Hi Reader

Last week I gave you the 80%.

Five fixes you could knock out in an afternoon. Encryption, BAAs, 2FA, incident response, risk assessment.

If you did those: genuinely good work. You're ahead of most solo and small-group practices I see.

If you didn't: do those first. Today's list builds on them.

This week is the next layer — five more specific, actionable things that most practices haven't done, but that OCR and state boards increasingly expect to see.

1. Audit who actually has access to your EHR and revoke what shouldn't be there.

Open your EHR admin panel right now. Look at the active user list. I'll wait.

What you'll usually find: a former employee who was never deactivated. A contractor with full-record access when they only needed scheduling. A second account someone made because they forgot their password.

The HIPAA minimum necessary standard requires access to be scoped to what someone actually needs to do their job. "Everyone gets admin" is not a policy — it's a liability. Spend 20 minutes this week reviewing your user list and pruning anything that shouldn't be there. Document what you changed and why.

2. Stop texting PHI from your personal phone number.

I know you're doing it. Every clinician I work with is doing it at some point. A quick "your labs came back, call me" from your personal iMessage is a breach. So is a scheduling reminder with a patient's name attached.

The fix isn't complex: a HIPAA-compliant messaging app (Spruce, Klara, and TigerConnect are the ones I see most in small practices) gives you a second number that lives on your existing phone. Texts and calls go through the app. Your personal number stays clean. BAAs are available from all three. Setup takes under an hour.

If you're texting patients in any form right now without one of these, that's the highest-urgency item on this list.

3. Check what your transcription tool is doing with your session recordings.

AI-generated clinical notes are everywhere now. Ambient scribes, session summaries, automated SOAP notes. The tools are genuinely useful. The compliance setup is often an afterthought. Be sure to get consent from the patient in advance as well.

Questions you need answered for every transcription tool you use:

• Is there an executed BAA in place? (Most have them — you just have to request it.)
• Where is the audio stored, and for how long?
• Is the audio used to train their models? (Some tools do this by default. It can be opted out. But you have to ask.)
• Who at the vendor can access your recordings?

If you can't answer these, you don't actually know what's happening with your patients' voices. That's an uncomfortable thing to sit with, and it's fixable this week with one email to your vendor's compliance team.

4. Make sure your cloud storage isn't sharing PHI with the world.

Google Drive, Dropbox, OneDrive — all fine when configured correctly. All catastrophic when they're not.

The specific risk: shared links. Most clinicians have at some point created a "anyone with the link" share for a document that had PHI in it. If that link is still live, that document is publicly accessible.

This week: audit your shared files. In Google Drive, search "shared with: anyone." In Dropbox, check the Sharing tab. Revoke anything that doesn't need to be public. Then make it a policy that shared links are never used for documents containing patient information.

This is unglamorous and takes an hour. OCR has cited practices for exactly this.

5. Create a simple workforce training log — even if it's just you.

The HIPAA Security Rule requires workforce training. The Privacy Rule requires it. Both have always required it.

What most solo practices have: nothing in writing.

What you need: a document showing that training happened, what was covered, and when. It doesn't need to be a learning management system. A simple spreadsheet with dates and topics is defensible. One column: date. Second column: topic covered. Third column: who participated.

Topics that count: phishing awareness, device policies, what to do if you suspect a breach, how to handle PHI in email. If you've read these newsletters, you've already covered most of this material. Write it down. Date it. You've now got a training log.

None of these are exotic. All of them are findable in a basic OCR investigation. All of them are fixable without a consultant.

But here's the honest thing I'll tell you: the practices that get hit hardest aren't the ones that never tried. They're the ones that did some of this work but had gaps they didn't know about — a misconfigured sharing setting, a vendor without a BAA, a user account that was never deactivated.

If you're not sure about your gaps, let's find out.

I do 15-minute compliance calls with solo and small-group practices. No pitch. I'll look at your actual setup and tell you exactly what I see — what's solid, what needs attention, and what would be the first thing an investigator would flag.

Most of the people I talk to leave with a short, specific to-do list and real clarity about where they stand. Some of them come back to work with me. Most don't, and that's fine.

If you've read this far, you care about getting this right. Book the 15 minutes.

​→ Schedule your free compliance call here​

It takes 15 minutes. The paper trail you build from it could be worth a lot more than that.

— Dan.

P.S. You don't have to live like this...​

P.S. Working with me 1-on-1 is $5,000. And all summer it's 20% off!!! Use Promo Code SUMMER This is the fastest way to get you where you want to go whether you are Launching a Telehealth Practice or wanting to Grow and Scale the one you currently have. Here's what we'll do:

1. 6 One on One Personalized Strategy Calls - Implement the changes right away and access to private texts/calls in between to answer questions
2. Full Tech audit - What's working for you, what's not and what can be done better
3. How to incorporate AI safely and securely while saving you time and money
4. HIPAA Compliance, RPM, RCM, and more.
5. How to maximize revenue whether your private pay or insurance based
6. And so much more - Over $9500 in value for $5000 (now 20% off) with a Guarantee that we will help you make more than the cost of the program back in added revenue and more free time or we will continue to work with you until that happens.

​Payments plans now available through Stripe Processing

Also: Want to go back and look at our previous Telehealth Tips? Click Here​