Group Practice Tech

Group Practice Tech by Person Centered Tech: a podcast where we help mental health group practice owners ethically and effectively leverage tech to improve their practices.

Group Practice Tech is a business podcast hosted by Person Centered Tech, with 100 episodes on record and a Required Pod Score of 80.

Person Centered Tech hosts Group Practice Tech, a business show with 100 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #30

  Episode 630: "I Have to Report This, Right?" Mandatory Reporting and the Risk of Future Harm

  Sep 25, 202617 minS6

  Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we're discussing a topic that's come up frequently in the wake of the Clancy case: mandated reporting. We cover: Misconceptions around mandated reporting Mandatory reporting vs. other legal and ethical duties that apply What a clinician needs to evaluate when there is concern harm may occur Permission to disclose vs. duty to protect Tarasoff duties and liabilities Determining what is required and what is permitted under applicable law The framework that Eric Strom and Liath presented in the related CE course to determine what to do in these situations Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources On-demand CE course: "I Have to Report This, Right?" Law and Ethics of Mandatory Reporting, Tarasoff Liability, and the Limits of Confidentiality When a client reveals possible abuse or a risk of harm, how do you determine whether a report is required, a disclosure is permitted, or another protective action is needed? In this three-hour legal-ethical CE course (APA and NBCC approved,) attorney and clinician Eric Ström and PCT's Liath Dalton work through these distinctions and their implications, real-world scenarios, differing state laws, and the decisions clinicians face when confidentiality and safety intersect. The course includes the PAUSE framework and worksheet to help you reach and document a proportionate, client-centered response. "This was one of the better, more involved and detailed CE's I have ever attended" "After working 40 years as a therapist, and 25+ of those years in private practice, this is the FIRST time 'Tarasoff' (its hx and utility) was made clear!" On-demand CE course: Legal-Ethical Cross-Jurisdictional Telemental Health in 2026 For clinicians practicing across state or national borders, this course examines how client location, clinician location, and licensure jurisdictions can affect confidentiality, mandatory reporting, emergency response, and other obligations. 3 legal-ethical CE credit hours. APA and NBCC approved. Direct Support and Consultation: Group Practice Care Premium — For group practice leaders who want support as questions arise, Premium includes weekly live and recorded Group Practice Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. Solo Practice Care Premium — For solo clinicians who want support as practice questions arise, Premium includes weekly live and recorded Office Hours, with a monthly session featuring therapist attorney Eric Ström, JD, PhD, LMHC. Additional resources HHS: HIPAA Privacy Rule and Sharing Information Related to Mental Health — Guidance on when HIPAA permits mental health information to be shared, including circumstances involving safety concerns. HHS: Disclosure When a Patient Presents a Serious Danger — Explains HIPAA's permission to disclose information to someone reasonably able to prevent or lessen a serious and imminent threat, when the applicable conditions are met. Child Welfare Information Gateway: Mandatory Reporting of Child Abuse and Neglect — An overview of reporting requirements and how they vary across states.

  ListenShow Notes
• 

  Episode #29

  Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know

  Sep 18, 202628 minS6

  Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation. We discuss: Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles Opportunistic vs. forced TLS Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace What HIPAA actually requires for email security Where NIST (National Institute for Standards of Technology) guidance fits in The actual risk analysis for legacy TLS Benefits of secure email services, and when it might make sense to cancel Data to gather from your secure email service to do your own risk analysis Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Episode 623: Now You Can Secure Outbound Email in Google Workspace Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management. PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know PCT's detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate. PCT's Free Google Workspace Configuration Help Center Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS. PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice PCT's framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources 45 C.F.R. § 164.312 — HIPAA Security Rule Technical Safeguards The regulation itself, including the Transmission Security standard at § 164.312(e). HHS: Are Covered Entities Required to Use NIST Guidance Documents? HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule. HHS: Is the Use of Encryption Mandatory in the Security Rule? HHS explains the Security Rule's risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards. Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections Google's current documentation on Gmail's support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable. NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations NIST's technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.

  ListenShow Notes
• 

  Episode #28

  Episode 628: HIPAA Security Officer: Who Leads, Who Does the Work, and Who's Liable?

  Sep 11, 202630 minS6

  Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we go over some common questions we get at PCT about the HIPAA designated Security Officer role. We discuss: The primary purpose of the Security Officer's role What is actually required of the person in this role Determining the right person for this role in your practice Tasks that can be passed off to a Deputy Security Officer Operational structure for Security Officers and Deputy Security Officers Whether the Security Officer or Deputy Security Officer hold individual liability in the event of a breach Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website.

  ListenShow Notes
• 

  Episode #27

  Episode 627: Key Takeaways from Day One of the 2026 NIST–OCR HIPAA Security Conference: Security Rule Updates & Risk Analysis

  Sep 4, 202624 minS6

  Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we recap what behavioral health practice owners should know from day one of the HIPAA Security Conference. We discuss: The timeline for proposed Security Rule changes What practices must have documented in writing according to the current Security Rule Encryption being reasonable and appropriate in almost every practice environment Expanding risk analysis enforcement initiative to include risk management Why risk analyses are foundational, and what they have to include that a gap analysis doesn't Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. PCT Resources HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Episode 618: HIPAA Security Rule Update—What We Know, What We Don't, and What You Should Do Right Now — Our previous update on the proposed HIPAA Security Rule changes, the regulatory uncertainty surrounding them, and why practices should continue strengthening their security under the current rule while the rulemaking process unfolds. Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources HIPAA Security Rule Notice of Proposed Rulemaking Fact Sheet — The Office for Civil Rights' summary of the proposed Security Rule modifications, including greater specificity for Risk Analysis, written documentation requirements, defined compliance intervals, and proposed changes to "addressable" implementation specifications. Unified Agenda Entry for the HIPAA Security Rule — The current federal regulatory agenda lists the rulemaking as a long-term action with final action anticipated in July 2027. This is a planning estimate rather than a legal deadline or guaranteed publication date. HHS OCR Guidance on Risk Analysis — Official guidance explaining the required scope and elements of a HIPAA Security Risk Analysis, why "addressable" does not mean optional, and how Risk Analysis provides the foundation for an organization's risk-management decisions. HHS OCR Security Rule Guidance Materials — A collection of official Security Rule resources, including OCR presentations on Risk Management and Recognized Security Practices, educational papers, and links to relevant NIST publications.

  ListenShow Notes
• 

  Episode #26

  Episode 626: Is Google Search Console HIPAA-Friendly? What Therapy Practices Can Learn Without Google Analytics

  Aug 28, 202615 minS6

  Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we share a HIPAA-friendly way for therapy practice owners to get useful information about how their websites are performing, via Google Search Console. We discuss: What Google Search Console can tell you about your website The crucial differences between Google Analytics and Google Search Console Why Search Console is permissible for therapy practice websites Caveats and what to consider when configuring Search Console Listen here: https://personcenteredtech.com/group/podcast/ For more, visit our website. Resources for Listeners PCT Resources Podcast: Episode 625: Google Analytics for Therapy Practice Websites—The HIPAA Risks Explained — The companion episode explaining why Google Analytics is not appropriate for therapy-practice websites and how individually identifiable website activity can become protected health information. PCT CE course: Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD, PhD, LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements. PCT's Google Workspace Configuration Help Center — Includes step-by-step, video-based guidance for securing, configuring and leveraging Google Workspace appropriately for a therapy practice Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT's Comprehensive HIPAA Security Compliance Program bundles : For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Resources Google Search Console — Google's free tool for understanding how a public website performs in Google Search, including the search terms that result in a website appearing, impressions, clicks, search position, indexing issues, and website-health information. Google Search Console Performance Report: Dimensions and Data Groupings — Google's explanation of the search-query, page, country, and device information available through Search Console. It also explains that some queries are omitted from reports to protect searcher privacy. Google Search Console: Verify Your Site Ownership — Google's instructions for verifying ownership through methods such as a DNS record or HTML file or tag. Google Analytics and Google Tag Manager are optional verification methods and do not need to be enabled to use Search Console. Google Search Console: Managing Owners, Users, and Permissions — Guidance for limiting Search Console access and periodically reviewing who has owner- or user-level access to a practice's website data. Google Search Console: Remove Information From Your Website From Google Search — Google's guidance for keeping sensitive, authenticated, or otherwise inappropriate pages out of search results and removing pages that have already been indexed.

  ListenShow Notes

Recent guests on Group Practice Tech. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.