keep pace with emerging technologies. PCT CE Course: If you’re wanting a deeper, structured framework for evaluating AI in clinical practice, this 3-credit legal-ethical on-demand training with Eric Ström, JD, PhD, LMHC, walks through the evolving legal standards, HIPAA considerations, and ethics code guidance that apply to AI use in behavioral health. You’ll gain practical strategies for assessing new technologies, understanding emerging standards of care, and implementing AI tools in a way that is legally defensible and ethically sound. Podcast: Podcast: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more Additional Resources: : The Mintz Matrix is a comprehensive, regularly updated overview of U.S. state data breach notification laws, providing a state-by-state breakdown of requirements such as definitions of personal information, what constitutes a breach, and timelines for notification. This is especially relevant in the context of this episode because HIPAA is only part of the picture—state laws often impose additional requirements, including shorter notification timeframes and broader definitions of protected information. Reviewing the Mintz Matrix can help you understand your specific state obligations and ensure that your response to a breach is not only HIPAA-compliant, but also aligned with applicable state laws. The provides essential guidance on what constitutes a reportable breach and what happens after a report is submitted. It explains that a breach involves the unauthorized acquisition, access, use, or disclosure of protected health information that compromises its security or privacy, and outlines how OCR reviews, investigates, and resolves reported incidents. This is particularly relevant to this episode because it helps demystify what occurs after you file a breach report—reinforcing that reporting does not automatically trigger penalties, but instead initiates a review process that may include technical assistance, investigation, or closure without further action. Understanding this process can reduce fear and support more confident, compliant decision-making when responding to a breach.
/episode/index/show/grouppracticetech/id/40998045
info_outline
Episode 612: Free Email Isn't Worth It: Why It's a Bad Idea and What To Do Instead
04/17/2026
Episode 612: Free Email Isn't Worth It: Why It's a Bad Idea and What To Do Instead
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we explain why free email providers are inherently not HIPAA compliance compatible. We discuss: Why it’s necessary to have a Business Associate Agreement with your email service provider Why clients can’t opt out of HIPAA What requests for alternative or non-secure communication actually mean under the HIPAA Privacy Rule What counts as Protected Health Information (PHI) Why a free email address might be a red flag for prospective clients How to get a BAA protected email, with a domain name or without Listen here: For more, PCT Resources: PCT Article: PCT CE Training: Learn about the legal-ethical considerations of modern communication channels in the context of real world practice and client needs. 3 Legal-Ethical CE credit hours. On-demand. PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training service for mental health group practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks. weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
/episode/index/show/grouppracticetech/id/40904610
info_outline
Episode 611: The Real Risks of Using Non-Vetted AI Platforms with Client Information
04/10/2026
Episode 611: The Real Risks of Using Non-Vetted AI Platforms with Client Information
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we continue our series on AI use within therapy practices by sharing how to explain to your team members why using non-vetted AI platforms is not permissible. We discuss: What counts as Protected Health Information and a breakdown of the often misunderstood 18th identifier under HIPAA How therapy progress notes and clinical notes are inherently identifying AI re-identification risk and why this is possible Why AI use involving client information must be vetted and HIPAA compliance-compatible What happens when you input data into personal AI platforms What we mean by AI governance, and why personal AI platforms can’t be governed Why lack of AI governance is a significant liability Impermissible disclosures under HIPAA Why proving low probability of compromise is difficult after the fact, and what this means for your ability to mitigate risk Managing the emotional pieces of identifying risk and risk mitigation in your practice Listen here: For more, PCT Resources: Live (and recorded) PCT CE Course: is a 4-hour legal-ethical CE training co-presented by Dr. Maelisa McCaffrey and Liath Dalton, designed to help clinicians move beyond fear and guesswork into confident, responsible AI use. The course provides a structured, real-world framework for integrating AI into clinical workflows while upholding HIPAA requirements, ethical standards, and clinical standards of care. Participants will learn how to evaluate AI tools, understand what constitutes PHI (and the limits of de-identification), implement appropriate policies and safeguards, and maintain documentation quality and clinical integrity. With practical tools, decision-making frameworks, and implementation strategies, this training supports clinicians in making informed, defensible decisions about AI use in practice. Live Webinar Presentation on May 8th, 2026 Registration for live training includes receiving ownership of and perpetual access to the on-demand self-study CE training produced from recording of live presentation. Get both the content *and* the CE, even if you can't join live. Article + 18 Identifier List: In this article, Person Centered Tech breaks down one of the most misunderstood concepts in HIPAA compliance: de-identification. It clarifies the difference between simply “removing identifiers” and meeting HIPAA’s strict legal standards for de-identification (Safe Harbor or Expert Determination). The piece explains why narrative clinical information is often inherently identifying, why a session transcript cannot realistically be considered de-identified, and how AI systems introduce heightened risks of re-identification. It reinforces a critical takeaway for practice leaders: HIPAA sets the floor—not the ceiling—for protecting client information, and governance must keep pace with emerging technologies. PCT CE Course: If you’re wanting a deeper, structured framework for evaluating AI in clinical practice, this 3-credit legal-ethical on-demand training with Eric Ström, JD, PhD, LMHC, walks through the evolving legal standards, HIPAA considerations, and ethics code guidance that apply to AI use in behavioral health. You’ll gain practical strategies for assessing new technologies, understanding emerging standards of care, and implementing AI tools in a way that is legally defensible and ethically sound. Podcast: service for mental health group practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks. weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
/episode/index/show/grouppracticetech/id/40795760
info_outline
Episode 610: Don't Panic - But Do Pay Attention: What the Darksword iPhone Exploit Actually Means
04/03/2026
Episode 610: Don't Panic - But Do Pay Attention: What the Darksword iPhone Exploit Actually Means
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share information about the recent Darksword iPhone exploit, and what that means for therapy practice owners regarding device security. We discuss: What you need to know about this exploit Device hardening within your security circle Device security gaps we see in everyday practice Pairing technical security measures with behavioral security measures PCT’s resources around risk management and device security Listen here: For more, PCT Resources weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more PCT’s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For For Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training service for mental health group practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health group practice, and a mitigation checklist to help you reduce your risks. Resources Wired Article: PC Mag Article: ' Malwarebytes Labs Article:
/episode/index/show/grouppracticetech/id/40715300
info_outline
Episode 609: Update: HHS Releases Model NPP for Part 2 Changes — What It Means for Your Practice
03/17/2026
Episode 609: Update: HHS Releases Model NPP for Part 2 Changes — What It Means for Your Practice
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we discuss HHS’s new model Notice of Privacy Practice for Part 2 programs, what has changed, and what that means for your practice. We cover: The Part 2 Final Rule from 2024 Why the Feb. 16th enforcement deadline has been so confusing The model Part 2 NPP and Patient Notice from HHS, and the function of each document Who is considered a lawful holder and what that means Whether you need to switch to the HHS templates What to do if you already used our decision guide and resources ahead of the deadline Listen here: For more, Resources Updated Model HHS Additional PCT Resources weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
/episode/index/show/grouppracticetech/id/40516615
info_outline
Episode 608: AI Isn’t the Problem, Lack of Governance Is – A PSA for Group Practice Leadership
03/02/2026
Episode 608: AI Isn’t the Problem, Lack of Governance Is – A PSA for Group Practice Leadership
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a PSA for group practice owners to address unauthorized AI use within your practice. We discuss: What we mean by governance What counts as Protected Health Information (PHI) The standard we use at PCT to determine if something is PHI Why AI tools like ChatGPT are inappropriate for PHI De-identification standards under HIPAA Ethical standards and informed consent for clinical use of AI Concrete next steps to take as a practice leader to address AI use in your practice Listen here: For more, PCT Resources: Article + 18 Identifier List: In this article, Person Centered Tech breaks down one of the most misunderstood concepts in HIPAA compliance: de-identification. It clarifies the difference between simply “removing identifiers” and meeting HIPAA’s strict legal standards for de-identification (Safe Harbor or Expert Determination). The piece explains why narrative clinical information is often inherently identifying, why a session transcript cannot realistically be considered de-identified, and how AI systems introduce heightened risks of re-identification. It reinforces a critical takeaway for practice leaders: HIPAA sets the floor—not the ceiling—for protecting client information, and governance must keep pace with emerging technologies. PCT CE Course: If you’re wanting a deeper, structured framework for evaluating AI in clinical practice, this 3-credit legal-ethical on-demand training with Eric Ström, JD, PhD, LMHC, walks through the evolving legal standards, HIPAA considerations, and ethics code guidance that apply to AI use in behavioral health. You’ll gain practical strategies for assessing new technologies, understanding emerging standards of care, and implementing AI tools in a way that is legally defensible and ethically sound. PCT CE Course: If your clinicians are feeling the pull to use AI for documentation, this 1.5-credit legal-ethical training with Dr. Maelisa McCaffrey (Hall) provides a grounded, practical framework for evaluating that decision. The course addresses how AI is currently being used in progress notes and introduces a clear thought rubric for determining the ethical risks, compliance implications, and appropriateness of integrating AI into documentation workflows. It also reinforces core documentation principles—like medical necessity and audit risk reduction—so that efficiency never comes at the expense of defensibility. A strong next step for practice leaders who want to move from reactive prohibition to thoughtful, structured governance. (Useful for all clinicians) weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
/episode/index/show/grouppracticetech/id/40288965
info_outline
Episode 607: HIPAA After Retirement – How to Close Your Practice the Right Way
02/20/2026
Episode 607: HIPAA After Retirement – How to Close Your Practice the Right Way
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we discuss the HIPAA responsibilities for therapy practice owners when closing their practice or retiring. We cover: Common assumptions about responsibilities after retirement What determines your record retention length How long you must remain contactable after closing your practice and why The key functionalities you need to maintain, and the most economical ways to DIY them Outsourcing to an executor service as an alternative to the DIY approach Common mistakes that are made when shutting down a practice and how to avoid them Practice closure planning as part of client care planning Action steps to take if retirement is on the horizon Listen here: For more, PCT Resources a clear, practical guide to HIPAA compliance after retirement or practice closure. Learn what record retention laws require, how to honor clients’ Right of Access, and which secure systems you need to maintain for the full retention period — so you can close your practice with confidence and integrity. PCT CE Course: weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more Resources (Professional Executor Services) — A therapist-founded service offering retirement and executor support for clinicians, including options for ongoing record retention and practice closure management. We mention them as one available option for outsourcing post-retirement HIPAA responsibilities. PCT has no affiliate relationship with TheraClosure and does not specifically endorse their services; clinicians should perform their own due diligence when evaluating vendors.
/episode/index/show/grouppracticetech/id/40169075
info_outline
Episode 606: Being Findable in an AI-Shaped Referral World
02/13/2026
Episode 606: Being Findable in an AI-Shaped Referral World
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we offer actionable tips for practice owners regarding the rapidly changing landscape of online referral sources. We discuss: How online referral sources have changed over the last year Why Psychology Today is no longer the dominant referral pathway Emphasizing community based referrals How clients are using AI to find therapists How AI tools prioritize results Practical do’s and don’ts for being findable via AI Listen here: For more, PCT Resources Free companion resource: We’ve created a practical, no-hype Do’s & Don’ts checklist to help you strengthen your discoverability without chasing trends or gaming AI. It walks you through exactly what to focus on — and what to ignore — so your practice stays clear, ethical, and resilient in a changing referral landscape. On-Demand CE Course: Join AMHCA ethics committee member, therapist and HIPAA lawyer, Eric Ström, JD PhD LMHC, as he unpacks what it means to do marketing as a mental health clinician. With so much advice being shared online and between colleagues about how to grow your mental health practice and business, he’s here to set clear boundaries around what is appropriate ethically and legally when trying to bring in new clients. 3 Legal-Ethical CE Credit Hours weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC + assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) + assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more Resources Article from Clear Health Costs: Article from Clear Health Costs:
/episode/index/show/grouppracticetech/id/40093375
info_outline
Episode 605: 42 CFR Part 2, HIPAA NPPs, and the February 16 Deadline: What Actually Needs to Change
02/06/2026
Episode 605: 42 CFR Part 2, HIPAA NPPs, and the February 16 Deadline: What Actually Needs to Change
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share what’s actually necessary when updating your Notice of Privacy Practices due to Part 2. We discuss: The confusion around updating NPPs without an updated model from HHS A quick refresher on Part 2 Who is considered a lawful holder under Part 2 Next steps for updating your NPP if you are a Part 2 program or lawful holder Our free resource on updating your NPP before the 2/16 enforcement deadline Listen here: For more, PCT Resources PCT Free Resource: a practical resource designed to help HIPAA-covered practices determine whether the updated 42 CFR Part 2 rules apply to them — and, if so, what belongs in their Notice of Privacy Practices. The guide includes a clear decision flow, plain-language explanations of Part 2 program vs. lawful holder obligations, and sample NPP language tailored to each category. It was created to fill the gap left by the absence of an updated HHS model NPP following the 2024 Part 2 Final Rule. Resources this HHS Fact Sheet summarizes the 2024 Final Rule updating 42 CFR Part 2, including new consent provisions, redisclosure alignment with HIPAA, enforcement changes, and the February 16, 2026 compliance deadline. It provides high-level regulatory context for healthcare organizations handling substance use disorder records. JD Supra Article: This JD Supra article from Snell & Wilmer outlines the compliance steps healthcare organizations must take in response to the 2024 Final Rule updating 42 CFR Part 2. It explains which entities are required to update their Notices of Privacy Practices by February 16, 2026, including both Part 2 programs and HIPAA-covered entities that receive or maintain Part 2-protected records. The article highlights required NPP updates, enforcement risks, and the importance of aligning privacy notices with the amended regulations.
/episode/index/show/grouppracticetech/id/40010895
info_outline
Episode 604: Don't Get Phished!
01/30/2026
Episode 604: Don't Get Phished!
Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share advice on how to avoid phishing scams. We discuss: Phishing scams in text messages and email Common scams you might encounter What not to do when you get a suspicious text message PCT resources for how to identify scams and social engineering Listen here: For more,
/episode/index/show/grouppracticetech/id/39924810