50. Cybersecurity Risk Assessment with AI: Protecting Your Private Practice

By /

Cybersecurity Risk Assessment with AI: Protecting Your Private Practice

If you’ve ever felt overwhelmed trying to navigate tech security in your practice, this episode is for you. Cybersecurity risk assessment with AI doesn’t have to be confusing or time-consuming—and in this episode, I walk you through how to simplify the entire process using smart prompts and workflows. I even share the exact questions insurance companies ask so you can be fully prepared for cyber liability coverage.

Whether you’re applying for a policy or just want to better understand your risks, this episode gives you practical, therapist-friendly tools for getting started.

AI Tips You Don’t Want to Miss:

  • The exact cybersecurity questions therapists are asked during insurance applications
  • A ChatGPT prompt to use for your own cybersecurity risk assessment
  • How ElevenLabs and Berries fit into your secure workflow
  • My approach to documenting and storing protected health information using AI
  • Where to begin if you feel totally lost in the compliance and tech world

Connect with me:

Sponsored by Alma: www.helloalma.com/kym
Sponsored by Berries: www.heyberries.com/therapists

Transcript:

[00:00:00] Hi everybody. So every Wednesday I like to pop in here and just talk about what’s going on in the world of AI and in private practice.

[00:00:06] And occasionally we get questions. So first I want to read the question to you. So Eric said, when was the last time you did a cybersecurity risk assessment for your business? Most insurance policies require at least one annually.

[00:00:21] Okay. Firstly, never Eric, but I know you’re right and that this is actually something we are supposed to do in private practice. I’ve heard this before, and it’s like one of those things that just kind of falls off your radar. I don’t know about the rest of you guys, but for me for sure. You know, it’s one of those things in the back of your mind.

[00:00:38] It’s like. Should I be doing that? Maybe I should be doing that. But anyway, so I decided why not make an AI workflow and I’m actually gonna just build a GPT out for it too and offer it to my clinical AI club members. Like, why not have this available to make our lives easier?

[00:00:52] first of all, did some research. around this, I was first like, is it true? I mean, for sure I’ve heard that, but is it like a true thing?

[00:00:59] And yes, I did deep research with at GPT, you can do it with Claude. If you’ve got a paid version, you can do it with Gemini. You can do it with Gro. You can go in and actually click and chat you. You can click deep research and tell it to go, literally research this topic on the internet and find sources that corroborate what you’re asking.

[00:01:18] I had to do a deep research summary and basically it comes up with, yes, cyber liability insurance policies are a thing now. It’s prompted me to wanna go check my, I have CPH and associates. I wanna see if I have a cyber liability clause in there because what this is basically saying is, especially with HIPAA compliant companies, if you don’t have this type of security

[00:01:39] check that you’re doing, it might make your cybersecurity insurance null and void. So one, I wanna check CPH and associates and see if I’ve even got that clause in there. I, I’m pretty sure I do. I think I actually signed up for it. And then it talked about like insurance companies that are paying you to see clients.

[00:01:56] They wanna make sure that you’re HIPAA compliant and that they could do risk assessment audits. I’ve never heard of this, but. God only knows what else they’ll think of to try to do claw back money. So why not do this workflow in your private practice? So I came up with this prompt. I wanna give you guys, now you, you guys know, I, I have a question like this and I’ve gotta do a whole workflow for it after I come up with this.

[00:02:18] Okay, so the prompt goes like this, I’m a mental health therapist in private practice in the United States.

[00:02:23] I wanna create a cybersecurity risk assessment checklist specific to my practice. And then this is a template that I put together, but it says, here are the details about my setup. I’m a solo slash. In group practice. So I am fill in the blank. In solo practice, I use list your EHR, your video platforms, your email service, your cloud storage, anything you’re using in your practice as your day-to-day workflow.

[00:02:46] List it there. I provide telehealth in person only or hybrid. You can put that in there too. I am or am not billing insurance. I use a Mac, windows, iPhone, Android, and I access client information from home office, shared office, coworking space, mobile device. Put that in there, and then the prompt is please generate a cybersecurity risk assessment checklist.

[00:03:14] That one fulfills HIPAA security rule requirements, two, helps meet cyber liability insurance expectations. Three can be completed annually. Four includes encryption, software updates, password security, data backups, staff training if applicable, and incident response planning. And. Lastly, I want you to write the summary up into a clear non-technical language that I can follow and make this into a checklist.

[00:03:45] Easy to use and include space to mark items as complete so you, you can make this part of your private practice, whatever, wherever you keep your information. You can upload this document, like simple practice, for example. There’s a place where you can just upload information. Have chatt PT put this prompt in, fill it in with all your information, have it, do all this.

[00:04:02] Go through, literally check it. If you don’t know how to check it, use CHATT PT and say, I don’t know how to do this step Where, how do I even check if I’m on a, you know, I’m gonna make something like a i a SOC two security, I level with my EHR that I’m using, or whatever. Whatever it suggests.

[00:04:18] When you go through and put this prompt in. Go through each step. If you don’t know how to do it, ask it how to do it. It’s gonna give you detailed instructions on how to check that out, make a checklist, date it go through, check everything, fill in the blanks that you check this, you check that, and that it’s all secure.

[00:04:34] Save it somewhere. And there you go. You’ve completed a risk assessment using AI very quickly. That may or may not ever need to be accessed, but why not do it? It annually. Just put it on your calendar, pull it back up, run it back through chat TPT, and say, I need to reassess from last year. Absolutely.

[00:04:51] Nothing’s changed. Can you write it up again and put a new date on it? Or these are the two things that have changed. Can you, can you run the risk assessment again using that prompt that I just gave you and have it run through? You know, I mean, how easy is that? So Eric, I’m really glad you asked that question because like literally I’ve never done that and I probably shouldn’t even admit this stuff out loud, but it’s true.

[00:05:13] And I’m gonna do it. I’m gonna do a risk assessment. There’s a company person Centered Tech. I don’t know if you guys have heard of them, but they’re fantastic with this stuff. So if anything does come up on this, you can go over to Person Centered Tech or even tell JGPT to see what Person Centered Tech would say about it. It’s gonna search their website for you and then give you more detailed information on what, what you’re talking about.

[00:05:32] Pretty cool. I mean, that’s a good question, Eric, really, but there literally is a way to AI apply anything that you’re doing.

[00:05:40] So I think this is a really cool way to do it. You put that prompt in and just keep it. It. Keep it somewhere that you actually did it. If anybody ever ask, you could say, yep, I did a SE security compliance checklist. Now, if it tells you to do something, use chat CPT for that. Right? If it tells you to do something, you’re like, crap.

[00:05:57] No, that is not secure. Like really technically, our cell phones, even having them in the room with our clients is a HIPAA violation because our cell phones are listening, right? We’ve given it permissions. We’ve given all the apps, permissions to listen, gather information, all of that. So that already is. A problem technically, according to person center tech, you’re supposed to turn your phone off in a session before you even meet with your client.

[00:06:20] Nobody does that, but you’re supposed to. So it’s gonna come up with these things for you. I ran it through just like a couple of tests to see, and it’s a pretty good prompt. So I think, you know, those of you that want to try it and do it, try that prompt out and tell me what you think.

[00:06:33] Okay. I’m gonna be sending out an email if you’re on my email list. I did a presentation for as the clinical consultant for Barry’s. I did a presentation for HERD as. The Barry’s representative, and it was on productivity and ai. If you’re on my email list, we’re gonna be sending it out to you so you can watch the replay.

[00:06:53] It was just about, you know, how to be super productive using ai. I put a ton of prompts in there. Barry’s gave a, gave a ton of prompts. We gave our informed consent to show you how to just like put that right into your own informed consent if you’re gonna be using any form of, AI with your clients, you’re gonna wanna make sure you have that in there.

[00:07:11] I do see a question coming through. Renee is saying, How are you getting clients to buy into using AI in session for notes and treatment plans? Really easily. I’ve not had any problem with that whatsoever. I, it’s just varies. I use theirs. I just put it right into my informed consent, so. Annually, of course, I update my paperwork.

[00:07:30] I have my clients resign. I only have three clients right now. I don’t have a lot, but this is the workflow that I see most clinicians using, that they’re putting it into their intake paperwork. When the client comes in, of course it’s their job to read that informed consent and ask if you have any questions.

[00:07:44] I, you know, typically, at least used to do this when I had new clients. I would go through and just hit the high level points on the consent and just explain everything, see if they have any questions. Nobody’s had any questions, anybody that’s even remotely asked about it. I’ve just explained as a therapist, there’s a ton of crap basically that I also need to do to just maintain your chart, and that is, you know, writing these treatment plans that we talk about occasionally.

[00:08:09] Assessments that I do based on our first session and annually I might re-up an assessment if I haven’t seen you for a while. Progress notes, you know, I explain all the documentation. I say basically it’s very time consuming and it’s not something I can bill for. So what I’d like to do is use this tool in our sessions to help make this go a lot more smoothly For me, it just speeds up my documentation and then I’ll explain how I’m using the ai.

[00:08:34] So I use berries and basically. If you haven’t used it yet, you just go to hey barrys.com. They’ve got 20 free sessions. You go in there, there’s a button that you click record at the beginning of the session. If you’re telehealth, it just picks up the conversations over the computer. If you’re in your office, you just have it up on your browser or even your phone.

[00:08:52] You just pull it. Pull up the website and hit record. It’ll record both conversations and that’s it. And when you’re done, you hit the button. It doesn’t say, I explained that it does not save the recording of the session. It generates a transcript, which then generates a progress note. And then with Barry’s, of course, it generates a really helpful treatment plan, which we are supposed to share with our clients.

[00:09:13] So we would then at that point say, Hey, you know, make this a conversation. Like, okay, this is what. The AI I’m using is suggesting, I think it’s ex exactly right with this, this, and this. What do you think? Do you think these are goals that you can work with? That sort of thing. So involving them in the process and showing them what kind of, what the output is and how helpful it can be is really good.

[00:09:33] I haven’t had anybody have a problem with it whatsoever, so that, that’s how I explain it. Now, I’ve met other clinicians that put the consent in there and it’s part of it, and they say, I’m just not going to take a new client that doesn’t consent to this. I’m just gonna refer ’em to somebody else.

[00:09:48] There’s other clinicians and also in the a CA and a PA code of ethics with ai, if you go research that, it says that, you know, they have the right to choose and still be our client. So you have to, to look at those for your ethics board and make a decision around that. Like I said, some clinicians just aren’t gonna do that.

[00:10:06] They’re just gonna use the ai. And if the client doesn’t like it, they’re just gonna refer ’em out. But others, clinicians I’ve talked to have said, I’ve had a few that didn’t wanna do it, and I just don’t use it with them. So that’s, that’s how I handle that. I hope that helps.

[00:10:18] I think that’s just the best workflow. Like, why have two separate consents and everything. And you can copy it right from Barry’s. even if you’re not a Barry’s member, you can go over there and you can just download it or you can ask chat, TBT to write you an informed consent clause, like a lawyer would write it for client sessions using ai, and it’ll write it for you real quick.

[00:10:35] So that’s my, prompt. Maybe you guys can add that into your workflow. Thank you, Eric, for asking that question. It’s a really good one. Something I wasn’t doing, so it reminded me I need to do that too. And I hope you guys find it helpful. And if you have any questions, let me know and I’ll see you next week. Take care. Bye.