{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"Episode 625: Google Analytics for Therapy Practice Websites \u2013 The HIPAA Risks Explained","description":"Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we unpack the reasoning, step by step, behind PCT\u2019s position on Google Analytics for therapy practices. We discuss: Can website activity constitute Protected Health Information? HIPAA\u2019s definition of healthcare operations vs. HIPAA\u2019s definition of marketing Business Associates, and how there is no BAA available for Google Analytics The disclosures required for HIPAA authorization for marketing activity Cases where collecting PHI without a BAA has gone awry The risk context in an increasingly AI world The takeaway: is it permissible for therapy practices to use Google Analytics on their practice websites? Uniting as an industry to demand BAAs for Google Analytics Listen here: https:\/\/personcenteredtech.com\/group\/podcast\/ For more, visit our website. PCT Resources Marketing in Mental Health: The Legal and Ethical Do\u2019s and Don\u2019ts You Need to Know \u2014 This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Str\u00f6m, JD PhD LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations\/ROIs, advertising, referrals, reviews, and endorsements. Group Practice Care Premium weekly (live & recorded) direct support & consultation service, Group Practice Office Hours \u2014 including monthly session with therapist attorney Eric Str\u00f6m, JD PhD LMHC Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost) Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more HIPAA Risk Analysis & Risk Mitigation Planning service for mental health practices \u2014 care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You\u2019ll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks. PCT\u2019s Comprehensive HIPAA Security Compliance Program (discounted) bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice Device & Workspace Security Suites Direct Support & Consultation from PCT team + therapist attorney Eric Str\u00f6m, JD PhD LMHC (live & recorded + searchable library) Includes the Risk Analysis & Risk Mitigation Planning service + tool HIPAA Security & Privacy Ethics training Resources HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates \u2014 OCR\u2019s current guidance on how the HIPAA Privacy, Security, and Breach Notification Rules apply to website and app tracking technologies. It addresses when website activity may constitute PHI, tracking on authenticated and unauthenticated webpages, Business Associate Agreements, marketing disclosures, HIPAA authorization, and risk analysis. Google: HIPAA and Google Analytics \u2014 Google\u2019s own guidance for HIPAA-regulated organizations. Google states that regulated entities must not expose Google Analytics to PHI and that Google does not offer Business Associate Agreements for Google Analytics. American Hospital Association v. Becerra \u2014 June 20, 2024 Court Decision \u2014 The federal court decision that partially vacated OCR\u2019s tracking-technology guidance regarding an IP address combined with a visit to an unauthenticated health-related webpage. The decision is important for understanding what may\u2014and may not\u2014constitute individually identifiable health information in the context of website tracking. HHS: Business Associates \u2014 HHS guidance on when a person or company becomes a HIPAA Business Associate, including when a vendor performs data analysis or other functions involving PHI on behalf of a covered entity. HHS: Marketing and the HIPAA Privacy Rule \u2014 Guidance on HIPAA\u2019s specific definition of marketing, the exceptions to that definition, and when written individual authorization is required for uses or disclosures of PHI for marketing. FTC: BetterHelp Health Data and Advertising Enforcement Action \u2014 The FTC\u2019s action concerning BetterHelp\u2019s disclosure of sensitive consumer health information to third parties for advertising purposes. Importantly, this was FTC consumer privacy enforcement, not HIPAA enforcement, but it provides a real-world example of the risks associated with health-related information flowing into advertising and tracking ecosystems. ","author_name":"Group Practice Tech","author_url":"https:\/\/personcenteredtech.com\/group\/podcast\/","html":"