We are back! Types of 'The HIPAA' Violations + The HIPAA Wall of Shame + Skunked Dogs + It's Marching Band Season

Rob: 0:00

I can't, I don't know how to turn that off, oh my God. Okay, it's the 70s.

Dawn: 0:08

We've gone back to the 70s.

Rob: 0:10

Hey, we're back and we got some clapping.

Dawn: 0:13

Thank you, audience. I got a new button. You're very kind.

Rob: 0:20

Hello and welcome to the new and approved Van Rijnke Blinds podcast with Rob and Dawn. I'm Rob and I'm Dawn and hey, we're back. Dawn, we are back and I have a fun button Are you ready? Okay, let's do it.

Dawn: 0:32

Woo hoo Yay.

Rob: 0:34

I brought the clapper. I love it. Yes, we've taken a few months off. We have To kind of reset and really dive into content and get things dialed in.

Dawn: 0:45

Yes, yeah, so we're back this week, we are we're here, Hopefully people want to listen to us again. They do.

Rob: 0:52

Actually, we still get downloads. We're going to be like Mr Beast. Okay, actually, no, sorry, we're in podcast world. So, joe Rogan, that's the top. You think Spotify will give us millions of dollars.

Dawn: 1:04

I don't know, because we just like to talk about the HIPAA.

Rob: 1:08

Oh, that's right, it is the HIPAA. So this week, kids, we're going to dive into the HIPAA. We're also going to dive into Let me bring it up Types of HIPAA violations. This is why I shut my phone on more Types of HIPAA violations. We're going to talk about the HIPAA wall of shame and we're excited because just last week, end of last week, boom the OCR released new audit guidelines.

Dawn: 1:31

Oh my gosh. Oh my gosh.

Rob: 1:34

This is exciting. So all the listeners there is new requirements for your annual HIPAA audit and for a customer of the old VRC. Then boom, you already get that. That's what we get. Yes.

Dawn: 1:44

We are currently updating as we speak. We are currently updating, yes.

Rob: 1:48

Is she doing it? We got people, so, but first let's. We got also in the new and improved Van Rijn podcast with Dawn, and Rob is talking about life a little bit.

Dawn: 2:00

So what's going?

Rob: 2:01

on Dawn. What's your topics? You bring up a couple of topics.

Dawn: 2:04

Topics Well, Ethan, our son, is 15 now. We're a softmore in high school and marching band season is full swing, so that is super exciting. We have a lot of late night Friday night lights and a lot of fun. Marchy, marchy and I've been actually chaperoning.

Rob: 2:28

You have been, I've been feeding.

Dawn: 2:30

I've been able to ride on the bus with the children.

Rob: 2:33

But what well, wait a minute. You had a squishy bus last week.

Dawn: 2:36

Well, we had the coach buses because we were, we went to. It was like a two hour drive to Austin, but this week we're just going down the road but we get to take the yellow school buses. So not too bad, it's fun.

Rob: 2:48

And I it guarantees going to smell just like it did when you and I rode the bus.

Dawn: 2:52

Yeah, that plastic Remember jumping out of the back of the buses. Well for the safety of that I know. Remember that I always hated, that, I was always scared and they put the mat down. Remember that, oh, we didn't get mats.

Rob: 3:01

Oh, you got hard no.

Dawn: 3:04

Oh well, I was in Colorado so they were very no you jump out, you're just to help each other.

Rob: 3:08

But yeah, it depended if you like the person or not.

Dawn: 3:14

And now you know it's funny about buses is the cool? The cool place is the back of the bus. It's always been. They want to be in the back of the bus. It wasn't always the cool place. Yeah, cause I always thought the bad kids sat in the back.

Rob: 3:31

Well, okay.

Dawn: 3:31

Well, anyway, anyway, so.

Rob: 3:34

So, yep, okay, Marching season is commenced and in in Texas world and football and and marching. It's normal to travel two, three hours to go to a game and perform and come back. It's Texas what we do. We just pack up the wagon and that's why we have buckies, because you have to stop the buckies.

Dawn: 3:51

And we sweat a lot. The first, then hot yeah, the first couple of Friday night lights were over 100 degrees and literally when the game was done it was just 95 and we're like, oh, so now we're cooling down a little bit. Actually, today is so far, it's 81.

Rob: 4:06

So yeah, it's good.

Dawn: 4:08

We're getting there, we like it.

Rob: 4:10

It's good, all right. So we have obviously marching. We're doing that, yeah. What other fun things done? What else is going on?

Dawn: 4:18

Oh, our dogs got skunked. Oh you know that? Well, they're still skunked. Yeah, they kind of smell.

Rob: 4:25

I said oh, because it's still ongoing. The one. Yes, in our new format you may hear the dogs, and that's fine. That's just what we're going to do.

Dawn: 4:31

Yeah, the dogs. So yeah, well, my other half thought it would be a bright idea to, because it was so hot to yeah, to crack the garage doors, and I think the the big old fat skunk just waddled in and came in the back and our white lab got sprayed directly in the face, like where it was. He was pure yellow and he's a white lab, so and it is hard to get out, and we tried all sorts of stuff and we're still we're still scrubbing his face.

Rob: 5:03

We're still dealing.

Dawn: 5:04

Yeah, and so, and he feels bad, he does, but so yeah, so we're dealing with that lingering smell.

Rob: 5:12

So that's been fun and that happened at like 10 o'clock.

Dawn: 5:14

That happened at bedtime.

Rob: 5:15

It only happens at bedtime, right, the craziness only happens.

Dawn: 5:18

Yeah, yeah, that's what always happens, so that's been fun and exciting.

Rob: 5:22

That's been fun. Yes, and let's see. Obviously it's cooling down. Finally.

Dawn: 5:27

That's a big piece.

Rob: 5:28

Yes, yeah, A lot of. Let's see it's cooling down. There's a new iPhone out, because that's one part of the new format of. Van Ryan has come out a couple times a week and talk about new stuff, so the new iPhone's out.

Dawn: 5:41

I don't know. It's not super exciting. It's titanium. It's pretty much the same thing you have to say you have to say, like Batman, you don't have a good Batman voice. I'm getting closer.

Rob: 5:51

Yeah, and obviously the other piece of what we talk about here is the HIPAA.

Dawn: 5:57

The HIPAA.

Rob: 5:59

And we are going to focus on the HIPAA, because we're focusing heavily on the HIPAA here in the States and through Europe and actually we're getting a lot of calls. We're getting a lot of calls about people that have HIPAA violations or feel they have violations and been violated.

Dawn: 6:19

Been violated?

Rob: 6:20

Yes, and what do we do? And I want everybody to know that the government is here. Yes, some people do and don't like that, but the OCR, they just have us here to actually take your complaints.

Dawn: 6:33

Not your compliance, but your complaints. Yep.

Rob: 6:36

And anybody can file a complaint with the government. So we're going to go through that next, we're going to go through that today. So the first type of well, we already know what the HIPAA is. I think we already know about that. Yeah, I think everyone knows what the HIPAA is, and we call it the HIPAA because people are calling it the HIPAA.

Dawn: 6:49

It just sounds more fun. It's just more fun. It's just called the.

Rob: 6:51

HIPAA we're just rebranded. It's just rebranded, we just rebranded the HIPAA, but we're excited that the HIPAA has been updated a little bit, yeah, yeah. So one of the first things that I've noticed is unauthorized access.

Dawn: 7:04

Ooh.

Rob: 7:04

That is a big one, Don.

Dawn: 7:05

That is a big one.

Rob: 7:08

What is that? Why don't you walk us through that real quick?

Dawn: 7:10

So this basically is when someone comes on to a business whether they're a business associate or they work at a covered entity, which is like a doctor's office they get access to systems like an EHR email, that type of thing. So your IT person or persons or company whatever has to give that person access Access rights. Do you give everyone the admin access?

Rob: 7:40

No Sure.

Dawn: 7:43

You give them user access with permission, specific permissions. Are they allowed to view EPHI? What systems are they allowed to use? That type of thing? So this is all. You come on to a company and you should have these set. For we have some really good IT partners we work with. They know if you are an operator or call center, you get these exposition permissions. They have them all set. They're all set up OK. Just boom, here's your computer Go. So what this is is this is someone that just either figures out how to get into it or possibly the person didn't know what kind of access to give them and just gave them everything.

Dawn: 8:32

And so they have admin access, so they're changing passwords and all sorts of stuff, and then they're finding oh look at my boss, look at this record about him or her or whatever, and look at this health information. Oh, I could post that on Facebook, or it goes down this dark hole. It does.

Rob: 8:49

And never post anything out there on the old Facebook or the Twitter or the Twitter X or the X Twitter or whatever it is, or the TikTok or anything. Yeah, we don't want to do that.

Dawn: 8:59

We've gotten calls on that, so interestingly enough, as we know, cyber attacks are just been so high the last couple years and they just increase. Well, the big one last week was MGM. Yeah, mgm.

Rob: 9:12

So let's talk about that for a second. So if a casino of MGM which I think their income is about 15 million a day through the entire organization. If they have that much money and got socially engineered, then you can be attacked from if you make a buck a day or 15 million a day.

Dawn: 9:33

It doesn't matter. It doesn't matter how much money you have that MGM thing was actually fascinating.

Rob: 9:39

That was all social engineer. So if everybody hasn't heard about, it is MGMs in Vegas. Their entire operations were shut down for about a day and a half. Not sure if they were paid the fine yet. They haven't said. But basically the hackers, the hacking group, called the help desk and they worked their way into the systems Basically saying oh, I'm a new employee, oh, my password isn't working. Could you reset my password? And they used LinkedIn and they knew exactly who were the directors or who had more access and socially engineered that.

Rob: 10:12

And then as soon as they got access in about 10 minutes. They released the ransomware, so yeah, so it doesn't matter if it's you make a buck a day, or 15 million like MGM, that's a good point is you don't need.

Dawn: 10:24

That's a really good point. A segue is do you need a lot of money to be HIPAA compliant? No, you need to be smart, you need to be invested, you need to be, you need to be in it. You want to do it. There's things you need to do to protect your patient, your customer data. Period end of story. It doesn't have to be millions of dollars. Sure, if you're MGM, I'm sure their HIPAA compliance bill is quite high. Actually, they probably. I don't know. If they do HIPAA, they're socked to.

Rob: 10:51

If they're self-insured.

Dawn: 10:52

Yeah, no, that's true, but I'm sure their compliance bill is a lot higher than if you have, like, a two doctor or a small business of 20 people. So it, big or small, compliance is key. There is so many hacking incidents, but the calls we've been getting, interestingly enough, are a lot of. My boss said this to other people at my office can they do that? Or I had a friend that posted stuff about my diagnosis on Facebook. We've got a lot of personal people that are calling that feel like they've been personally violated. So we have what we did is we've been taking these calls.

Dawn: 11:37

We get about probably about five calls a day on this, and what we've done is we've done an email series for the next month and a half on HIPAA violations how to make a file complaint excuse me and what to do and what to look for and that type of thing, because it's just, it's rampant right now. It really is, and people are feeling very, very uneasy.

Rob: 12:04

Yeah, yeah, and you got to remember your rights. We have rights under the law, and that's what's important. Breaches, breaches, breaches. We actually did just talk about the breach. That's the big. Well, that's the breach of last week.

Dawn: 12:17

There's one every day.

Rob: 12:19

But breaches, and I like to call them incidents. I don't like the word event as much but I like incident like this is what happened, so always start as an incident. That's what we always recommend here, and Van Ryan has started as an incident and you have to determine what happened because you have 60 days to actually report it.

Rob: 12:37

Yes he does go to the government and it does go to your customers. So you've got to dive in and understand what the breach happens. A lot of issues we see on the HIPAA wall of shame, which I'll talk about in a minute is there's still theft physical theft of computers, macbooks, notebooks, employees stealing.

Dawn: 12:57

Tracks Computers. Yeah, people stealing computers, stuff like that.

Rob: 13:01

But network, network, network email hacking, network attacks, server attacks, so you need to make sure you have a good IT partner a good MSP that understands how to handle regulated data, because it is regulated data just like financials. So because healthcare is the second most heavily regulated industry in the US, financials is first. So the HIPAA wall of shame is fun, that is fun. So, rob, where could our viewers, our listeners.

Dawn: 13:31

sorry, Are we doing video?

Rob: 13:33

today? No, where could our listeners find the HIPAA?

Dawn: 13:36

wall of shame. Okay, so whatever you're listening from the car, whatever you're walking.

Rob: 13:40

All you need to do is go to Google, because now it's the Google, the Google, the Google.

Dawn: 13:46

And just type in HIPAA.

Rob: 13:50

HIPAA wall of shame.

Dawn: 13:51

HIPAA wall of shame, and Google do it now.

Rob: 13:55

It pops up the OCR's breach portal. In that breach portal it will show any breaches affecting more than 500 individuals. They get posted and updated daily what was the top one that we saw yesterday.

Dawn: 14:08

One 10C, one million or one billion.

Rob: 14:11

Was it B or M? I think it was million, one million. Oh, 10c had the top one. It was a hospital chain. Yep, and it's public knowledge that's written in the law and you look at the website, it hasn't been updated. It hasn't been the aesthetics haven't updated in like 10 years. But the data's updated daily and what I look at that is I look at that site to see the trends and it's always email phishing attacks. It's always networks and it's also server attacks.

Rob: 14:39

But I also like to see how many people are impacted I mean those are people that are impacted, and people are impacted. I mean, those are people's lives. So the thing about that their credit could have been stolen Ours has probably been stolen.

Dawn: 14:50

Everybody's has been stolen.

Rob: 14:52

Their information is out there for sale. Providers can't provide the healthcare that they want.

Dawn: 15:00

And just for our listeners, it's not just the healthcare companies that are getting hacked. On. There was a few interesting things. Pensions are getting hacked.

Rob: 15:09

Oh yeah, and then remember that one the FedEx pilots. Fedex pilot union.

Dawn: 15:13

FedEx pilot union pension, whatever I mean they're going in. There was another plumbing like the plumbing groups.

Rob: 15:25

What do you call this? Uaw? Yeah, uaw, not UAW, but Duh, union, the union. Sorry, yes, that's a whole nother story.

Dawn: 15:32

Well, they've been attacked too, right, well, yeah, but it's interesting because it's not just healthcare, it's not just your provider getting hacked. We actually work with more business associates, as our listeners probably know they are, you know, not creating the record. They are just you know they have the record but they're not creating it like a doctor.

Rob: 15:53

Yeah, provider creates it.

Dawn: 15:54

Right. So it can happen anywhere to anyone and you know it's not just the HIPAA getting violated, it's personal information. You know it's more than just the HIPAA, but because their health record obviously that is and that is regulated by the federal law. That's what we're focusing on, but yeah, ooh, yep, lots going on.

Rob: 16:23

Lots of breaches and breaches.

Dawn: 16:25

Breaches and breaches incidents.

Rob: 16:27

Incidents. Let me start.

Dawn: 16:28

Yeah.

Rob: 16:29

And when that happens, you have to document the incident of breach and then you have to perform an audit and understand what happened and then create a remediation plan and resolve those issues. Yep.

Dawn: 16:39

So this next one Rob this improper disclosure. This happens a lot. Yep, you get the wrong record health record Wrong records. Yep like.

Rob: 16:50

Your provider sends the wrong record to you, sends the wrong record Since I've gotten wrong bills of people. I'm like, who is this?

Dawn: 16:57

That is a big, big mistake. We've had some customers of ours accidentally do that and it just. It shouldn't happen. But anyway, there's ways to remediate that. But this is a big one too is just sending the wrong information to the wrong place.

Rob: 17:16

Yeah, yeah. And if that does happen to you and you get Tommy's record instead of your record, you need to call your physician and go. Hey, you sent me the wrong information. Where's my information? Yep? And then they have to document that Yep. And then they have to provide you. They may ask you to terminate that, yeah.

Dawn: 17:35

And delete or shred. Delete it or shred which?

Rob: 17:37

you should do, and then obviously you'll get your record, Because by and long they have to do that.

Dawn: 17:42

And it happens a lot daily. Oh, this one, this one, you could talk about the next one. Rob, I remember the one office you walked into one time with the millions of files.

Rob: 17:55

Oh yeah, yeah, that was unlocks, stacks and stacks and stacks, unlocked that people could get into. Yeah, yeah, if you have any charts, if you have any charts, if you have any documentation if you have anything on your desk, anything, anything like that.

Dawn: 18:07

Yeah.

Rob: 18:08

That can be stolen. I mean think about it you travel, you have your book bag or your backpack or your whatever, your suitcase.

Dawn: 18:17

So, yeah, you fail to secure that hard copy, that PHI. But, the bigger thing, because now most of everything's electronic is the failure to encrypt your. Phi, which, if someone steals a laptop and that laptop's not encrypted, they can sell all that information on the dark web, can't they?

Rob: 18:38

Oh yeah, and it's about $600 to $700 per full. They call it a full Z. So, our information is for sale. Everything's for sale, because then the pensions are going to get hit and the unions are going to get hit because A they're not that secure.

Dawn: 18:51

They don't have that mindset, old school.

Rob: 18:54

B, they have the money and they have the information that hackers need for the access, and they'll drain the accounts, yeah. Yeah, so it's up to you to also ask where your money is, and your pensions, if you have them, or your 401Ks or anything like that, or your banking institutions? What's your security protocols?

Dawn: 19:12

So, yeah, you were just at the doctor the other day, weren't you? I was.

Rob: 19:16

Dr Chad. Dr Chad.

Dawn: 19:18

And you pulled out their privacy policy.

Rob: 19:22

Is by law. That's what everybody to do. Listening is the next time you go to your physician, your provider ask them for a copy of the privacy policy and they are required by law to provide it to you. It should be in paper and handed to you. They may be electronically emailed to you, that's fine, but they have to send it to you. You have to receive it at the time of visit. So make sure to do that, do it, that's huge, do it, that's big Big.

Rob: 19:48

All right. Another one Dawn is training education, education, education.

Dawn: 19:55

I think we know a little bit about training.

Rob: 19:56

We do. We kind of built an LMS. We did, we did, we did. We have all kinds of training.

Dawn: 20:01

Not just HIPAA training.

Rob: 20:02

There's security training, cybersecurity training, man we have diversity training.

Dawn: 20:06

We have all that.

Rob: 20:07

State law training.

Dawn: 20:08

Yep, but you've got to train your team.

Rob: 20:10

They need to know what's going on.

Dawn: 20:12

They need to know what the HIPAA is.

Rob: 20:14

Send players on the football field or you send folks out on the racetrack. We didn't talk about Singapore. Maybe I'll talk about that next time. I diverted, didn't I? Education is key. You have to train your team on how to handle health information. It could be online. It could even be a simple PowerPoint sitting in a conference room. That's boring, but you have to educate people and tell them how to properly handle it.

Rob: 20:40

And by law you have to have that training certificate. So you've got to train, train, train. Those are key pieces, Right, Yep. The next one is what's? The next one, oh, ignoring patient record.

Dawn: 20:55

Request how about records?

Rob: 20:57

Request for the records. Yeah, record requests I know, I know this is big. You can't just ignore your patients, right.

Dawn: 21:07

And now you have to have it. It's required to have it electronic. So portals, yep, the Cures Act you'll have. You have to have portals. Providers have to provide it electronically in a portal, some sort of portal.

Rob: 21:23

Yeah, they do. They have to have that. So when a you can ask your physician anytime for a copy of your health records, because they are your records, they do not belong to the physician, the provider, hospital, clinic, anywhere, ambulatory services they are yours. So you got to make sure.

Dawn: 21:42

If you make sure you ask for them, and they have to provide it to you anytime.

Rob: 21:46

Usually it's within 24 or 48 hours. I always recommend to our customers go 24 hours or immediately.

Dawn: 21:52

Just get it out, yeah.

Rob: 21:55

Securely secure email. You could put it in a Manila envelope.

Dawn: 21:59

You can certify mail. Certified mail, Only certified mail.

Rob: 22:02

Correct, good point.

Dawn: 22:03

It has to be certified mail or UPS, fedex trackable. Trackable, that's the key.

Rob: 22:07

Yep, yep, ups or certified mail. Those are key, so do not wait. And for business associates, if you're an IT company, you're an answering service, you're a technology company and you have health records, your customers may ask you for that access or needs assistance and by law you have to help them with that Yep. Definitely Insufficient risk analysis is another one.

Dawn: 22:31

This is one that you love. When someone how many people say they're HIPAA compliant. Oh yeah, my business HIPAA compliance. We do training, we're good.

Rob: 22:40

The best one is when they just put on the website Right, oh gosh, and they spell HIPAA wrong.

Dawn: 22:43

Right, I love it, come on. Or they put the HIPAA seal. Yeah, that's like from whatever image on Google the seal, the seal, that stupid chill thing, yeah, that people just grab and say oh yeah, I'm compliant, yeah right, you are. Yeah, yeah, they're trained, they know what the HIPAA is. That's great. But how do you handle an incident? How do you do? You have policies, procedures. You go on and on and people are like ugh, so that really right there leads to. They have never done an assessment.

Rob: 23:15

Never assessed their risk. They've never done that. Nope, nope. Those are key pieces and you have to have, you have to have the analysis and you have to understand the risk. You don't know what you don't know, so I take tests, right.

Dawn: 23:27

Yep.

Rob: 23:28

And that's how you learn, is you have to test to see, do you? Actually know what you know or you know what you don't know. That's what you do risk analysis.

Dawn: 23:37

Yep Risk audits.

Rob: 23:39

Not just for HIPAA, that's, you know, that's, there's SOC2, there's ISO, everything else we do like that. Those are the keys.

Dawn: 23:44

The keys, just success.

Rob: 23:45

I think I'm going to use my little button again.

Dawn: 23:48

Oh, yes, you like that. Give yourself a clap. That was good, that was awesome, yeah.

Rob: 23:52

What's this other button do?

Dawn: 23:54

Oh, the funk. Oh, that's like 70s.

Rob: 23:57

You got the funk yeah.

Dawn: 24:00

Okay, there you go. Well, that was so. Cheeseball right there. That was horrible, I don't know, it's a new toy.

Rob: 24:05

I got a button.

Dawn: 24:08

I got to put the button. The other big one is BAAs. What is a BAA? It's a business associate agreement. So, this is another thing. This is fun to watch people cringe when they have to sign this because they know that they don't have any sort of risk analysis that's been done.

Dawn: 24:28

And so they get nervous. What does this mean? Well, it means that if there's a breach, if you have a breach that you are, you're going to be responsible. And because you are handling that EPHI, some people think, oh, that's the doctor's information. Well, but you're the one that's the IT provider, you're the one that's the EHR, whatever it is. So that is very important, so very important. Beware if someone doesn't want to sign a BAA. There's probably a reason why.

Rob: 24:57

Yeah, and it's required by law, just like your bastard service agreement, just like your statement of work, you have to have a business associate agreement. It is important.

Dawn: 25:08

Very important. Those are the keys.

Rob: 25:10

The keys to success is a BAA.

Dawn: 25:12

Have a process.

Rob: 25:14

Is it process or process?

Dawn: 25:15

Process I don't know. Process process Root root I don't know, tomato, tomato, tomato.

Rob: 25:21

You say root Root. Oh my gosh.

Dawn: 25:25

Yeah, pecan, pecan.

Rob: 25:27

Oh, oh, that whole thing. You know what Listeners?

Dawn: 25:30

educate me Someone told us here in Texas it's pecan or pecan, either one of those, whichever one. One of them is if you're just if it's a whole pecan, and one of them is if it's in a pie.

Rob: 25:42

Is it a pecan or pecan? It's pecan Pie can?

Dawn: 25:46

I don't know it's pecan or pecan, depending on if it's whole or if it's in a pie. I can't remember which one it is. Well, I won't listen, but someone did tell us.

Rob: 25:54

Listeners, if you know, because I knew but I forgot. But then I don't know put it in the comments or just like email us. Everything's in there, just let us know it's the pecan or the pecan.

Dawn: 26:04

Yeah.

Rob: 26:05

Right. Those are the keys.

Dawn: 26:07

That was diversion. Oh my lord.

Rob: 26:09

One of the last ones that we wanted to talk about is the delayed breach notification In trouble, you can't ignore it, people. It's like if you ignore an decision, if you ignore a cut, if you like, arm fell off or you got cut by a lawn mower. Is that too much? No?

Dawn: 26:27

Graphic. No one would ever ignore that. That doesn't make sense. It does make sense If you just ignore it.

Rob: 26:33

It's going to get worse.

Dawn: 26:34

You will bleed out and die.

Rob: 26:36

So do not ignore your incidents or breaches that didn't work.

Dawn: 26:40

Now I can see I picture you with like an arm dangling. That's just random.

Rob: 26:47

I don't think it will muddle on much. It's all dead. It's been hot, so please do not ignore your incidents or breaches, like you would not ignore a cut for your arm dangling.

Dawn: 26:58

Oh my gosh, okay, let's. Why don't we circle back?

Dawn: 27:02

and talk about if you feel that your HIPAA has been violated or you feel like there's been a violation that's occurred, whether it's at work, whatever personally, there's a few things you can do. So one, if it's at a doctor's office, they should have a poster or the privacy policy with who that compliance officer is and you should have a number, a phone number and an email and you should be able to contact them if you can't ask for them there at the office. Now, if it's an office that has multiple offices everywhere, you may not get that person at that office that you're in. So compliance officer at the practice. Second, if it happens at your place of business, hr is gonna be probably the first place to go. There may not be a compliance department, but HR should be able to help you. They will be able to help you with that.

Dawn: 27:54

So, like I said, if it's you have both of them, tell both of them. So that's important to notify them of when you feel that you've had something happen that you think is a violation. And the final one and you can do this straight out of the gate, if you want, you can file a complaint with the OCR. We will put this in the show notes. You can email them. If you go on their website, you click the button file a complaint. Now, mind you, if you email, phone call or actually, you can mail them yes mail them to DC, mail them.

Dawn: 28:30

It's the DC office. You have to provide a description. You have to provide what happened information for them so they can look into it. They will look into it. They will get back with you. There's I don't know. We should probably look at that statistic how many complaints actually are filed. It'd be interesting to look at see how many are filed monthly, yearly, whatever?

Rob: 28:54

Yeah, you know what we'll look that up, but anyway.

Dawn: 28:57

so just know that you can definitely do one of those three things or all of them, you know, whatever your situation is. The other thing is you can always call us and ask us what do you think? I've had a couple of people call and they think it's a violation, but it's not. It's maybe more of a personal vendetta or maybe just something that it's borderline.

Rob: 29:21

So, yeah, it's a lot of personal vendettas. We've got a, unfortunately, like friends that were friends that said something on Facebook or some other social media.

Dawn: 29:30

And be mindful, Treat others like you wanna be treated right and speaking of social media, you can definitely make complaints through your social media too. I believe Facebook the meta.

Rob: 29:41

The meta, the meta or meta it really is done. I know.

Dawn: 29:44

You could actually file complaints if you feel that someone's attacked you inappropriately or something. You can do that too, and I bet you Twitter or X probably allows you to do that as well. Anyway, sorry. That's just diverting there, yeah.

Rob: 30:00

That's good stuff, Don. Is that the pod? I think that's the pod.

Dawn: 30:04

Yeah, I think that's the pod. That's the pod the pod.

Rob: 30:07

Yes.

Dawn: 30:08

Well, thank you all for joining us. Do we have any fun?

Rob: 30:10

pleasure music. Oh, let me see what else I got the funky we'll go out on the funky, oh my gosh All right. Cheeseball Doop doop, doop, doop doop.

Dawn: 30:19

Baww. See y'all next week.

Rob: 30:20

Baww All right.