Risk Management In Group Practice

• Identify what forms of HIPAA Security policies and procedures are necessary for a group practice’s compliance
• Choose an employment structure that supports HIPAA Security compliance
• Identify a training program that can improve client care and reduce risk of liability
• Describe how to review client files and provide feedback to staff

1. HIPAA Security Compliance Process Overview
   • 3-step model of compliance
     1. Risk analysis
     2. Risk management and mitigation planning
     3. Security policies and procedures
2. Compliance for Group Practices
   • How risk differs in a group vs. a solo practice
     1. Risk “surface area”
     2. “Bring your own device” and HIPAA compliance
   • Security policy and procedure needs in a group vs. a solo practice
     1. HIPAA Security standards for workforce training and management
3. Impact of Employment Law on HIPAA Compliance Strategies
   • The eternal question: employees or contractors
   • Can the practice enforce its HIPAA Security policies and procedures?
4. Q&A
5. Technology and Risk Management
6. Paperwork and Risk Management
   • Creating a training program that improves client care, reduces liability, and engages staff
     1. Have clear policies and procedures
     2. Use examples, samples and tech tools
     3. Work as a group and share mistakes
     4. Collect feedback and adjust on a regular basis
   • Reviewing clients files and providing constructive feedback
     1. Use an objective tool to review notes and files
     2. Incorporate documentation into performance reviews
     3. Identify training needs and collaborate
7. Extended Q&A, next steps?

• Criteria for the Evaluation of Quality Improvement Programs and the Use of Quality Improvement Data, American Psychological Association, American Psychologist. 2009. September Vol 64 Number 6, Pages 551-557.
• Luepker, E.T. (2012) Record Keeping in Psychotherapy and Counseling. New York, NY: Routledge.
• Reamer, Frederic G., “Social Work in a Digital Age: Ethical and Risk Management Challenges” (2013). Faculty Publications. 391. https://digitalcommons.ric.edu/facultypublications/391
• Reamer, F. (2001). The Social Work Ethics Audit: A Risk-management Tool. (Washington, DC: NASW Press).
• Schwitzer, A.M. & Rubin, L.C. (2015) Diagnosis & Treatment Planning Skills. Thousand Oaks, CA: SAGE Publishing.
• US Dept. of Health and Human Services. (2006). HIPAA Administrative Simplification . Washington, DC: Author.
• US Dept. of Health and Human Services. (2013). HIPAA Omnibus Final Rule . Washington, DC: Author.
• Wiger, D.E. (2012) The Psychotherapy Documentation Primer, 3rd Edition. Hoboken, NJ: John Wiley & Sons, Inc.
• Zuckerman, E.L. & Kolmes, K. (2016). The Paper Office for the Digital Age, 5th Edition. New York, NY: The Guilford Press.

Roy Huggins, LPC NCC, is a counselor in private practice who also directs Person-Centered Tech. Roy worked as a professional Web developer for 7 years before changing paths, and makes it his mission to grow clinicians’ understanding of the Internet and other electronic communications mediums for the future of our practices and our professions.

Roy is an adjunct instructor at the Portland State University Counseling program where he teaches Ethics, and is a member of the Zur Institute advisory board. He has acted as a subject matter expert on HIPAA, security and clinical use of technology for Counseling licensure boards and both state and national mental health professional organizations. He has co-authored or authored 2 book chapters, and he routinely consults with mental health colleagues on ethical and practical issues surrounding tech in clinical practice. He served for 5 years on the board of the Oregon Mental Health Counselors Association and then the Oregon Counseling Association as the Technology Committee Chair.

He really likes this stuff.