August 2016 Workbook Status Update

Summary

• The workbook software is not yet done.
• We have explored some options to make the work go faster and settled on one of them.
• We don’t know when the software will be done but we will try to give you better visibility into our progress in coming months.
• Refunds continue to be available; we’ve included a list of potential alternative vendors below for folks who really can’t wait any longer.
• You can still take all our CE courses and use Office Hours at no cost for the foreseeable future. The courses are already in your My Courses page here. And Office Hours can be accessed here. Email [email protected] with any and all questions. We’re more than happy to help!

Background

The process of creating the HIPAA Security Workbook has been a wild ride. We’ve made progress or completed a portion of the tasks required to get the Workbook to the point where you can use it and encountered delays and setbacks with other tasks. We’ve also been consistently wrong with our predicted dates of completion when folks have asked. Rather than make yet another highly uncertain prediction, we’d like to provide you with a view of what’s been finished in whole or part, what still needs to be done, and where we’ve changed course on our path to getting a usable product in your hands. Our intent with the retrospective piece of this update is not to make excuses, but instead to give you the information you need to make decisions about requesting a refund and/or pursuing alternate options for assistance with your compliance process. We are also not asking for additional funds; we’re determined to get far enough that people can at least do a complete Risk Assessment process before we start actively selling the product again.

The idea for a tool to help guide solo practitioners and small practices through the process of complying with the HIPAA Security rule slowly percolated into Roy’s head over the course of 2013 and 2014 as he presented our Digital Confidentiality courses and consulted for colleagues. It didn’t take too many $1000+ individual consultations to help folks with compliance before Roy started thinking about a better way to do things; something cheaper for customers and less time intensive for him. By late 2014 Roy and I (Brian) had bounced the idea back and forth enough that we were confident it was a feasible and sellable product.

My wife and I found out we were unexpectedly pregnant in early 2015, which kicked off a whole series of changes for me. I quit my day job of 15 years as a software engineer in Spring 2015 to focus on Person-Centered Tech and overseeing the construction of a small second house in our backyard. (We wanted to reclaim our upstairs room from our friends/housemates while still being able to live in close proximity.) Because my wife was in an educational program that would be difficult to stop and resume, we also planned that I would be the primary caregiver while she finished school and found a job using her new expertise.

Everything is Awesome! (When You’re Just Starting Out)

Roy and I decided that the summer of 2015 before the baby was born was our now or never moment for the Workbook. We knew we’d need to pay various outside experts and contractors to tackle pieces of the project we weren’t able to do ourselves, so we conceived the presale campaign to get the funds to do so. We were flattered and excited by your positive response and grateful for the opportunity to pursue such an exciting project. We thought it should be entirely feasible to get the outside things that we needed done with the funds raised.

Here was our plan of action as of April 2015:

1. Roy would continue the work he’d already done on mapping out the information we needed to acquire from the practitioner and how we would use that information to provide appropriate recommendations.
2. We would hire a lawyer to assist with the privacy policy, subscription agreement, etc.
3. We would hire a HIPAA Security expert to review our process to ensure it covered everything it needed.
4. We would hire an instructional video professional to create short video clips to guide practitioners through some of the most common information finding and setting change activities.
5. We would purchase/subscribe to the various hardware and software tools we needed to do our work and deliver the product to practitioners.
6. Roy would finalize the paper version of the product.
7. Brian would create software that could store the questions we needed to ask, show the proper questions to each practitioner based on their earlier responses, and record their answers.

With the minor exception of hiring Aaron for a few hours per month to help keep track of all the details for item 1, 1 through 5 went fairly smoothly. 6 and 7 did not go smoothly. Here is a list of the major assumptions we made that were incorrect:

• The compliance process would be complex, but still possible to turn into a paper product that someone could fill out/follow along with: As Roy and Aaron worked through the questions and decisions that would follow from them, it became clear that instead of hundreds of potential questions and tens of decisions, we needed thousands of potential questions and hundreds of decisions. Answering a hundred questions out of three hundred in the booklet and making tens of decisions along the way was never going to be fun, but it was feasible. Answering a hundred questions out of two thousand and making hundreds of decisions along the way was a different matter entirely. That’s the kind of thing you need a computer to help keep track of! And so we discovered that a paper workbook is simply not feasible.
• Overseeing his backyard construction project wouldn’t take a ton of Brian’s time: We have a general contractor, that’s what they do, right? Everyone who’s done something like this is shaking their heads right now. It turned out to be a 10-40 hour per week job depending on where we were in the process and how many decisions needed to be made. It also extended much later than hoped so it still took time all the way through 2015 instead of ending around October when the baby arrived.
• Brian had completed similarly complicated projects in a few months in his career, so this one should also go quickly: I significantly underestimated the importance of having an established working environment/process and the difficulty in transitioning from desktop to web applications. It took weeks to get everything set up to a point of moderate efficiency. Trying to do both the customer facing web application and the database facing backend simultaneously also proved overwhelming due to the number of new things I had to learn to make good web software.
• We could focus exclusively on the workbook until we had it far enough along that it would be usable: This was a problem in part because the work extended beyond the time period we had planned, but even before that happened we underestimated how much time and energy we needed to spend to keep the rest of the business going, even on a sort of low level standby mode.
• We could get the workbook to a usable state before Brian’s baby was born: Once the baby was born, I was in no state to do the complicated task of writing code, especially because the construction project was still consuming large amounts of time.

By December of 2015 it was clear that we weren’t going to be able to keep the lights on without spending more time on the core business. (We’d already stopped paying ourselves a few months after the presale as it became more apparent things were going to take longer than hoped.)

Climbing Out of the Hole

We spent the first quarter of 2016 working on improving the operation and analytics of our website to the point where we could more consistently sell our existing products. With the cash flow from that, we made our best move in quite a while: we hired Liath to help manage various things that we didn’t enjoy much or hadn’t had the time to tackle. Perhaps the biggest effort where Liath has been vital is becoming certified by APA to offer CE. We’re not there yet but well under way and it is looking good. That will help expand the number of clinicians who can use our CE substantially. We’re also moving to become certified by ASWB, which gets us about as close to national coverage as we can get without going after the pickier states one by one. APA and ASWB certification required us to set up an advisory board with clinicians from other professions. Unfortunately, our psychologist advisor won’t be able to continue after this summer; if you know of or are a psychologist in the Portland, OR area who might be a good fit for our material, please drop us a line!

I spent most of my time in the first half of 2016 trying to figure out how to get some expert assistance with the workbook software. We interviewed some development teams, found some good possibilities, and determined that there was no way we could afford them with our cash on hand. I then worked on securing a business loan, which first required writing a business plan since we had never done so and one of the banks wanted to see it. Long story short, no one wants to loan us money, but the exercise of writing the business plan was very helpful.
Roy was finally able to spend some time in the past month or so developing new content and we’ve been pleased to see fairly strong sales of the new guided readings.

Plan B (C? D?)

We’ve spent the last couple weeks figuring out how to keep going and get the workbook into your hands. We’re more convinced than ever that it’s a viable product after our business plan efforts, but apparently you can’t use conviction as collateral on a loan. We know you’ve been waiting a long time; we know it’s a long time because we’ve been frustrated/annoyed/thinking hard about the workbook every single day of that time. Here’s our current plan to get things done:

• We continue working on increasing our number of course offerings and number of potential customers until we reach a point where we’re actually making enough money to pay Roy and me. We’ve gone about as far as we can go on personal savings and credit after a year of basically no pay. If we can’t pay ourselves to work for PCT we’re definitely not going to get the workbook done. This work will primarily involve Roy and Liath.
• We revise our software production roadmap to incorporate a number of ideas we’ve had for places we can temporarily or permanently substitute a human being for automation. While discussing the project with potential development teams to hire we had several ah-ha moments where we realized there was a piece we’d been planning that wasn’t absolutely required to get folks all the way through to a completed Policies and Procedures manual.
• Brian and Roy resume work on the workbook software. That effort will be Brian’s highest priority after the various things needed to make sure the bills and payroll get paid, Roy doesn’t accidentally spend company money on movies, (The flaw of using the same bank for business and personal banking is that the debit cards for your two accounts look pretty close to identical.), etc. Roy’s highest priority after the basics will be to work through the backlog of content he’s been contemplating and people have been asking for, but our advisory board can only handle so much material to review at once so we expect he will still have some time left over for software development. This won’t be the quickest way to get things done, but it should be financially sustainable.
• As finances allow, we’ll hire a development team to tackle specific portions of the work that make sense to outsource due to time and expertise limitations on our part.
• We’ll provide regular status updates so you can see what’s going on and we have some accountability. We’ll do this at least quarterly and hopefully monthly. At the moment I’m planning that the next update will include a revised project planning graphic or table or the like that can accompany each update so you can see visually how much progress has been made and how much remains.

When Will It Be Done?

We don’t know.

This question is probably the most anxiety-inducing question a software developer receives on a regular basis, so I’ll spend some words unpacking it. Maybe it will help someone understand a software developer who’s their client a little bit better!

It’s usually possible to predict fairly accurately one particular programming task that is similar to something one has done before. One can mentally assign something into a very quick (less than 30 minutes), quick (less than two hours), not too bad (less than a day), ehhh (less than two days), tricky (less than a week), hard (less than a year), and extremely hard (maybe never).

When working on a project composed of many tasks that are similar to a task seen before, it’s usually possible during the planning stages to break the project down into individually estimable tasks and then add those estimates back up to get a rough sense of how long the project will take. One can add in estimates of how much time each programmer has available to get a rough sense of a plausible completion date for the project.

Where things go off the rails is when one is trying to make estimates for a project that’s so different from something the team has done before that it is composed of an unknown number of tasks, each of inestimable duration. Sometimes the best one can do in cases like this is say whether the project is possible. Sometimes one can do a bit better and categorize things into easy (weeks), moderate (months), difficult (years), and impossible (maybe never).
Our initial categorization of the challenge posed by the workbook software was moderately difficult. We don’t need to do something unique within the software industry and all of the computation that will take the computer a while to perform if approached via the simple brute force method isn’t time critical, so we can plan to deliver the product initially with the simple methods.

I think that was a reasonable guess at the time and still think it’s a reasonable guess now. The biggest problem for us has been overestimating the number of person hours available to spend on the project, not underestimating how long the various pieces of the project will take (although we’ve certainly done some of that too).
So, when will it be done? I’m hoping to refine this from a WAG (wild-assed guess) to a rough estimate between now and the next status update, but here’s my WAG: somewhere between 50 and 250 person days of work from now. How much time will we have to commit to the project? WAG: between one and five person days per calendar week on average. Combine those estimates and we get an EWAG (extremely wild-assed guess) date for a usable Risk Assessment piece of 10 to 250 calendar weeks from now.

I Can’t Wait That Long/I Need a Firmer Estimate!

We understand.

We’ll try to get a firmer estimate in the next status update, but it will still have pretty wide error bars.
We are happy to offer refunds to anyone at any time before we get you something usable. We’ve found some other people who offer HIPAA Compliance consulting/software packages, although we’ve never heard a report about how good they are from anyone who’s tried them. Here’s the list we’ve assembled of our competitors who work with small practices (none are specifically mental health focused) and our best estimate of the cost to use them:

• Security Metrics: ~$2,000/year
• HIPAA Care: $588/year
• HIPAA Compliance Services: $1,797/year
• HIPAATraining.net: $3,583/year

We’ve also contemplated some ways ambitious folks might work through some of the unfriendly security/compliance industry tools with liberal use of the Office Hours service that is available to all of you as Workbook Subscribers. Feel free to get in touch if that’s something you want to give a shot.

Off to the Project Planning Mines!

Ok, that’s all I’ve got for now, I’ll be back with another update by November 9th! (My internal goal is to have the next update before the end of September, but we’ll see.)