The Impact of Healthcare Reform on Psychotherapy Services

Outlines and describes reasons for healthcare reform, discusses ways these reforms will transform  behavioral health  and psychotherapy services.  Illustrates the goals of Patient-Centered HealthCare and processes leading to that goal.

Healthcare reform is all around us. Behavioral health and psychotherapy will not be exempted from these changes.  Mental health professionals do not yet experience the full impact of healthcare reform legislation, but it impacts are surfacing regionally and nationally in both obvious and subtle ways.  Providers know something is happening, but don't see it fully or feel it yet.  The effects are not unlike those of tornados or floods in other parts of the country. Many providers seem to believe they are shielded from these changes.  Perhaps they feel shielded because their fees-for-service are good or insurance payers are not auditing practices in their area, right now.  In many states, healthcare policies are changing so quickly that a considerable interaction with knowledge experts is required to understand the consequences of the economic, regulatory and the legislative forces at work.  

Reasons for Healthcare Reform

Healthcare reform is based on public and legislative consensus that healthcare services are often fragmented, uncoordinated and insufficiently accountable. For many patients, satisfaction with care they receive is low.  And patients who have emergencies, illness, or disease are often unable to afford or obtain health and wellness care.  Referrals and coordination of care practices have been inefficient. There have not been effective means to assure that physical and mental health needs are met.  

There are failures in the provision of healthcare and significant inefficiencies. Public health suffers as a result, the cost of healthcare goes up. Until the recent decade, the focus of healthcare services was concentrated on treating serious and life threatening disease an injury rather than prevention.  Improvements in quality, savings, and better patient care result when the focus shifts to collaboration and prevention.  The Health Information Technology for Economics and Clinical Health Act (HITECH) and the Patient Protection and Affordable Care Act (ACA) have been central to the resurgence of healthcare management by public and commercial health care payment sectors.  In the mid 1980’s and early 1990’s, managed care meant “restricting care” based on criteria that that were not transparent or accountable. In 2013 the focus moved toward on ensuring access, improved general health and cost reduction.

Beginning with the ACA, healthcare reform focused on the quality of care.  This focus requires that healthcare be measured, accountable, transparent, affordable and available.  As a result of the ACA and the HITECH, fee-for-service mental health services will be shifting to coordinated and accountable care as illustrated in Figure 1.  

The Triple Aim of healthcare reform is to (1) insure reasonable access to care and a positive patient experience, (2) improve patient and group health and well-being, and (3) to manage and contain costs.  These three goals are to be implemented in a manner that is transparent and accountable. Measures of the Triple Aim are being created, evolving and used.  Both healthcare providers and payers will be accountable.  

Mental Health Transformations

Insurance payers have begun to signal that they want to contract with groups rather than individuals.  Many payers are open about this preference.  And the preference makes sense.  It costs less and it requires psychotherapists to be accountable to their peers.  Privately, insurance payer representatives state that it is their job to reduce the cost of care any way they can legally do and that it is providers’ job to assert them selves.  

Groups of physicians have responded effectively to payers because they are organized, they have business consultants, data and financial resources. Mental health professionals can not respond effectively when they operate in isolated private practice.  Especially when they rely on paper charts.  Barriers to individual practitioner’s ability to form practice groups exist in their inability to collectively gather local data and provide credible arguments for the quality of their care. Individual practitioners are powerless to counter the pressures that can be exerted by insurance companies and government supported insurance actions.  However, by “grouping up,” psychotherapists can create avenues of influence.  Psychotherapists who form larger groups or associations of practice groups can create efficiencies of scale and consumer benefits that solo and small group practice professionals cannot.

Payers are interested in group contracts in part because single provider contracts are an economic burden to them.  Further, payments to providers are shifting from “claims–based” to “inherent value”, "added value" and “pay-for-performance” (P4P) criteria.  Private employers, and commercial payers, are following this lead by asking for quality of care that is measurable as opposed to earlier payment models that restricted care without accountability.  

Mental health services, under the ACA, have parity with medical care.  Mental health services  are now considered specialty care as are other points of care such as neurology, cardiology, etc.  Just as for other specialty care providers; third-party paid mental health services must become coordinated and accountable.  In medicine, primary medical care is becoming the care coordination center in new models called Primary Care Medical Homes (PCMH) and Patient Centered Primary Care Homes (PCPCH).  Hospitals and hospital systems are purchasing medical practices and forming Hospital Medical Homes (HMH) and Accountable Healthcare Systems (AHS) designed to manage care in communities and regions.  

The Patient Protection and Affordable Care Act (ACA) was written in part to assure that health plans coverage for mental health services are on par with physical illnesses. In Oregon, the ACA was adopted as state law and is being implemented in Coordinated Care Organizations (CCOs) that are similar and in most ways identical to Federal Accountable Care Organizations (ACOs.)  Healthcare infrastructure is adapting on a state by state basis.

While traditional solo practice fee-for-service will remain for the near term, psychotherapists will over time find it increasingly necessary to coordinate care, provide measures, and demonstrate accountability for services they provide.  Figure 1 describes the changes taking place in mental health services. In this new system of care, patient screenings, referrals, progress and outcomes will be tracked by physicians and payers.  The move from fee-for-service to coordinated care will require changes in the way psychotherapists practice. Psychotherapists are not specifically required by the ACE to be accountable for the services they provide.  Physicians, however, are directly responsible, and have financial incentives to measure and manage the quality of services that psychotherapists provide.  Since physicians are required to coordinate and measure the quality of care, they are also in position to manage and direct behavioral and mental health services over time.

Figure 1.

Michael G. Conner, PsyD is a psychologist in private practice and an owner of Private Practice Cloud, LLC a healthcare operation support business. His business currently supports The American Mental Health Alliance Oregon (AMHA-OR). Dr. Conner is a member of the Board of Directors of Mentor Research Institute (MRI). He acknowledges Michaele P. Dunlap, PsyD, Board Secretary of AMHA-OR, and President of MRI, as co-author of this article.

What is Protected Health Information in Psychotherapy Practice?

The Brief defines protected health information (PHI) under federal law. 

"The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information" (PHI).

“Individually identifiable health information” is information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,

• the provision of health care to the individual, or

• the past, present, or future payment for the provision of health care to the individual,

and identifies the individual or there is a reasonable basis to believe it can be used to identify the individual.

Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number, etc...).

The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

Dis-Identified Health Information

Data are "individually identifiable" if they include any of the 18 types of identifiers for an individual or for the individual's employer or family member, or if the provider or researcher is aware that the information could be used, either alone or in combination with other information, to identify an individual. There are 18 identifiers.

1. Name

2. Address (all geographic subdivisions smaller than state, including street address, city, county, or ZIP code)

3. All elements (except years) of dates related to an individual (including birth date, admission date, discharge date, date of death, and exact age if over 89)

4. Telephone numbers

5. FAX number

6. Email address

7. Social Security number

8. Medical record number

9. Health plan beneficiary number

10. Account number

11. Certificate/license number

12. Any vehicle or other device serial number

13. Device identifiers or serial numbers

14. Web URL

15. IP address

16. Finger or voice prints

17. Photographic images

18. Any other unique identifying number, characteristic, or code

A critical point of the Privacy Rule is that it applies only to individually identifiable health information held or maintained by a covered entity or a business associate acting for the covered entity.

Individually identifiable health information held by anyone other than a covered entity, including an independent researcher who is not a covered entity, is not protected by the Privacy Rule and may be used or disclosed without regard to the Privacy Rule.  This is why psychotherapists need to implement Business Associate Agreements (BAA).  There may, however, be other Federal and State protections covering the information held by these entities that limit its use or disclosure.

http://privacyruleandresearch.nih.gov/pr_07.asp

Michael G. Conner, PsyD is a psychologist in private practice and an owner of Private Practice Cloud, LLC a healthcare operation support business. His business currently supports The American Mental Health Alliance Oregon (AMHA-OR). Dr. Conner is a member of the Board of Directors of Mentor Research Institute (MRI). He acknowledges Michaele P. Dunlap, PsyD, Board Secretary of AMHA-OR, and President of MRI, as co-author of this article.

What's Driving Healthcare Reform?

Briefly describes eight legislative and regulatory forces now transforming healthcare services in the United States.  These forces establish technological and regulatory incentives and requirements on insurance payers and healthcare providers.  The purpose of healthcare reform is described.

Despite having the world’s most expensive health care system, the United States ranks last compared with six other industrialized nations based on measures of quality, efficiency, access, equality and healthy lives.  The overall purpose of healthcare reform in the United States is to improve quality and outcomes through  measurement, transparency and accountability.  

The driving forces transforming healthcare in the United states are:

1. American Recovery and Reinvestment Act (ARRA) /HITECH) .

2. Patient Protection and Affordable Care Act (ACA)

3. Health Information Technology for Economic and Clinical Health Act (HITECH),.

4. U.S. Department of Health and Human Services National Strategy for Quality Improvement in Health Care (National Quality Strategy)

5. Health Insurance Portability and Accountability Act (HIPAA)

6. National Commission on Quality Assurance (NCQA)

7. Centers for Medicare and Medicaid (CMS)

As defined by the ACA, the “Triple Aim” of the ACA is to:

1. Ensure access to healthcare and patient satisfaction.

2. Improve group health and well-being.

3. Manage or reduce healthcare costs.

The ARRA requires providers (EPs) eligible for reimbursement to use certified electronic health record systems (EHRs).   Mental health care providers are not currently defined as “eligible”.   

The HITECH Act calls for voluntary adoption of health information technology (HIT) technology throughout the health care system. This new law substantially expands the federal government's effort to

1. Establish a national electronic patient records system.

2. Establish comprehensive privacy and security standards for records.

3. Establish incentives for healthcare providers (not including Mental Health) who adopt Meaningful Use (MU) criteria.

Meaningful Use (MU) is a set of criteria for the use of electronic health record systems (EHR) to improve patient care by healthcare providers.  The concept of meaningful use was developed by the National Quality Forum (NQF).  Their ideas included improved population health, coordination of care, improved safety, and promoting patient engagement by creating a common interoperable electronic health record system that supports information exchange and provides information to providers that supports data informed practice decision making.  Physicians are given financial incentives to adopt EHRs that are certified by the Federal government and support MU.  Behavioral and mental health care providers are not eligible.  

The U.S. National Quality Strategy includes:

1. Promoting better health and health care delivery focusing on engagement.

2. Attending to the health needs of all patients.

3. Eliminating disparities in care.

4. Aligning public and private sectors.

5. Supporting innovation, evaluation and rapid-cycle learning and dissemination of evidence.

6. Utilizing consistent national standards and measures.

7. Focusing on primary care and coordinating and integrating care across the health care system and community.

8. Providing clear information so constituents can make informed decisions.

HIPAA rules were enacted by the U.S. Congress that requires formal notices must be sent to patients for any data breach when private Protected Health Information (PHI) is revealed to the public and it allows for fines.  The rules are specific concerning how and under what circumstances PHI can be shared in the operation of healthcare services.  HIPAA provides for a complaint process, investigation and enforcement of penalties.

NCQA is a not-for-profit corporation that  serves individual healthcare providers, provider groups, health plans and organizations offering:

1. Accreditation, Certification and Recognition programs for healthcare providers and organizations.

2. Performance Measurement and Report Cards

3. Educational programs designed to improve health care by disseminating best practices.

4. Recommendations for Public Policy

NCQA promotes  Primary Care Medical Home (PCMH)  and provider Tier designation criteria derived from measures of quality that have value to healthcare payers and that can be used as a basis to negotiate reimbursement rates based on anticipated outcomes.  

CMS is the largest insurance payer in the United States, is funded by the Federal government through the Center for Medicare, Medicaid and CHIP.   Nearly 50% of all healthcare services are paid for and administered by CMS, making it the largest health plan and market force in the US.  CMS’ role in the larger health care arena has been expanded to support affordable health care and make the U.S. health care system more outcome-driven and cost-effective. 

The ACA requires CMS to:

1. Expand Medicaid.

2. Regulate private health insurance plans.

3. Create high quality care and better health outcomes at lower costs through improvement to health care for all Americans.

4. Promote health care innovation.

5. Reduce disparities in healthcare.

6. Coordinate with States to set up Health Insurance Marketplaces,

7. Establish Affordable Insurance Marketplaces.

8. Integrate the Center for Consumer Information and Insurance Oversight to oversee market reforms and consumer protections in the private health insurance market.

9. Promote the adoption and use of health information technology in the nation’s health care system.

Michael G. Conner, PsyD is a psychologist in private practice and an owner of Private Practice Cloud, LLC a healthcare operation support business. His business currently supports The American Mental Health Alliance Oregon (AMHA-OR). Dr. Conner is a member of the Board of Directors of Mentor Research Institute (MRI). He acknowledges Michaele P. Dunlap, PsyD, Board Secretary of AMHA-OR, and President of MRI, as co-author of this article.

Formation of an Independent Practice Association to Protect Private Psychotherapy Practice

Two or more psychotherapists who provide services are considered competitors.  Agreements between psychotherapists that obviously restrain competition are “per se” illegal (i.e. intrinsically illegal) and include:

1. Setting or “fixing” prices..

2. Dividing markets.

3. Refusal as a group to provide services to customers (i.e. boycotting).

As matter of law, it is illegal for psychotherapists to agree on:

1. The rates they will charge for psychotherapy services.

2. Which community, population or patients they will and will not serve.

3. Insurance companies or other third-party payers with which they will or will not contract.

A group of mental health professionals can come together to discuss ways to collaborate and provide a higher quality of care provided the primary focus of their conversation is how working together in their formal association can provide a significant benefit to consumers.  Professionals in these conversations can discuss the cost to deliver the care provided, when, and only when, that conversation is ancillary to providing services which greatly benefit consumers. The primary purpose of conversation must be plans to deliver services that benefit consumers in a way that could not otherwise be provided by professionals practicing solo.

Individuals can form a committee to discuss the formation of a business association.  At some point, their conversations and business planning must be structured within the context of an attorney-client relationship - forming an Independent Practice Association (IPA).  

Once formed, IPA leaders can talk about potential business practices including directing, coordinating, organizing, encouraging, steering, setting agendas , and discussions for the purpose of creating potential service delivery models that are pro-competitive, that result in competitive agreements, and secure a fair compensation for association members as a group. This acceptable plan making is contingent on their pursuit of goals that provide and develop means to deliver services likely to be improved by the association which create a more valuable benefit to consumers than could be obtained from individuals who are not associated. 

Guidelines to Legally Discuss Quality, Value and Price

 It is important to have a discussion regarding quality, value and price in order to determine whether or not your community and your potential members have an interest or even an ability to improve on the status quo. Psychotherapists might have to abandon the notion of forming an IPA if their community consists predominantly of solo private practice professionals who are close to retirement and professionals who have a high referral rate of cash pay clients. 

Those intending to organize a private practice association may encounter significantly more resistance from professionals who are close to retirement or have cash only practices.  That is not always true, since some professionals are more interested in sharing what they have learned; helping to create a future for newer mental health professionals.

In order to discuss fees for service among a group of professionals the framework for that communication needs to:

1. Recognize that quality is the degree to which services and treatment increase the likelihood of desired outcomes.

2. Define opportunities and means to improve quality.

3. Identify and define the value propositions in the list of quality improvement initiatives.

4. Identify the costs to implement and administer quality improvement initiatives as well as reasonable profit.

5. Clarify whether quality improvement can be implemented on a cost plus reasonable profit or a fair price within which individual practitioners can administer their contract requirements.

Illegal Topics of Discussion

 There are topics that should not be discussed among independent practice psychotherapists.

Here are a few important cautions:  

1. Never discuss price or cost among members unless the discussion is ancillary to quality and represents a potential benefit for consumers.

2. Members of an IPA must never discuss price and cost with a Payer.

3. Members of an IPA should never have a "naked" conversation or exchange about setting any price for their services.

 Michael G. Conner, PsyD is a psychologist in private practice and an owner of Private Practice Cloud, LLC a healthcare operation support business. His business currently supports The American Mental Health Alliance Oregon (AMHA-OR). Dr. Conner is a member of the Board of Directors of Mentor Research Institute (MRI). He acknowledges Michaele P. Dunlap, PsyD, Board Secretary of AMHA-OR, and President of MRI, as co-author of this article.

Should Therapist Locator Systems Offer a BAA? Have one from Psychology Today?

Technology companies think about HIPAA very differently than most mental health professionals are trained to think about HIPAA. There are many loopholes, vulnerabilities and areas of misinformation related to the differing legal responsibilities of therapists and the technology companies which serve therapists.

The old saying “We don’t know what we don’t know” speaks to the issues of concern about online therapist locator services.

As the developer of a website functionally equivalent to Psychology Today’s therapist locator, internal referral communication services and a telehealth system, I have hands-on understanding of what a high-tech database, talented engineers, marketing professionals and advanced programming software are capable of doing. I have spoken with numerous developers of EHR and outcome measurement systems. I understand the technology and functionality of therapist locator systems, intranet text communication and referral technology, and the vulnerabilities of that technology.

Website developers know that a therapist locator site touches significant information provided by the public. In my opinion the public may reasonably believe that therapist search information is protected or at least private; not for distribution, sale or publication. Furthermore, therapists must bear some responsibility to vet the businesses they employ to help them market their services and facilitate communication between therapists and the public.

Every IP address, MAC Id, cursor movement, keystroke, click, or file opened in a therapist locator system, can be time stamped, viewed, digitally recorded and saved using the system’s hosting platform. All that data could be aggregated, correlated, analyzed, viewed, saved, published and sold; legitimately or not.

According to software developers and US Department of Health and Human Services, one small piece of data can be a key to identifying a person as the patient of a specific provider. Virtual private networks are not enough to keep PII and PHI private. Knowing this, a website therapist locator service should be designed so that security procedures and organizational policy keeps private and secure Personally Identifiable Information (PII) and Protected Health Information (PHI) gathered implicitly and explicitly from the public.

Like every other therapist locator website, the database I created is capable to determine the identity of individuals who use it. For example, business intelligence (BI) software and advanced SQL queries and AI are capable to connect the identity of individuals using a website with the reason those people have for contacting providers. Such software is capable to identify the providers who are contacted. That capability should be highly secured and the data should be accessible only through appropriate permission strategy, a 3 step access verification, and login tracking.

Sharing a therapist locator’s internal communication database with the capabilities of other data warehouses could allow construction of elaborate profiles of individuals who navigated the website and used the therapist locator. With that information a sophisticated phishing initiative could, for example, be developed targeting uninformed, vulnerable patients, their friends and/or family members.

We can only imagine what malicious employees of Psychology Today working with cohorts at Amazon could do! Appropriate BAAs would lock the front and back doors on opportunities for malfeasance.

As a psychologist and software engineer educated in HIPAA issues and the purposes of BAAs, I know the websites I create are high-tech healthcare operation services which should comply with HIPAA regulations. I believe businesses providing therapist locator services should set and meet a high professional and ethical bar. Ask yourself, do I have any patient who would feel harmed if their identity as a patient, what they are being treated for, and our phone numbers were published?

Patients and providers cannot be protected from the behavior of shady organizations or their employees without protections enforced by the powers of Federal and State regulation and the Departments of Justice. PHI is defined and protected by HIPAA regulation. This includes PII which covered entities use or store as part of care. That information is only shareable for medical purposes. HIPAA does not confine PHI to healthcare records and test results. PHI is any information a provider uses and/or discloses that can identify a patient seeking services, or an appointment or contact with a provider.

Even when PII does not reveal a patient’s healthcare history, it is still PHI when linked to a health condition or request for care for a health condition. A patient's name or email alone can be considered PHI if in any way associated with a healthcare provider.

Database technology combined with business information software can calculate and express the association between an individual, a provider and services for a health condition as a probability. Predictive analytic functionality is built into business information software. Patients, their providers and their conditions can be identified within a statistical level of certainty. That creates vulnerability at best and a breach of privacy at worst. Either way, therapists could be held legally and ethically responsible for patients’ loss of privacy..

A referral-site business should offer a BAA to the professionals whose practices are listed. The therapist locator and internal communication system I created has HIPAA policies and procedures in place to help assure data security, privacy and integrity. Security refers to access. Privacy refers to viewing PHI. Integrity refers to non-corruption of data. Those policies and procedures have been reviewed by a Board of professionals representing members of the site.

Why are a Review Board and BAAs important?

HIPAA is complex, not static. HIPAA regulates processes which provide assurance that people have certain rights and protections; these are not required to be “bullet proof” but must include reasonable actions to assure privacy, security and data integrity for covered entities. An advisory board of therapist-users is a valuable collaboration which protects patients and therapists.

Offering HIPAA assurance is expensive and time consuming. A potential breach is called an “incident” and must be investigated, documented and mitigated; must be reported to HHS if the incident represents a significant violation, problem and/or potential harm.

Licensed mental health professionals providing counseling and psychotherapy services are defined by HIPAA regulation as “covered entities.”

Many therapists do not understand that they are covered entities who must adhere to HIPAA and must protect patients. Therapist locator and internal communication service companies provide services that the covered entities (therapists) pay them to provide. Therapist locators do not work for the public; they work for the mental health care providers who enroll on those sites. A massive violation of HIPAA such as publication or illegal sale of PII and PHI could have significant legal and financial impact on covered entities.

Without BAAs, covered entities (therapists), patients, and the public lack affordable or feasible means to determine what a therapist locator service is doing with information gained by their service.

As part of due diligence when creating the operating policies for my company, I considered the public/patients first, therapists second and my company third.

Investigation determined that ordinary professional liability insurance such as the policy I buy for my therapy practice does not cover data privacy, security, integrity, or investigation of incidents pertaining to EHRs or any other electronic information gathering, storage, processing, and/or display service.

Cyber insurance is a separate form of insurance than therapists’ professional or general liability coverage. One million dollars of cyber insurance coverage for the therapist locator I created costs my company about $2200 per year.

Are therapist locators and their internal communication systems secure, private and reliable?

Can you imagine what an “antisocial” engineer working for a large therapist locator service could do with database and network access permissions? What if Russian, Chinese, or Iranian hackers gained access to Psychology Today’s communications and User interface (UI)? The vulnerabilities in these systems are frightening to me and to people I know who have administered these systems.

Covered entities, individual or corporate, which provide healthcare services are responsible for preventing and reporting HIPAA incidents. They are responsible when their healthcare operations support services have potential access to PII and PHI. It is implicit that covered entities should not contract with a healthcare operation support service that does not provide HIPAA assurance. The Department of Health and Human Services determines whether and when a HIPAA incident is a violation.

Without a BAA, a healthcare operations support service could dispute challenges to their security, or whether they are legally required to inform therapists, or to pay the cost of reporting a breach, or help therapists mitigate potential harm to patients. The covered entities would have to file suit against the healthcare operations support company that has no BAA and make a case, at considerable expense, if PHI or PII were misused.

If therapists had BAAs with companies offering therapist locator services, the companies would be required to report any incident to HHS and all covered entities. The U.S Department of Justice (DOJ) would be required to investigate.

BAAs for United States health data-handling services are required by federal regulation to make sure providers are informed of significant data-handling incidents. With a breach, and no BAA, providers might become named defendants held responsible for the breach. Even with a BAA, breach expense to a provider to mitigate any harm done to patients and the public trust can be significant.

Healthcare operations support businesses are not covered entities under HIPAA; they provide services to covered entities. United States healthcare operations support businesses are expected to offer BAAs and healthcare providers are expected to obtain them. Failing to obtain a BAA does not relieve covered entities of their responsibilities under State and Federal law.

I use Psychology Today myself for healthcare operation support services described generally in a contract provided by Psychology Today. I would like to believe that Psychology Today (technically) “works for me”, that its system is highly secure, and that it has no employees who are (insert any awful scenario to illustrate the point) grifters, con-artists, functional psychopaths or unwitting Russian/Chinese/Iranian assets. But can I demonstrate any proof of my hope? What outrage might make those marketing their practices on Psychology Today vulnerable to a class action lawsuit by inflamed members of the public who find their lives invaded by sneaks who know too much about their problems?

BAA’s (at least the several I have read) do not cover providers’ costs of breach notification; they exist primarily to assure customers of safe operations and commit to identify, investigate, document and fix problems. If there is a incident, therapists are ultimately responsible to notify the US Department of Health and Human Services. That is why covered entities (therapists) need BAAs for individual contractors and for companies they contract with for services. Without a BAA, a covered entity is on your own to investigate, report and mitigate harm and potential harm to their patients. An argument that you “did not know” would likely be met with “aren’t you supposed to know and isn’t it your job and legal responsibility to inform your patients and protect their privacy?”

Healthcare operations support organizations are typically profit driven and self-protective. Even if an organization displays a website policy promising to not use PII and PHI, how would you know if there was a breach? Would you expect (without BAA assurance) that a healthcare operation support business might tell you that one of their employees sold or gave away information including PII and PHI, or that such information was hacked?

In my opinion, covered entities might be held responsible when they accept services from a healthcare operation support business and there is no BAA.

Insurance for cyber security for one therapist cost $1200 to $1800 a year when recently checked. Remember, professional liability and general liability policies do not usually cover cyber security or breach costs or HIPAA incidents or violation investigations concerning an EHR.

When there have been security breaches, some larger healthcare provider systems have sued healthcare operations support businesses for damages. Without a BAA it would be difficult to for a therapist or patient to prove a healthcare operations business was negligent or criminal. It would likely require a class action lawsuit.

Healthcare operation support businesses have insurance to defend against lawsuits. I am told by my attorney that covered entities must be insured or pay out of pocket to bring a civil action against a healthcare operations support business. If you sue a technology company, you could find yourself named in a counter suit for which you may need appropriate business insurance to cover the expense.

Without a BAA, on healthcare operation support services can post disclaimers and terms of use and language that in effect indemnify, hold harmless, waiver a rights to trial, limit liability, establish jurisdiction, For example…

EACH PARTY WAIVES TO THE FULLEST EXTENT PERMITTED BY LAW ANY RIGHT TO TRIAL BY JURY IN ANY ACTION, SUIT OR PROCEEDING BROUGHT TO ENFORCE, DEFEND OR INTERPRET ANY RIGHTS OR REMEDIES ARISING UNDER, RELATING TO OR IN CONNECTION WITH THESE TERMS OF USE.

Common disclaimers have specific broad language that the website owner are not responsible for “…other harmful components.”

WE MAKE NO WARRANTY THAT THE SITE'S SERVICE WILL BE UNINTERRUPTED, THE SITE'S FUNCTIONS SHALL BE ERROR-FREE OR, THAT THE SITE OR THE SERVERS THAT MAKE IT AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.

Other harmful components” include databases exploited internally and the effects of databases exploited externally by malicious software, cyber espionage, and the unprecedented impact of Russian hackers who have penetrated the Federal Government and over 20,000 business networks in the U.S. including Microsoft, Amazon Web Services and Citrix,

Psychology Today operates a huge public data-handling business, does business with mental health professionals in communities in every State in America and internationally. Psychology Today offers therapist locator services, has functionality that allows therapists to communicate back channel with other therapist-subscribers, sharing PII and PHI; transmitting PII and PHI for healthcare purposes. This simultaneously complicates providers’ responsibility and illustrates that these functions are healthcare support operations because PII and PHI are inherently available. Other therapist locators offer back-channel communication among subscribers.

Many therapist locator services, including Psychology Today, do not offer BAAs. I have told you why I offer a BAA. I can only speculate about why Psychology Today and other therapist locators don’t or won’t. This is all very complicated for a solo-practice therapist to investigate. For example, last I checked, Psychology Today was a corporation chartered in the Cayman Islands. Likely, Federal and State Law, and U.S. regulations do not apply to Cayman corporations. But U.S. Regulations apply to covered entities.

Recently, Psychology Today has expanded its communications offerings to include a teletherapy videoconferencing app. The app is called Psychology Today Sessions. I encourage you to read a critique by PersonCenteredTech about that service and its "BAA."

Maybe therapist locators are so big or so small that no regulatory agency has the mandate or resources to initiate legal action to find out just what data they collect and what they are doing with that data. Or, have these businesses developed in a world that is poorly informed or too busy to notice there’s a problem?

Conclusion

At this time, based on (1) experience, (2) the information available, and (3) abundance of caution, I can find no ethical or regulatory reason why HIPAA responsible entities (mental health professionals, clinics, etc.) should not strive to protect the public by requiring BAAs from businesses that touch patient or potential patient data, especially those that (1) provide therapist locators, (2) display professional profiles, (3) publish articles on mental health, (4) support electronic communication between patients and healthcare professionals and (5) provide internal electronic communication permitting professionals to make referrals to one another. Each of these variables, in part or in total, can be used to identify people and their communications with therapists in the course of seeking services.

---

Michael G. Conner, PsyD is a psychologist in private practice and an owner of Private Practice Cloud, LLC a healthcare operation support business. His business currently supports The American Mental Health Alliance Oregon (AMHA-OR). Dr. Conner is a member of the Board of Directors of Mentor Research Institute (MRI). He acknowledges Michaele P. Dunlap, PsyD, Board Secretary of AMHA-OR, and President of MRI, as co-author of this article.

Michael Conner, PsyD https://www.oregontherapyoptions.com/#/providerinfo/Michael-Conner-PsyD

Michaele Dunlap, PsyD: https://www.oregontherapyoptions.com/#/providerinfo/Michaele-Dunlap-Psy-D

---

Disclaimer: The paper is intended to raise issues that relate to the legal and ethical relationships of mental health practices and healthcare operations support services.

The issues discussed in this article are potential conflicts of interests between a type of healthcare operations support business and covered entities who benefit from the services of such businesses. The opinions and concerns expressed do not represent nor should they be taken as legal advice. Any comments posted are not necessarily shared by the authors or the Board of Mentor Research Institute.

Statements, concerns and reasons for those concerns have been presented to encourage discussion among the mental health professionals and by their regulatory bodies. Psychology Today’s service is offered as an example of many therapist locators, one with which many professionals are familiar as subscribers.