Latest / Hey Docs! / Navigating the Complexities of Data Privacy Laws

Transcript

Navigating the Complexities of Data Privacy Laws · Hey Docs!

• 0:04
  Speaker 1: Welcome to the Haydocks Podcast with your host Jill Allen.
• 0:07
  Speaker 1: Today I have special guest Greg Drysdale from Waterpoint Consulting
• 0:12
  Speaker 1: joining me on the show. Greg is an expert in
• 0:15
  Speaker 1: data privacy and security, and today he'll be sharing insights
• 0:19
  Speaker 1: on the importance of these practices in dental and orthodonic offices.
• 0:24
  Speaker 1: We'll explore common pitfalls, how to improve data privacy, and
• 0:28
  Speaker 1: the role of water Point Consulting and helping practices stay compliant.
• 0:33
  Speaker 1: There's a lot to learn, so let's get into it,
• 0:40
  Speaker 1: hay Docs. When it comes to marketing, I keep hearing
• 0:43
  Speaker 1: that you're frustrated and that you don't know what you're
• 0:46
  Speaker 1: paying for or even if your marketing efforts are working.
• 0:50
  Speaker 1: Are you wondering what your next marketing move should be.
• 0:53
  Speaker 1: I would suggest you contact Mary kay Miller and her
• 0:56
  Speaker 1: team at Kaleidoscope with their free digital marketing audit. You
• 1:00
  Speaker 1: will get answers and solutions to your biggest marketing questions.
• 1:05
  Speaker 1: Go to contact kale dot com to request your free
• 1:10
  Speaker 1: digital marketing audit Today. When it comes to websites, SEO
• 1:14
  Speaker 1: and digital advertising, you don't know what you don't know
• 1:18
  Speaker 1: till you know. Find out what you don't know today,
• 1:22
  Speaker 1: that's contact kl dot com. All right, Greg, I am
• 1:29
  Speaker 1: so excited to have you on hay Docs. Thanks for
• 1:33
  Speaker 1: being here today.
• 1:34
  Speaker 2: Yeah, well, thanks for having me. I really appreciate you
• 1:37
  Speaker 2: having me on. Yes, absolutely. So.
• 1:39
  Speaker 1: The way I love to start off Haydocks is to
• 1:42
  Speaker 1: have my guests just tell our audience a little bit
• 1:44
  Speaker 1: about who you are, a little bit about your company,
• 1:48
  Speaker 1: Waterpoint Consulting, and just kind of what you're doing in
• 1:51
  Speaker 1: our industry.
• 1:52
  Speaker 2: Sure. So, water Point Consulting is a healthcare and consumer
• 1:57
  Speaker 2: data privacy company. So what we do is we help
• 1:59
  Speaker 2: businesses gain and maintain compliance with various data privacy laws.
• 2:03
  Speaker 2: Those can include things like hip hop, state healthcare laws,
• 2:06
  Speaker 2: state consumer laws, global consumer laws. And really what we
• 2:10
  Speaker 2: do we do this to ensure that the personal data
• 2:12
  Speaker 2: that these businesses are collecting is protected and only disclosed
• 2:17
  Speaker 2: as the various laws will allow. And by doing so
• 2:20
  Speaker 2: then we can help practices like your audience build trust
• 2:23
  Speaker 2: to attract and retain patients. So we believe that strong
• 2:27
  Speaker 2: data privacy practices can be a real differentiator for a practice.
• 2:30
  Speaker 1: Yeah.
• 2:31
  Speaker 2: As far as myself, my background is in technology, things
• 2:34
  Speaker 2: like data and software development, I'm a former corporate vice
• 2:38
  Speaker 2: president for a pretty well known company. I'm also retired
• 2:41
  Speaker 2: from the Air Force. You know, the last seven eight years,
• 2:45
  Speaker 2: I've been really digging in and trying to learn the
• 2:48
  Speaker 2: best ways to build and manage good data privacy programs.
• 2:51
  Speaker 2: And then last year I decided I don't want to
• 2:53
  Speaker 2: work on the corporate side anymore, so, you know, so
• 2:56
  Speaker 2: I left and tried to start this business up, partnering
• 2:59
  Speaker 2: with my wife on it. She is She's spent a
• 3:02
  Speaker 2: lot of time in healthcare, so a lot of time
• 3:05
  Speaker 2: in hospitals and medical practices in very hip a heavy roles,
• 3:10
  Speaker 2: and so really she has a lot of that additional
• 3:13
  Speaker 2: practical knowledge. Hey, what can we do? What should we
• 3:16
  Speaker 2: do here? You know, I think our combined knowledge and
• 3:19
  Speaker 2: you know, certifications, backgrounds, you know, makes us very unique
• 3:22
  Speaker 2: in the market.
• 3:23
  Speaker 1: Yeah, I love that, And gosh, I was very excited
• 3:26
  Speaker 1: to have you on today because this is one of
• 3:28
  Speaker 1: those I'm going to say, just feels like a gray area,
• 3:32
  Speaker 1: even though I know there's a lot of black and
• 3:35
  Speaker 1: white in this area. It's I like to say, the
• 3:39
  Speaker 1: unsexy side of our business when we own them own businesses,
• 3:43
  Speaker 1: and especially in the healthcare realm where there's a lot
• 3:46
  Speaker 1: of like you said, you know, just a data privacy
• 3:48
  Speaker 1: that we have to be aware of. And I think
• 3:50
  Speaker 1: especially as especially in the orthodonic industry as we are
• 3:54
  Speaker 1: continuing to move where everything is digital. You know, we
• 3:57
  Speaker 1: don't just have lockdown files in our office and most
• 4:00
  Speaker 1: of the data that's going back and forth is you know,
• 4:04
  Speaker 1: going up to a cloud and whatnot. So I love
• 4:07
  Speaker 1: that you're in this space. I love that we're going
• 4:09
  Speaker 1: to have a great conversation today, and I just know
• 4:12
  Speaker 1: that our young docs are going to get a lot
• 4:14
  Speaker 1: out of this, which is I think the more information
• 4:17
  Speaker 1: we can arm ourselves with, the better we can be
• 4:20
  Speaker 1: at compliance. But also just knowing where some red flags
• 4:24
  Speaker 1: may be or where we may be exposed in our
• 4:26
  Speaker 1: businesses that we may not know about.
• 4:29
  Speaker 2: Absolutely.
• 4:30
  Speaker 1: So with that being said, I'm wondering if we can
• 4:33
  Speaker 1: just start super basic here and when we hear about
• 4:38
  Speaker 1: or think about data privacy or consumer data or the
• 4:44
  Speaker 1: scary word hippaa or you know, like you know it
• 4:47
  Speaker 1: all all of those things which you know in some
• 4:50
  Speaker 1: ways means the same thing and in other ways don't
• 4:52
  Speaker 1: mean the same thing at all. I'm wondering if you
• 4:55
  Speaker 1: can just pretend like we don't know a whole lot here,
• 4:58
  Speaker 1: and you know, break that down for us and tell
• 5:01
  Speaker 1: us what those terms mean and kind of what that
• 5:03
  Speaker 1: means to us, especially in our orthodonic realm that we
• 5:06
  Speaker 1: live in.
• 5:07
  Speaker 2: Yeah, sure, so if we start basic. So, data privacy
• 5:11
  Speaker 2: itself is really just the principle that a person should
• 5:15
  Speaker 2: have control over their own data, and that includes how
• 5:18
  Speaker 2: businesses handle that data. So from a patient or a
• 5:21
  Speaker 2: consumer perspective, it's their ability to determine the where and
• 5:25
  Speaker 2: the how and to what extent they share their personal
• 5:27
  Speaker 2: data with others, right, And so once they've shared that information,
• 5:31
  Speaker 2: all data privacy laws contain certain rights to the individual
• 5:35
  Speaker 2: over their data. These are things like the right to
• 5:37
  Speaker 2: access their data, right to correct, right to delete their data,
• 5:41
  Speaker 2: right to know who's how their data is being shared
• 5:43
  Speaker 2: with others. Right. Sure, And I think one of the
• 5:46
  Speaker 2: keys here is a certain amount of trust is required
• 5:49
  Speaker 2: for individuals to share their data with practices and other businesses.
• 5:52
  Speaker 2: You have to have a good feeling about somebody that
• 5:54
  Speaker 2: they're not going to do anything that's going to put
• 5:56
  Speaker 2: your data at risk. Sure, And so then from the
• 5:59
  Speaker 2: practice side, you know, once that individual decides that they
• 6:01
  Speaker 2: trust the doctor or the practice enough to share their information,
• 6:05
  Speaker 2: it's then the practice is responsibility to protect the privacy
• 6:08
  Speaker 2: of that data through things like proper handling, processing, storage, disclosure.
• 6:14
  Speaker 2: So for your audience, you know, the patients in control,
• 6:17
  Speaker 2: they have all these rights and they expect a certain
• 6:20
  Speaker 2: level of privacy and protection, and then that practice is
• 6:23
  Speaker 2: responsible for providing that. So that's really what we're talking about.
• 6:26
  Speaker 2: And then you mentioned terms like consumer and healthcare data privacy,
• 6:30
  Speaker 2: So really there's not much of a difference there other
• 6:32
  Speaker 2: than what laws apply and what rights are granted. Right,
• 6:36
  Speaker 2: So a lot of these different regulations all have the
• 6:39
  Speaker 2: same kind of rights that they grant. For your audience
• 6:42
  Speaker 2: of doctors, you know, HIPPA almost certainly applies, I mean
• 6:48
  Speaker 2: unless they're doing some things that you know, you know,
• 6:50
  Speaker 2: really old school not doing any you know, electronic processing
• 6:54
  Speaker 2: and things like that. But then beyond that, depending on
• 6:57
  Speaker 2: the state that their patients reside in, that type of
• 7:00
  Speaker 2: data that's collected, some annual revenue thresholds, number of records processed,
• 7:05
  Speaker 2: Other state healthcare and consumer laws could also apply. So
• 7:09
  Speaker 2: the types of things that practices need to be concerned
• 7:12
  Speaker 2: with are dependent on those types of factors. There's commonalities,
• 7:15
  Speaker 2: for sure, but it's rarely you know, a one size
• 7:18
  Speaker 2: fits all scenario. Got it?
• 7:20
  Speaker 1: Got it? Oh? I love that, And I'm going to imagine,
• 7:24
  Speaker 1: I mean, we know that all of this is very important.
• 7:27
  Speaker 1: You know, we have to have kind of these safeguards
• 7:29
  Speaker 1: in place for the patient of course, but also just
• 7:35
  Speaker 1: from the owner I would assume as a compliance piece.
• 7:39
  Speaker 1: And I don't know if you want to get into
• 7:42
  Speaker 1: that a little bit. I know, I found it interesting
• 7:44
  Speaker 1: that you said depending upon the state. Are there different
• 7:47
  Speaker 1: things that we have to pay attention to depending upon
• 7:49
  Speaker 1: the states that we're in, or maybe the way that
• 7:53
  Speaker 1: we are doing our data, you know, how we're handling data,
• 7:57
  Speaker 1: you know, different things like that. Do you mind unpacking
• 7:59
  Speaker 1: that just a little bit.
• 8:01
  Speaker 2: Yeah, for sure, certainly. So, yes, they answered your question
• 8:05
  Speaker 2: is yes, based on your location or really your patient
• 8:09
  Speaker 2: or the consumer's location, that's really what controls most of
• 8:13
  Speaker 2: these laws, right, and not specifically for HIPPA, because HIPPA
• 8:17
  Speaker 2: is a federal law, so it's going to apply to
• 8:18
  Speaker 2: everybody within the United States. But then there's certain additional
• 8:22
  Speaker 2: things that states add on to that, right, so there's
• 8:25
  Speaker 2: these state healthcare privacy laws and a lot of what
• 8:28
  Speaker 2: that does is kind of changes definitions of what data
• 8:32
  Speaker 2: is considered, you know, that needs to be protected, how
• 8:35
  Speaker 2: long you have to announce that there was a data breach,
• 8:38
  Speaker 2: things like that can change from the original you know,
• 8:40
  Speaker 2: HIPPA requirements. And then even further on is these consumer laws.
• 8:45
  Speaker 2: And we'll take Colorado since that's near and dear to
• 8:48
  Speaker 2: your heart. Colorado has a comprehensive consumer privacy laws. It's
• 8:52
  Speaker 2: called CPA, and every resident of the state of Colorado
• 8:56
  Speaker 2: has these rights that are granted. And again we talked
• 8:58
  Speaker 2: about some of them, right to access, right to delete,
• 9:00
  Speaker 2: right to correct. There's also certain things like the thresholds
• 9:04
  Speaker 2: and things like that. So if a company's big enough
• 9:07
  Speaker 2: and they have a certain amount of annual revenue, these
• 9:10
  Speaker 2: laws apply. If they're below that, they don't. How many
• 9:13
  Speaker 2: data records you collect within a year or process within
• 9:16
  Speaker 2: a year. Those kind of things throw things out of
• 9:19
  Speaker 2: balance a little bit, and you know, that's why it's
• 9:22
  Speaker 2: a little hard to keep up with some of these things,
• 9:24
  Speaker 2: especially on the consumer side, where there's not a federal
• 9:28
  Speaker 2: law right now, it's all left to the states and
• 9:31
  Speaker 2: so I think right now there's something like eight or
• 9:34
  Speaker 2: nine states that have comprehensive privacy laws, and then there's
• 9:38
  Speaker 2: another six or seven that are coming online within the
• 9:40
  Speaker 2: next year that'll continue to change. Again, most of those
• 9:43
  Speaker 2: are relatively similar. Yeah, and even right now it may
• 9:46
  Speaker 2: get a little better because you know, the federal government
• 9:49
  Speaker 2: is considering a federal bill on this. So yeah, there's
• 9:53
  Speaker 2: all kinds of things that may change. But I guess
• 9:55
  Speaker 2: the point here is that there's just a lot of
• 9:58
  Speaker 2: variables and just have to watch out for all of them.
• 10:02
  Speaker 1: You know.
• 10:02
  Speaker 2: Even you mentioned the data that you collect, right, and
• 10:06
  Speaker 2: so for a practice you know, obviously they have their
• 10:09
  Speaker 2: their healthcare data set, right, and this is everything within
• 10:12
  Speaker 2: probably their practice management system and everything that's related to
• 10:15
  Speaker 2: that patient. Now, if they collect other things outside of
• 10:19
  Speaker 2: that data, things like other personally identifiable information via maybe
• 10:24
  Speaker 2: a contact form on their website, or they do things
• 10:28
  Speaker 2: like sweepstakes or giveaways or you know, their social media,
• 10:32
  Speaker 2: that's not technically covered by HIPPO because if it's outside
• 10:36
  Speaker 2: of their healthcare privacy record or healthcare record, those might
• 10:40
  Speaker 2: be picked up under some of these other laws.
• 10:42
  Speaker 1: Very interesting. I would have never thought of that and
• 10:45
  Speaker 1: I'm sure a lot of doctors haven't that there are
• 10:48
  Speaker 1: still data privacy laws that are in effect. Potentially when
• 10:53
  Speaker 1: we're out there saying hey, you know, give us your
• 10:56
  Speaker 1: email address, or hey give us you know this, you know,
• 10:59
  Speaker 1: we're we're doing this thing here or this thing there.
• 11:02
  Speaker 1: So which kind of makes me wonder Number one, if
• 11:06
  Speaker 1: we don't know about it, how do we find out
• 11:08
  Speaker 1: about what this looks like? But secondarily, what are the consequences?
• 11:13
  Speaker 1: You know, if we are not doing a good job
• 11:16
  Speaker 1: at following good data and consumer privacy practices, you know,
• 11:20
  Speaker 1: what does that impact look like to us? And I'm
• 11:23
  Speaker 1: sure there's probably scales of this, but can you talk
• 11:27
  Speaker 1: to that a little bit?
• 11:28
  Speaker 2: Sure? So the answer to that is, it really depends.
• 11:32
  Speaker 2: It depends on the law specific law. Some laws, if
• 11:36
  Speaker 2: someone brings up a complaint to one of the boards,
• 11:39
  Speaker 2: what will generally happen is, you know, it'll get investigated.
• 11:43
  Speaker 2: Some things can happen, like the company can get fined,
• 11:46
  Speaker 2: you know, the practice could get fined. They could be
• 11:48
  Speaker 2: told they have to change their ways they're doing things.
• 11:51
  Speaker 2: And then some states allow for citizens to actually sue
• 11:54
  Speaker 2: and collect money directly. Wow, so it's going to be
• 11:57
  Speaker 2: all over the board, so it's hard to really lock
• 11:59
  Speaker 2: that down. Now with HIPPA, there is no private right
• 12:03
  Speaker 2: within HIPPO, so they're not going to you know, they're
• 12:05
  Speaker 2: not going to be nobody's going to be getting sued. However,
• 12:09
  Speaker 2: what happens is if someone brings you know, something to
• 12:12
  Speaker 2: the attention of Health and Human Services, whether that be
• 12:15
  Speaker 2: via a breach or via some other violation of a
• 12:19
  Speaker 2: hip or rule, then what's going to happen is, you know,
• 12:22
  Speaker 2: aghs will generally come and start digging in, and you
• 12:26
  Speaker 2: know they have the right to levy fines and things
• 12:28
  Speaker 2: like that.
• 12:29
  Speaker 1: So yeah, yeah, so I'm kind of curious. Again, this
• 12:33
  Speaker 1: is kind of this scary gray area that all of
• 12:35
  Speaker 1: us are like, Eh, you know, I don't want to
• 12:37
  Speaker 1: talk about it too loud because I don't want to,
• 12:40
  Speaker 1: you know, get the privacy police looking my way. But
• 12:43
  Speaker 1: what does a company like yours, water Point Consulting, do
• 12:48
  Speaker 1: that kind of helps keep doctors safe. Are you getting
• 12:51
  Speaker 1: in there ahead of time and just kind of evaluating
• 12:55
  Speaker 1: what practices they have in place and you know, helping
• 12:58
  Speaker 1: them see their weak points or are you coming in
• 13:00
  Speaker 1: more after the fact when they have maybe gotten themselves
• 13:05
  Speaker 1: into got the eye on them, and they're like, oh shoot, no, what.
• 13:11
  Speaker 2: No. So generally, what companies like mine would do is
• 13:14
  Speaker 2: we would come in before and we would help them
• 13:17
  Speaker 2: kind of write their processes and make sure that everything's
• 13:20
  Speaker 2: in place. So data privacy consultants generally know the laws
• 13:23
  Speaker 2: and the best practices around privacy and security, and they
• 13:27
  Speaker 2: use that knowledge to put the necessary things in place
• 13:29
  Speaker 2: to keep the patient data protected as best they can.
• 13:32
  Speaker 2: So generally that's some kind of combination of three things. Right.
• 13:36
  Speaker 2: It's an audit, right, so come in and examine current practices, processes, procedures,
• 13:42
  Speaker 2: security controls, even the website to really understand the risk
• 13:46
  Speaker 2: level and build a plan for any future improvements. So
• 13:50
  Speaker 2: I can't speak for everybody. For us, that basically looks
• 13:53
  Speaker 2: like two days on site and another week or so
• 13:56
  Speaker 2: to do any additional research, develop a scorecard and plan.
• 14:00
  Speaker 2: Once that plans delivered, then the second piece of that
• 14:03
  Speaker 2: after audit is built. Right. So based on whatever comes
• 14:06
  Speaker 2: out of that audit, we're going to build out all
• 14:08
  Speaker 2: the required documentation, the processes, the procedures, policies. We're going
• 14:12
  Speaker 2: to advise on cybersecurity practices, advise on necessary website changes,
• 14:17
  Speaker 2: build out an incident response plan. So this is right,
• 14:21
  Speaker 2: like all the meat, right, and this is you know
• 14:23
  Speaker 2: this generally it's a lot of documentation and it's a
• 14:26
  Speaker 2: lot of figuring out what processes should look like. Generally,
• 14:29
  Speaker 2: still only a couple of weeks worth of work. And
• 14:32
  Speaker 2: then once that's all done, audit's been done, build has
• 14:35
  Speaker 2: been done, then it's really about training the staff, right,
• 14:38
  Speaker 2: So it's building a practice specific training plan, you know,
• 14:42
  Speaker 2: building a document repository to house all these artifacts we've created,
• 14:46
  Speaker 2: and then actually coming on site for another day you know,
• 14:48
  Speaker 2: this is our process, but coming outside for another day
• 14:51
  Speaker 2: and to train that staff on the process of procedures
• 14:53
  Speaker 2: and policies. Again, this takes about a week for that
• 14:57
  Speaker 2: whole phase, including the day on site, so the whole
• 15:00
  Speaker 2: process is fairly straightforward, able to be completed in about
• 15:05
  Speaker 2: four weeks with pretty minimal disruption to the practice. I
• 15:08
  Speaker 2: always say, I think there's a general misconception with these
• 15:11
  Speaker 2: types of services that it takes a long time or
• 15:13
  Speaker 2: it is extremely disruptive or expensive. That definitely isn't the case,
• 15:18
  Speaker 2: you know, especially when you're talking about small to mid
• 15:20
  Speaker 2: size practices. You know, when you get up into if
• 15:23
  Speaker 2: you're consulting for you know, DSOs or osos or med
• 15:27
  Speaker 2: groups or hospitals, obviously this timeline and cost and all
• 15:31
  Speaker 2: that kind of stuff changes a bit. Yeah, but generally
• 15:33
  Speaker 2: speaking for a practice, that's basically what it looks like.
• 15:37
  Speaker 2: And then you mentioned kind of do you coming after
• 15:40
  Speaker 2: the fact. That depends you know, that depends on a
• 15:42
  Speaker 2: few things, like we are going to build out the
• 15:44
  Speaker 2: incident response plans, so what happens if something goes wrong?
• 15:48
  Speaker 2: What are the steps you take to do whatever you
• 15:50
  Speaker 2: need to do to remedy that, right, But it also
• 15:53
  Speaker 2: depends on either in house or contracted it. A lot
• 15:58
  Speaker 2: of those folks have these types of services too, and
• 16:01
  Speaker 2: they're probably even a little better equipped. They have a
• 16:04
  Speaker 2: lot of the tools that are going to be that
• 16:05
  Speaker 2: they're going to be able to really dive in and
• 16:07
  Speaker 2: figure out how it happened and all all this kind
• 16:09
  Speaker 2: of stuff. You know, we can help, you know, guide
• 16:11
  Speaker 2: and control the overall process, but then there's some more
• 16:15
  Speaker 2: technical aspects to it. So that's generally what it looks like.
• 16:18
  Speaker 2: It's a combination of audit, build and train.
• 16:20
  Speaker 1: Yeah, oh I like that audit, build and train, So
• 16:24
  Speaker 1: With that being said, a lot of my listeners are
• 16:28
  Speaker 1: brand new doctors. They are just getting started, just opening
• 16:32
  Speaker 1: up their practices. I've got to guess that there's a
• 16:36
  Speaker 1: little bit of a difference on what a startup doctor
• 16:39
  Speaker 1: who maybe is just getting going. I got maybe one
• 16:42
  Speaker 1: employee and myself, I don't you know, I'm just like,
• 16:45
  Speaker 1: I'm just getting my doors open to that existing practice
• 16:49
  Speaker 1: that has been going for a while. We've got a
• 16:51
  Speaker 1: full team. We've you know, we've we're rocking and rolling.
• 16:55
  Speaker 1: We're five, eight, ten years in. Sure, can you talk
• 16:58
  Speaker 1: about the differences there if there are many or things
• 17:01
  Speaker 1: that a doctor in one stage of their practice life
• 17:05
  Speaker 1: may be thinking about versus a doctor in a different stage.
• 17:08
  Speaker 2: Sure, So I would say, generally speaking, the end goal
• 17:12
  Speaker 2: and the things to be considered are going to be
• 17:14
  Speaker 2: the same, Right, So you want to get to that
• 17:16
  Speaker 2: same endpoint, you know, where you have a really solid
• 17:19
  Speaker 2: data privacy program in place. I think where it's going
• 17:22
  Speaker 2: to differ between startups and existing practices is more in
• 17:25
  Speaker 2: the process. Okay, So you know for startups, nothing or
• 17:30
  Speaker 2: minimal things already in place, less time on the audit, right, Sure,
• 17:35
  Speaker 2: there's no need to go through a bunch of different
• 17:37
  Speaker 2: things because there's nothing in place, right, So that's that's
• 17:41
  Speaker 2: probably the biggest key there. But what that leads to
• 17:45
  Speaker 2: then is probably more time spent on the build right.
• 17:48
  Speaker 2: So they don't have anything in place, so they're going
• 17:51
  Speaker 2: to need a bigger collection of artifacts, right to be
• 17:54
  Speaker 2: able to get this thing going. For me, I think
• 17:58
  Speaker 2: it's best if data, privacy is security are considered prior
• 18:01
  Speaker 2: to the IT setup. So when you you know, when
• 18:04
  Speaker 2: they're doing all of this thing, before they set up
• 18:06
  Speaker 2: their networks and all of this kind of thing, have
• 18:08
  Speaker 2: a privacy consultant look at that and kind of help guide, right,
• 18:12
  Speaker 2: so you know, contracted it is great, and they have
• 18:15
  Speaker 2: the technical know how, but they don't often know the
• 18:16
  Speaker 2: specific laws that govern what should be put in place.
• 18:19
  Speaker 2: So I think that's where people like me can help, right.
• 18:22
  Speaker 2: But there's definitely an advantage of building things correctly from
• 18:25
  Speaker 2: the beginning and invoiding rework. So I think that this
• 18:28
  Speaker 2: works great for startups, and it's it's pretty consistent. So
• 18:32
  Speaker 2: for startups because there isn't a lot of variation and
• 18:34
  Speaker 2: what's already in place, the process from startup to startup
• 18:37
  Speaker 2: will be pretty consistent.
• 18:39
  Speaker 1: Yeah, right, yeah, yeah.
• 18:40
  Speaker 2: And then on the other side, for the existing practices,
• 18:43
  Speaker 2: you know, we need to be much more thorough, conduct
• 18:46
  Speaker 2: a very thorough audit to fully understand the risk because,
• 18:49
  Speaker 2: as we discussed earlier, the audit determines the path forward, right,
• 18:53
  Speaker 2: So each practice is going to have different things in
• 18:57
  Speaker 2: place that will seriously affect what it looks like in
• 19:01
  Speaker 2: the build phase and then the train phase as well,
• 19:03
  Speaker 2: because they're going to have a different collection of artifacts
• 19:06
  Speaker 2: already in place, and so they'll only be needed to
• 19:08
  Speaker 2: be trained on some Maybe I think existing practices will
• 19:12
  Speaker 2: generally it'll be a little harder sell on some of
• 19:16
  Speaker 2: the build because they've been doing things. You know, it's
• 19:20
  Speaker 2: worked for them.
• 19:21
  Speaker 1: You know, it's always the it's always the hard sell.
• 19:24
  Speaker 1: It's been working, it's not broken. Why do we need
• 19:26
  Speaker 1: to fix this?
• 19:27
  Speaker 2: Right, I've never had I've never had a breach, right, Right,
• 19:31
  Speaker 2: But you know there's no guarantees and you know, so
• 19:37
  Speaker 2: you know, I think that's the harder piece there is.
• 19:39
  Speaker 2: I'm going to come in with certain recommendations and things,
• 19:42
  Speaker 2: and uh, you know, how receptive are they to that
• 19:45
  Speaker 2: because are those changes? Right?
• 19:46
  Speaker 1: Yeah? Hey, docs, let's talk about smile Sweet because it's
• 19:51
  Speaker 1: not just another scheduling system. It's a game changer in
• 19:55
  Speaker 1: the world of new patient management. And as a proud
• 19:58
  Speaker 1: smile Sweet partner, I've witnes the incredible impact it has
• 20:01
  Speaker 1: on practices of all sizes. Smile Sweet means your new
• 20:05
  Speaker 1: patient calls and webleeds are expertly handled seven days a week,
• 20:09
  Speaker 1: even during nights and weekends, and they offer top notch
• 20:13
  Speaker 1: customizable presentation software and seamless post consultation follow up. It's
• 20:18
  Speaker 1: like having a secret weapon for your practice's success. Curious
• 20:23
  Speaker 1: dive into the revolution at getsmilesuite dot com and don't
• 20:27
  Speaker 1: forget to mention Haydocks to unlock some extra goodies. Elevate
• 20:31
  Speaker 1: your practice with smile Sweet because every smile deserves a
• 20:36
  Speaker 1: suite of excellence. Are you ready to revolutionize your orthodonic
• 20:43
  Speaker 1: practice and retainer program, then I suggest you reach out
• 20:47
  Speaker 1: to Retainers for Life. It's like Amazon for retainers, convenient
• 20:51
  Speaker 1: and efficient. Having Retainers for Life in your practice means
• 20:55
  Speaker 1: patients can easily order retainer replacements online with direct del
• 21:00
  Speaker 1: reach to their mailbox. No more emergency appointments, waiting or
• 21:04
  Speaker 1: strain on your practice. It eliminates the hassle of managing
• 21:08
  Speaker 1: retainers while adding a steady income stream, and even equips
• 21:13
  Speaker 1: you with marketing tools to boost your success. Ready to
• 21:16
  Speaker 1: get started, go to www dot afterorthorevenue, dot com, forward slash,
• 21:25
  Speaker 1: haydocs dot h T m L and mention our code
• 21:30
  Speaker 1: r f l h e y d o c X
• 21:35
  Speaker 1: that's r e f l h e y d o
• 21:39
  Speaker 1: c S to receive two thousand dollars off your onboarding fee.
• 21:43
  Speaker 1: With retainers for life, you can say goodbye to retainer
• 21:47
  Speaker 1: headaches and hello to effortless efficiency and extra revenue. And
• 21:54
  Speaker 1: you know, that kind of gets me thinking. One is
• 21:57
  Speaker 1: a little bit of a rabbit trail, So I'm gonna
• 21:59
  Speaker 1: hopefully indulge me and let me go down it for
• 22:01
  Speaker 1: just a second. My first question is I have docs,
• 22:04
  Speaker 1: you know all the time. Well, I don't have a
• 22:06
  Speaker 1: server in my office. I don't have to worry about
• 22:08
  Speaker 1: these things because I'm just connecting up to the cloud
• 22:11
  Speaker 1: to a whole nother company and they're taking care of
• 22:13
  Speaker 1: all of this for me. My first thought is is
• 22:17
  Speaker 1: that true? And is there still things that you need
• 22:20
  Speaker 1: to be concerned about, which I would think there are,
• 22:23
  Speaker 1: But I think sometimes we can get a false sense
• 22:25
  Speaker 1: of security thinking that, well, I don't have a server,
• 22:28
  Speaker 1: so therefore I don't have anything to worry about. Can
• 22:30
  Speaker 1: you just speak to that. I know that's a little
• 22:32
  Speaker 1: bit of a rabbit trail there, But as I'm seeing
• 22:36
  Speaker 1: more and more softwares, especially in our industry, where they're
• 22:40
  Speaker 1: all cloud based, and we aren't you know, we aren't
• 22:43
  Speaker 1: running servers in our office anymore. You know, all of
• 22:46
  Speaker 1: our computers are just hooking right up into something else.
• 22:49
  Speaker 1: Do you mind speaking to that just a little bit.
• 22:51
  Speaker 2: Yeah, sure, So there is some truth in that, in
• 22:56
  Speaker 2: that the requirements or the who's respond for some of
• 23:00
  Speaker 2: that stuff maybe pushed off a little bit, so you know,
• 23:03
  Speaker 2: all your stuff's in the cloud, and maybe who's ever
• 23:06
  Speaker 2: managing that, you know, needs to be aware of these
• 23:09
  Speaker 2: types of things. Also, the cloud based software, the practice
• 23:12
  Speaker 2: management software, things like that, where data is fully encapsulated
• 23:16
  Speaker 2: within that system. Right, And generally speaking, if a practice
• 23:20
  Speaker 2: management system is good and they're doing what they should
• 23:24
  Speaker 2: be for HIPPA, then they probably have a lot of
• 23:26
  Speaker 2: those things in place at least for that data, right.
• 23:30
  Speaker 2: But what that doesn't cover is kind of all this
• 23:33
  Speaker 2: foundational stuff, right, It's the Okay, maybe maybe the security
• 23:37
  Speaker 2: side of it, maybe you're better off than most. Maybe
• 23:40
  Speaker 2: a lot of that's being handled or maybe who's ever
• 23:43
  Speaker 2: handling your servers or whatever, your cloud based servers, maybe
• 23:47
  Speaker 2: they don't know what they're doing, right. I Mean there's
• 23:49
  Speaker 2: always that too. But you know what I would say,
• 23:53
  Speaker 2: it's all that foundational stuff, right. So it's the it's
• 23:55
  Speaker 2: all the documentation, it's the procedures, it's the plans, it's
• 23:59
  Speaker 2: things that are the day to day what happens in
• 24:01
  Speaker 2: the office kind of a thing. Right. It's what happens
• 24:05
  Speaker 2: when a patient comes in and wants you to give
• 24:07
  Speaker 2: them all the all of their medical records. What happens
• 24:10
  Speaker 2: if they say, hey, show me who you're sharing my
• 24:13
  Speaker 2: data with? Right, you know, what do we do there?
• 24:16
  Speaker 2: What happens if you do have a data breach or
• 24:17
  Speaker 2: if the cloud server company has a breach, you know,
• 24:20
  Speaker 2: you're still responsible for that. This is your patient data,
• 24:24
  Speaker 2: and so you know, how do you handle that? So
• 24:26
  Speaker 2: a lot of that stuff is the kind of stuff
• 24:28
  Speaker 2: we try to dig into. And but I would definitely
• 24:31
  Speaker 2: say it's not completely true that just because you don't
• 24:35
  Speaker 2: handle it or handle it on site, doesn't mean you're exempt.
• 24:39
  Speaker 2: So the other and the other piece of that is
• 24:42
  Speaker 2: that's really only handling your PHI or your protected health information. Right,
• 24:47
  Speaker 2: So if you have a website, or if you have
• 24:50
  Speaker 2: you know, like we talked about earlier contact forms and
• 24:52
  Speaker 2: all this other data that could be collected, social media,
• 24:55
  Speaker 2: all of this stuff, those are all means for things
• 24:57
  Speaker 2: to go wrong, right, for data to be shared incorrectly,
• 25:00
  Speaker 2: or for you to be storing that data, you know,
• 25:03
  Speaker 2: outside of your record but that's not encrypted, or that
• 25:05
  Speaker 2: data is in plain text it's readable, right, Other things
• 25:09
  Speaker 2: like your staff making mistakes. Right, we don't have good
• 25:12
  Speaker 2: policies in place where maybe they're downloading information out of
• 25:16
  Speaker 2: their practice management system and storing it locally unprotected on
• 25:20
  Speaker 2: their computer, right, or they're taking that data shooting it
• 25:24
  Speaker 2: off to a consultant or or.
• 25:25
  Speaker 1: Sea absolutely encrypted.
• 25:27
  Speaker 2: All of that stuff. I've seen. All of that stuff happens.
• 25:30
  Speaker 2: So just because you know servers aren't on site or
• 25:33
  Speaker 2: you're not actually controlling that doesn't mean that there's not
• 25:36
  Speaker 2: risk and there's not things you need to be concerned about.
• 25:38
  Speaker 1: Yeah, yeah, that's great, and thank you for indulging me
• 25:41
  Speaker 1: on that little uh you know, rabbit trail there because
• 25:45
  Speaker 1: I hear this all the time, and I think it's
• 25:46
  Speaker 1: so important that it's so much bigger than just thinking
• 25:50
  Speaker 1: about our operating systems and oh, well, we're safe. You're
• 25:53
  Speaker 1: really like kind of painting a good picture for it,
• 25:56
  Speaker 1: especially because we live in such a data forward industry
• 26:01
  Speaker 1: where you know, we're out there on social we're out
• 26:03
  Speaker 1: there on our Google business page, d da da da
• 26:05
  Speaker 1: da da da da dah, and there is a lot
• 26:08
  Speaker 1: of I think exposure that we probably don't think about
• 26:12
  Speaker 1: or wouldn't even realize could be exposure, and just thinking
• 26:16
  Speaker 1: that we definitely need companies, you know, like yourself in
• 26:20
  Speaker 1: place to help us stay safe because I think a
• 26:23
  Speaker 1: lot of times it's not if it's when something is
• 26:26
  Speaker 1: going to happen. So with that kind of in mind,
• 26:28
  Speaker 1: I'm wondering, if you know, if somebody's listening now and
• 26:31
  Speaker 1: they're like, oh, okay, maybe I really need to take
• 26:34
  Speaker 1: this seriously. Do you have any top suggestions or maybe
• 26:39
  Speaker 1: your top three things that you're like, Okay, if I
• 26:41
  Speaker 1: could give you three things that I think that you
• 26:44
  Speaker 1: could address right away, what would those be.
• 26:47
  Speaker 2: So the first thing is kind of generic, but it's
• 26:51
  Speaker 2: know your risk right. And if you don't know where
• 26:55
  Speaker 2: your shortcomings are or where the holes are, it's really
• 26:57
  Speaker 2: hard to ensure that you're compliant or that you're properly
• 27:00
  Speaker 2: protecting patient data.
• 27:01
  Speaker 1: Right.
• 27:02
  Speaker 2: So my suggestion is conduct the hip or risk assessment right,
• 27:06
  Speaker 2: and they can you know, they can do that themselves.
• 27:08
  Speaker 2: You know, you know, obviously I'm biased, and I would
• 27:10
  Speaker 2: say that you know, someone who does this, for aly
• 27:13
  Speaker 2: might get a deeper and more thorough assessment. But there's
• 27:16
  Speaker 2: nothing in the hippo law that says you can't do
• 27:18
  Speaker 2: it yourself. Figure out where your holes are, and this
• 27:21
  Speaker 2: is in privacy and security. You know all of those things.
• 27:24
  Speaker 2: And just know that because even if you decide that
• 27:27
  Speaker 2: you're not going to go forward immediately with the work,
• 27:29
  Speaker 2: knowing the risk and understanding the path forward is super important.
• 27:33
  Speaker 2: So that's the first thing. Just just know what you're
• 27:35
  Speaker 2: dealing with, know your risk. The second thing is a
• 27:38
  Speaker 2: little more specific, but I believe this to be a
• 27:42
  Speaker 2: very widespread miss and this is know who you're sharing
• 27:48
  Speaker 2: patient data with, okay. And I say that because I've
• 27:52
  Speaker 2: had conversations with with docs, and I've had conversation with
• 27:55
  Speaker 2: other consultants, and you know, trying to get to the
• 27:58
  Speaker 2: bottom of hey, what do you what do you do
• 27:59
  Speaker 2: when you guys hook up and share data? Right, and
• 28:02
  Speaker 2: by law, practices are not allowed to share patient data
• 28:05
  Speaker 2: with third parties, including consultants like myself, right without a
• 28:09
  Speaker 2: contract in place. And this isn't the hey, I'm going
• 28:12
  Speaker 2: to give you these services for this amount of money contract, right.
• 28:16
  Speaker 2: This is the contract that kind of lays out other
• 28:18
  Speaker 2: things like the data that's allowed to be shared, the
• 28:21
  Speaker 2: permissible uses of that data, what to do if there's
• 28:23
  Speaker 2: a breach, what to do with the data when the
• 28:25
  Speaker 2: contract ends. Right. So this contract is the responsibility of
• 28:29
  Speaker 2: the practice. It's not the responsibility to the third party.
• 28:32
  Speaker 2: So that doesn't mean the third party, if they've been
• 28:35
  Speaker 2: doing it a while, is not going to come with
• 28:36
  Speaker 2: the contract and they'll just have the doctor sign it.
• 28:39
  Speaker 2: That's possible and that's allowed. But the responsibility lies with
• 28:43
  Speaker 2: the practice. So if for some reason there was a
• 28:46
  Speaker 2: breach somewhere down the line. We've seen a few recently
• 28:48
  Speaker 2: right where there was a large breach, and you know,
• 28:52
  Speaker 2: once Health and Human Services come in and start taking
• 28:55
  Speaker 2: a look and they say, hey, who are you sharing
• 28:57
  Speaker 2: data with or who's sharing data with you and they
• 28:59
  Speaker 2: give you the list of hey, these are the practices
• 29:01
  Speaker 2: that or something. Then Health and Human Services can come
• 29:04
  Speaker 2: to the practice and say show me the authority that
• 29:07
  Speaker 2: you had to share data with that company, right, yeah,
• 29:10
  Speaker 2: And I have a feeling that they'd be not everybody's
• 29:15
  Speaker 2: doing that. Let's let's put it that way.
• 29:18
  Speaker 1: I'm going to agree with you. I'm going to agree
• 29:21
  Speaker 1: with you on that one.
• 29:22
  Speaker 2: And I think what's important also to know with a
• 29:25
  Speaker 2: specific one is it doesn't matter whether the practice is
• 29:29
  Speaker 2: sending data to the third party or whether they're allowing
• 29:33
  Speaker 2: access to their systems that hold the patient data. So
• 29:36
  Speaker 2: either way, it's considered data sharing. And anytime a business
• 29:39
  Speaker 2: associated or third party you know, has provided access to
• 29:42
  Speaker 2: the patient data, one of those needs to be in place.
• 29:44
  Speaker 1: Yeah.
• 29:44
  Speaker 2: Yeah, So I would say other than know your risk,
• 29:48
  Speaker 2: know who you're sharing data with, and if you don't
• 29:50
  Speaker 2: have contracts in place, get contracts in place.
• 29:53
  Speaker 1: That's such such good information. Yeah, perfect, that's great.
• 29:57
  Speaker 2: And then really, if I had a third one, it's
• 29:59
  Speaker 2: a little more practical in that there's something you can
• 30:03
  Speaker 2: do right away and it will help with a lot
• 30:05
  Speaker 2: of a lot of issues that could arise and that
• 30:09
  Speaker 2: is make sure your staff is trained on phishing and
• 30:12
  Speaker 2: secure data handling practices. Okay, yeah, So for those who
• 30:16
  Speaker 2: don't know, phishing is where cyber attackers, you know, to
• 30:18
  Speaker 2: see people into revealing sensitive information. Could be user ideas, passwords,
• 30:23
  Speaker 2: it could be the actual patient data, right, could be anything.
• 30:27
  Speaker 2: So the majority of breaches happened because of an accident
• 30:31
  Speaker 2: or mistake. I think I mentioned that earlier, sharing data
• 30:33
  Speaker 2: with people they shouldn't be sharing data with, Sending data
• 30:36
  Speaker 2: around via encrypted emails, storing patient data and plain text,
• 30:39
  Speaker 2: clicking on malicious links, you know, falling for phishing attacks.
• 30:42
  Speaker 2: All of those things open the door for very bad
• 30:45
  Speaker 2: things to happen. So if you're going to train somebody
• 30:48
  Speaker 2: on something right away, phishing, secure data handling practices.
• 30:51
  Speaker 1: Yeah, I love that you say that, and I'm just
• 30:54
  Speaker 1: going to tell you in Vetti who's listening, it is
• 30:57
  Speaker 1: so easy. We've seen it in the Facebook groups. We
• 30:59
  Speaker 1: see it all time. It is so easy to fall
• 31:02
  Speaker 1: prey to those because these guys are masters at their
• 31:05
  Speaker 1: craft at deception. And I have just seen so many things,
• 31:09
  Speaker 1: even within my own business, where I'll be like that
• 31:13
  Speaker 1: just doesn't look quite right, I know, there's something not
• 31:16
  Speaker 1: quite right. But you know, it takes a little bit
• 31:18
  Speaker 1: to be like, oh, you know, there's you know, the
• 31:21
  Speaker 1: wrong word is capitalized, or the wrong you know something
• 31:25
  Speaker 1: or another is.
• 31:27
  Speaker 2: Spelling is off, or it's very generic and they're greeting
• 31:30
  Speaker 2: to you or you know, things like that. Did you
• 31:32
  Speaker 2: just go, I don't know, it doesn't seem right. Yep.
• 31:34
  Speaker 2: And they're getting more sophisticated to you, right, I mean
• 31:37
  Speaker 2: used to used to be strictly phone calls, you know,
• 31:40
  Speaker 2: you know, and then it was emails, and now it's
• 31:42
  Speaker 2: text messages. I mean, I'm not sure why you would
• 31:45
  Speaker 2: ever answer something like that to a text message, but
• 31:48
  Speaker 2: emails the biggest way they're doing it right now. But
• 31:50
  Speaker 2: those like you mentioned, there are key things you can
• 31:53
  Speaker 2: look at and you can actually look at the U
• 31:55
  Speaker 2: r L or look at the sender and the U
• 31:58
  Speaker 2: r L and you know, right click and actually inspect it.
• 32:01
  Speaker 2: You can see if it's not the legitimate you know,
• 32:03
  Speaker 2: not coming from the legitimate place. Right.
• 32:05
  Speaker 1: Yeah. I love that you brought that up because I
• 32:08
  Speaker 1: just think it's such a prevalent thing right now. And
• 32:10
  Speaker 1: that just kind of leads me into my next question.
• 32:13
  Speaker 1: And you've kind of answered this already, But how do
• 32:16
  Speaker 1: we help our teams keeping them trained and being knowledgeable
• 32:22
  Speaker 1: on all this information? Is this training that we should
• 32:26
  Speaker 1: be doing once a quarter, once a year, every six months,
• 32:29
  Speaker 1: you know, pick it and stick it and you never
• 32:32
  Speaker 1: have to think about it again. That if they are
• 32:39
  Speaker 1: only that easy?
• 32:42
  Speaker 2: No, so to me, the best thing a practice can
• 32:45
  Speaker 2: do to get their staff better trained and knowledgeable in
• 32:49
  Speaker 2: this area is to make data privacy a priority. Okay,
• 32:52
  Speaker 2: And here's why I say that. Some doctors make sure
• 32:55
  Speaker 2: your teams know that data privacy is important to you, right, Yes,
• 32:58
  Speaker 2: So if the boss isn't concerned about it, staff's not
• 33:01
  Speaker 2: going to be concerned about it either. Right, They're not
• 33:03
  Speaker 2: going to take the time to become trained and knowledgeable
• 33:05
  Speaker 2: on something they don't feel as important or that they
• 33:07
  Speaker 2: don't feel as necessary for their job. Right. And along
• 33:10
  Speaker 2: with that, if you make it a priority in your
• 33:12
  Speaker 2: staff can see that is important to you. Further that
• 33:15
  Speaker 2: along by bringing someone to train on a privacy or
• 33:17
  Speaker 2: security topic on a regular basis, I would suggest quarterly
• 33:21
  Speaker 2: or you know better yet, ask your privacy officer to
• 33:24
  Speaker 2: pick topics and conduct the training themselves. There's tons of
• 33:26
  Speaker 2: great resources out there to help. And it's a great
• 33:29
  Speaker 2: growth opportunity I think for the privacy officer, and it
• 33:31
  Speaker 2: gets more involved in the privacy program to begin with, right.
• 33:34
  Speaker 1: Yeah.
• 33:36
  Speaker 2: The second speaking of privacy and security officers, these are
• 33:39
  Speaker 2: required by HIPPA, right, But most practices aren't big enough.
• 33:43
  Speaker 2: They're not going to be bringing in you know, specific
• 33:45
  Speaker 2: privacy and security officers, right. They're going to assign it
• 33:48
  Speaker 2: as a role to somebody else. Right. Generally that's to
• 33:50
  Speaker 2: the practice manager. Right. Practice managers are very busy and
• 33:54
  Speaker 2: have a lot of responsibilities, so they may not have
• 33:56
  Speaker 2: the necessary time to devote to data privacy, right, And
• 33:59
  Speaker 2: so I would say consider assigning these roles to someone
• 34:02
  Speaker 2: at a lower level, someone who may have an interest
• 34:05
  Speaker 2: or who's hungry and who's looking for growth opportunities. There's
• 34:08
  Speaker 2: nothing in him. But that says it has to be
• 34:10
  Speaker 2: the practice manager and nothing It says it has to
• 34:12
  Speaker 2: be anybody specific. Right, So give it to somebody's hungry
• 34:16
  Speaker 2: looking for growth. You know, they might be more invested
• 34:18
  Speaker 2: in and I think you'll likely get better results.
• 34:20
  Speaker 1: Yeah, that's I love that. Love that.
• 34:22
  Speaker 2: Then the third thing, and this isn't healthcare related at all.
• 34:25
  Speaker 2: This is something I tell all of my clients and
• 34:27
  Speaker 2: you know, retail everything. I tell them that they need
• 34:30
  Speaker 2: to stop thinking of protecting personal data or responding to
• 34:35
  Speaker 2: data privacy requests as a burden. Right. Think of it
• 34:39
  Speaker 2: as like another product or service that you offer. You know,
• 34:43
  Speaker 2: for instance, orthodontists offer traditional braces, they offer clear aligners, right,
• 34:47
  Speaker 2: But of equal importance, you know, they offer privacy. They
• 34:50
  Speaker 2: offer protection and a simple, straightforward process for you know,
• 34:53
  Speaker 2: for patients to exercise their data rights.
• 34:55
  Speaker 1: Right.
• 34:56
  Speaker 2: I think just that little mind shift can have a
• 34:58
  Speaker 2: huge impact on how the staff tree it's patient data
• 35:01
  Speaker 2: and creates a willingness to want to learn and be
• 35:03
  Speaker 2: more involved in the process. And then I think by
• 35:06
  Speaker 2: that they become more curious and want to learn more, right,
• 35:10
  Speaker 2: and they're reaching out and they're trying to figure out, Hey,
• 35:12
  Speaker 2: what does this all mean? What can I best do
• 35:15
  Speaker 2: to get myself knowledgeable and trained? Right? Yeah, So I
• 35:19
  Speaker 2: think those are the three things that I would say, Yeah, I.
• 35:21
  Speaker 1: Love all three of those points really good. And I
• 35:24
  Speaker 1: think easy I especially love the especially for our startup
• 35:28
  Speaker 1: docs too. You know, you may not have multiple people
• 35:31
  Speaker 1: in your practice, but just giving an opportunity for somebody
• 35:35
  Speaker 1: to feel like they've got ownership over something. And this
• 35:39
  Speaker 1: is an easy thing, not that it doesn't need to
• 35:41
  Speaker 1: be paid attention to, but somebody who maybe has a
• 35:44
  Speaker 1: little bit more time and can follow the system to
• 35:47
  Speaker 1: make sure that the practice stays safe. And I really
• 35:50
  Speaker 1: appreciate what you said. Yeah, the teams will follow their doctors.
• 35:54
  Speaker 1: Doctors hear me on this. If it's important to you,
• 35:57
  Speaker 1: your teams will make it valuable. If it's not important
• 36:00
  Speaker 1: to you or you don't understand it, don't expect that
• 36:03
  Speaker 1: your teams are going to understand it. And I see
• 36:05
  Speaker 1: this especially in our startups where many many times we're
• 36:09
  Speaker 1: hiring people into our medical industry that have never been
• 36:13
  Speaker 1: in our medical They don't even maybe even know what
• 36:18
  Speaker 1: hippa and some of these things are. They may know
• 36:21
  Speaker 1: it as a consumer, but it was just that form
• 36:23
  Speaker 1: that the doctor's office had me fill out. But they
• 36:25
  Speaker 1: don't really have any training on it. They don't really know.
• 36:27
  Speaker 1: They just know it's a form I have to fill
• 36:29
  Speaker 1: out in order to see the doctor, right, And so
• 36:31
  Speaker 1: I think, you know, just taking the time, like we
• 36:34
  Speaker 1: have to do in every area. It's kind of our
• 36:36
  Speaker 1: battleship principles. You know, where are we weak at, where
• 36:40
  Speaker 1: are we vulnerable at? You know, if we just take
• 36:42
  Speaker 1: the time and then teach our teams what's important to us,
• 36:46
  Speaker 1: they will follow. They will do exactly what we need
• 36:48
  Speaker 1: them to do to help keep us safe. And it
• 36:50
  Speaker 1: isn't and it doesn't require you as doctors to be
• 36:52
  Speaker 1: the superman or the superwoman of your practice. Lean on
• 36:56
  Speaker 1: your team for that. So, as we're talking here, kind
• 37:00
  Speaker 1: of curious if you can, I don't know, maybe talk
• 37:03
  Speaker 1: about some of the common pitfalls that you see in
• 37:06
  Speaker 1: regard to data privacy and practices and what are some
• 37:11
  Speaker 1: of those potential consequences if we aren't following good data
• 37:15
  Speaker 1: and consumer privacy practices.
• 37:18
  Speaker 2: Sure, yeah, so you know, I think if I could
• 37:21
  Speaker 2: give one piece of advice, I would tell practices that
• 37:24
  Speaker 2: it would benefit them to go beyond the basics. Okay,
• 37:28
  Speaker 2: And what I mean by the basics is this is
• 37:30
  Speaker 2: your notice of privacy practices. This is the acknowledgment from
• 37:34
  Speaker 2: the patient that they've seen in the notice of privacy practices?
• 37:36
  Speaker 2: Is keeping conversations private? Right, That's what I would call
• 37:40
  Speaker 2: the basics. These are all things that the patient'll see
• 37:42
  Speaker 2: and they're definitely important. But those things alone don't necessarily
• 37:47
  Speaker 2: meet HIPPO requirements. Okay. Oh, so the majority of a
• 37:51
  Speaker 2: strong data privacy program is what's going on behind the scenes. Okay,
• 37:54
  Speaker 2: that's the foundational stuff that the patient you know, doesn't see.
• 37:57
  Speaker 2: That's the documentation and the processes and the proceeds and
• 38:00
  Speaker 2: the policies, security controls, those kind of things. These are
• 38:04
  Speaker 2: equally important because this is also the stuff that's going
• 38:06
  Speaker 2: to be examined heavily by Health and Human Services that
• 38:08
  Speaker 2: there's a breach, right, or they receive a complaint. You know,
• 38:12
  Speaker 2: if practices can show that they can, that they put
• 38:14
  Speaker 2: effort in and that reasonable safeguards are in place, then
• 38:18
  Speaker 2: that can reduce or eliminate fines altogether. And then you
• 38:22
  Speaker 2: mentioned consequences. So obviously the you know, we know about
• 38:26
  Speaker 2: some of these, right, These are fines. We talked about
• 38:28
  Speaker 2: it earlier. These are you know, if there is a breach, breach,
• 38:31
  Speaker 2: remediation costs, there's damages to reputation, right, loss of patients,
• 38:37
  Speaker 2: failure to attract new patients, right, All of those things
• 38:40
  Speaker 2: can come out of this if the program isn't solid, right,
• 38:44
  Speaker 2: And so I want to go over kind of a scenario, right,
• 38:46
  Speaker 2: So we call it a five hundred record scenario. So
• 38:50
  Speaker 2: let's just say a hacker or a disgruntled employee even
• 38:52
  Speaker 2: gets access and steals five hundred patient records. Okay, So
• 38:56
  Speaker 2: current statistics show that breach remediations about five hundred dollars
• 39:01
  Speaker 2: per record in healthcare, So five hundred records five hundred
• 39:05
  Speaker 2: dollars a piece, it's about two hundred and fifty thousand
• 39:07
  Speaker 2: dollars to remediate, okay, and that's not even a five
• 39:10
  Speaker 2: hundred records is not even a large breach, right. And
• 39:13
  Speaker 2: then in addition to that, there's the notification piece. So
• 39:17
  Speaker 2: regardless of what size the breach is, affected, patients need
• 39:21
  Speaker 2: to be notified, Health and Human services needs to be notified.
• 39:24
  Speaker 2: Depending on location, some states, attorney generals need to be notified,
• 39:29
  Speaker 2: but the big one is at five hundred records, local
• 39:31
  Speaker 2: media outlets need to be notified. Okay, So it's going
• 39:35
  Speaker 2: on the news, right. So obviously this is a big
• 39:37
  Speaker 2: concern for a reputation of a practice, right, So you
• 39:40
  Speaker 2: just want to make sure that all of that stuff
• 39:42
  Speaker 2: is in good shape because once they come looking, you know,
• 39:45
  Speaker 2: you can save money on things like fines and stuff
• 39:48
  Speaker 2: like that. But also it's about far more than just breaches.
• 39:52
  Speaker 2: Other violations have significant impacts, things like failing to perform
• 39:56
  Speaker 2: a risk analysis or denying patient access to their record,
• 40:00
  Speaker 2: are charging them high fees to do so. I mean
• 40:02
  Speaker 2: there was a there was a practice a few years
• 40:04
  Speaker 2: back that that was fine ten or twelve thousand dollars
• 40:07
  Speaker 2: because patients were asking for their records and they were
• 40:10
  Speaker 2: trying to charge them something like one hundred and seventy
• 40:12
  Speaker 2: dollars copying fee or something to do so. So obviously
• 40:16
  Speaker 2: that's not that wasn't allowed, but things like failure to
• 40:21
  Speaker 2: provide the required training, failure to enter into the businesses
• 40:24
  Speaker 2: oc agreements, you know, but that's really the big things, right,
• 40:29
  Speaker 2: That's what I would have them do, is just make
• 40:31
  Speaker 2: sure they're building out the foundation as well as the
• 40:34
  Speaker 2: stuff that the patient may see.
• 40:36
  Speaker 1: Yeah, oh that's such good information. Thank you for that. Absolutely,
• 40:40
  Speaker 1: So as we kind of finish up here, if somebody
• 40:43
  Speaker 1: wants to get a hold of you, I mean, this
• 40:44
  Speaker 1: is such good information you've You've just broken this down
• 40:47
  Speaker 1: so easily for us, and I'm sure I've got a
• 40:49
  Speaker 1: lot of docs that are like, ah, Greg is going
• 40:52
  Speaker 1: to be really easy to talk to, and he's not
• 40:54
  Speaker 1: going to beat me up when I call him and
• 40:55
  Speaker 1: tell him I haven't done anything with this. What's the
• 40:59
  Speaker 1: best way that they can reach out if they want
• 41:02
  Speaker 1: to get some help or just maybe get a little
• 41:04
  Speaker 1: additional information outside of what we've talked about today.
• 41:07
  Speaker 2: Sure, Waterpointconsulting dot com. That's Waterpoint with an E on
• 41:11
  Speaker 2: the end of it. I made it really difficult. So
• 41:16
  Speaker 2: Waterpointconsulting dot com. Email me at there's a contact form
• 41:20
  Speaker 2: on there, Email me at Greg d at Waterpointconsulting dot
• 41:24
  Speaker 2: com or also on that website you can find my
• 41:27
  Speaker 2: phone number and I'm happy to take calls as well.
• 41:29
  Speaker 1: Perfect. That's awesome. Well, Greg, as you know, I like
• 41:33
  Speaker 1: to finish up Haydocs with a little speed round. Are
• 41:37
  Speaker 1: you ready to jump into the speed round with me?
• 41:41
  Speaker 2: Oh?
• 41:41
  Speaker 1: Sure, let's do it all right. What's your favorite go
• 41:46
  Speaker 1: to productivity tool?
• 41:48
  Speaker 2: Go to productivity tool? So they have a couple. The
• 41:54
  Speaker 2: first I would say is Teams, So Microsoft Teams I
• 41:59
  Speaker 2: use a lot so for messaging and meetings, So that's
• 42:02
  Speaker 2: that kind of keeps me connected. And another one I
• 42:05
  Speaker 2: use is called Evernoe, and that's a product for no
• 42:10
  Speaker 2: taking and task management. Yeah, those are kind of my
• 42:12
  Speaker 2: go tos right now.
• 42:13
  Speaker 1: Yeah, I love I love ever. Note, are you an
• 42:16
  Speaker 1: early bird or a night owl?
• 42:18
  Speaker 2: No, it's not even a competition here. I'm an early bird.
• 42:23
  Speaker 2: And the reason is, you know, I like to get
• 42:26
  Speaker 2: things done first thing in the morning because the rest
• 42:29
  Speaker 2: of the you know, before the rest of the country
• 42:30
  Speaker 2: is working. Yep, yep, you know that way. If meetings
• 42:33
  Speaker 2: take take up a good portion of my normal day,
• 42:35
  Speaker 2: then you know, at least I got some work.
• 42:37
  Speaker 1: Yeah, that's wonderful. How about your first job you ever had?
• 42:42
  Speaker 2: First job I ever had was as a pizza cook.
• 42:46
  Speaker 2: I was fourteen years old. My mom was a waitress
• 42:49
  Speaker 2: at an Italian restaurant, so she got me the job.
• 42:52
  Speaker 2: We had a big picture window up front. I used
• 42:53
  Speaker 2: to had my my counter and I used to, you know, the.
• 42:57
  Speaker 1: Pizza whoeverone's like, I could never do for a fourteen years.
• 43:00
  Speaker 1: I bet, I bet that's awesome. And what would you
• 43:05
  Speaker 1: say has had the most impact on your professional life?
• 43:09
  Speaker 2: On my professional life, I'd say definitely military service. I
• 43:14
  Speaker 2: chose that route over going to college out of high school.
• 43:18
  Speaker 2: I didn't really know what I wanted to do. I
• 43:20
  Speaker 2: wasn't super interested in continue on in school at that point,
• 43:25
  Speaker 2: you know, and so I chose the Air Force. My
• 43:27
  Speaker 2: dad had been in the Air Force, and I think
• 43:29
  Speaker 2: it really for me, it was the best decision I
• 43:31
  Speaker 2: could have made, you know. Taught me discipline and responsibility
• 43:35
  Speaker 2: and service and hard work, all those things that you
• 43:38
  Speaker 2: know can definitely be used in my professional.
• 43:41
  Speaker 1: I love that. Well, thank you for your service.
• 43:44
  Speaker 2: Ye oh, my pleasure.
• 43:45
  Speaker 1: And then our last one, what is one business skill
• 43:49
  Speaker 1: you think everybody should have?
• 43:52
  Speaker 2: Oh, there's a lot.
• 43:54
  Speaker 1: How to narrow it down.
• 43:56
  Speaker 2: I'm going to narrow it down and say, critical thinking. Hmm.
• 44:00
  Speaker 2: That's a good And you know, I think being able
• 44:02
  Speaker 2: to form judgments, you know, based on analysis of facts
• 44:06
  Speaker 2: and the things in front of you, I think is
• 44:08
  Speaker 2: important no matter what line of work you go into.
• 44:10
  Speaker 1: Yeah. Yeah, well, Greg, this has been just a delight.
• 44:13
  Speaker 1: Thank you so much for taking a really kind of scary,
• 44:17
  Speaker 1: not so sexy thing that we have to deal with,
• 44:21
  Speaker 1: you know, in and out of our businesses and making
• 44:23
  Speaker 1: it just really really easy to digest. And I think
• 44:26
  Speaker 1: you gave us some really good, implementable things that we
• 44:29
  Speaker 1: can move forward with right away. So thank you.
• 44:32
  Speaker 2: Absolutely. I hope it helped the audience out there, and
• 44:35
  Speaker 2: I again I appreciate you having me on it. I
• 44:37
  Speaker 2: had a good time.
• 44:38
  Speaker 1: Yep, thank you. All right til next time?
• 44:40
  Speaker 2: All right bye.
• 44:42
  Speaker 1: Are you ready to start a practice of your own?
• 44:45
  Speaker 1: Need a new fresh set of eyes or some advice
• 44:48
  Speaker 1: on your existing practice? If so, reach out to me
• 44:51
  Speaker 1: Jill Allen at www dot practice results dot com. If
• 44:56
  Speaker 1: you like what we're doing here on Haydocks and want
• 44:59
  Speaker 1: to hear more of this off some content, be heure
• 45:01
  Speaker 1: and give us a five star rating on your preferred
• 45:04
  Speaker 1: listening platform and subscribe to our show so you never
• 45:08
  Speaker 1: miss an episode. Remember, new episodes drop every Thursday. See
• 45:12
  Speaker 1: you next week.