Good evening, everyone, and welcome to our wonderful webinar this evening. We are thrilled to talk about cybersecurity.

And we were just speaking before all of you arrived about...

This is the dedicated team. You guys are here at 08:00 at night, 05:00 at night, and we are just honored that you chose to spend your time with us.

So we're gonna go over a couple housekeeping items in just a moment, but I wanted to start with a quick question.

Feel free to put your answers in the chat. How confident are you that your practice is truly protecting patient information in today's digital world?

Now it's an interesting idea to think about it, and it'd be good for you to let us know. Super confident, moderately confident, not confident enough. Because after this webinar, you're gonna feel a lot better about some tips and tricks to get you to the next level. With AI and cloud based technology and increasingly sophisticated cybersecurity threats, protecting patient information has never been more important.

Today, we'll explore common HIPAA risks, cybersecurity vulnerabilities, practical steps your team can take to protect your practice and your patients.

Before we begin, I would like to introduce Tyler McComas, the vice president of sales at Curve. I'm going to turn this over to him in just a moment, but I did wanna take a and say how thankful for you... We are with our partnership that we have with Curve and appreciate the opportunity to bring this really important educational material to our dental community. Tyler?

Yeah. Thank you, Sheela. As you mentioned, VP of sales at Curve and, more importantly, a husband and father of two. They're getting tucked in right now.

And we were talking about earlier, not just in our dental offices, but in our personal lives. I remember yesterday, I got a notification, Bank of America is sending new debit cards. And I took a screenshot, sent it to my wife. I said, did you do this?

Because I was I was nervous it was someone else, like something was happening. So it's a great topic and we're...

I'm happy to be here. So thanks for having me.

Excellent. And thank you for staying in your office this evening to be here. We appreciate you. We also have our incredible Kimberly Kuishin, who ours... Is our director of partner growth, is always here for any questions, and we'll also be emceeing this evening when the q and a comes. So please put all of your questions in the chat. We're gonna save some time to dive into some of those questions you came with in your mind today.

Now it is my ultimate pleasure to introduce friend now as we've worked together for quite a while and doctor... Wonderful doctor Mitchell Rubenstein. He chairs the technology committee for the New York State Dental Association and coauthored New York State's official HIPAA compliance course. He also serves as ADA standards committee on informatics.

I don't even know how to say that because he's helped a lot more brains than I have and pre... Previously served as education director for the New York County Dental Society from 2018 to 2023. What is really exciting is he remains in private practice. He is in the trenches like all of us have been, and he has an incredible practice that specializes in aesthetic and restorative dentistry in New York. As head of clinical aid... Education at Pearl here, we love having doctor Rubenstein on our webinars. We are delighted to have you, and we will turn it over to you. And we'll see you all in a few minutes.

Alright.

Well, thank you, everybody, and thank you, Sheela, for that wonderful introduction. I really appreciate that.

And as you were mentioning, thank you to everybody who's attending because as as Sheela said, we've we've all spent a a full day, you know, in the... You know, at work treating patients, fixing teeth, and you come home, you wanna relax a little bit, you know, and here you are trying to learn something. And I always I always think that's a that's a great thing. We're always trying to get better in this profession, which is what what makes us a great profession. So thank you for being here.

The topic is important.

And I know you may have sat through some boring, like, HIPAA and IT courses. This is not gonna be one of them. We're gonna talk about lots of things. Some of them may be a little different than what you're expecting, what you heard before.

I'm fine with questions. Put your questions in the chat. I do actually see the chat in the...

On on the side of my screen here. I may answer something during the chat or we may do it in the q and a, but don't be shy of putting your answers in there...

Your questions in there. Okay?

This is a combination and evolution of several courses I teach, trying to get the the the essentials and the basics down, but but let's get started. The first thing I would like to do though, only the second thing, is thank our sponsors, Pearl and Curve.

Curve, I've been working with for a number of years now, not as a speaker, but they're... They they run my office. I mean, Curve is my practice management system. It's central to everything in my practice, and it it has been for a while now. Pearl, of course, is is a core AI company in dentistry. The best known for their, AI interpretation of x rays, but they they do a lot of other things connecting, AI functionality with insurance documentation, scheduling, you know, data analysis, business metrics, a lot of things like that. And it's worth looking at because, frankly, as dentists with... We we need the help because this is not our core expertise.

And as for who am I and why should you even be listening to me in the first place, Sheela mentioned a few of the things that I do.

The of the technology committee for New York State Dental Association, and I... I'm on a standards committee for the ADA and a few other things. But primarily, what do I do? I'm I'm a restorative dentist in private practice of four days a week.

When I'm not teaching, I am treating patients. And so the things that I talk about in a course like this are not esoteric. They're not they're not sort of, you know, academic things to me. This is stuff that has to work you know, in a real practice before I'm gonna say, okay. This is what I'm gonna do.

And I think a dentist, another dentist should be at least a part of your technology education because it's really important to think of these things in terms of how we have to use them to help our patients. That's really the... That... That's what we're supposed to be doing. Okay? So follow that with my disclaimer. A lot of fine print, so I'll just cut to the chase.

I am gonna tell you what I do. I'm not gonna tell you what you should do, but I'm gonna tell you what I do and why I do it. I'm also, as I said, a dentist. I'm not a lawyer.

And we have lawyers. We have, you know, IT specialists, and those are the people before you make any real substantive change in how you do things that you should consult with them because these are the people who help you with this stuff. And as I like to ask, and some of you probably have heard me ask this question before, what business are we in in dentistry?

Sometimes it seems like it's just the the tooth business, but it's not. Okay? We are really in the information business, especially now.

Treating a patient, whatever, but you're reading an x-ray. You're trying to educate your patient on something. You're communicating with a specialist. You're measuring the distal buccal canal of tooth number thirty, writing a clinical note.

All of it is information getting from one place to the next. It's the critical part of our practice. And I feel this way because I'm interested in information technology, but it really... When you think about it, it's it's core to our business.

The amount of information that we generate now in our practice is huge.

The the information... I call it the crown jewels of our practice. It's... The most valuable thing in our practice is the information that you have patients. It's more precious than your milling machine or your cone beam seat team. Those things can be replaced. They're insured. But take a... Make a wrong move and you lose access to the information, you have a a much bigger problem on your hand. We have patient demographics.

We have their clinical records, treatment plans, their credit cards, insurance information. All the stuff comes in and out of our computers. Okay? Their medical histories, their prescriptions.

Okay? And then there's all the data. There's our radiographs and our CBCT images, our photographs, scans.

When you look by bit at what kind... At how much information this is, it's a lot.

Okay? And when I started in dentistry, it was... Because it was a century ago, not really. It was the twentieth century. And we didn't have that much information. This is what we had. Right? We had a paper chart with, some X rays printed on film and a handwritten chart and maybe a medical history.

I like to say this is back when our offices looked like this.

Mid twentieth century, say the nineteen fifties. It was the most secure dental office there was. There were no computers. There were no screens.

If there was a mouse anywhere in this office, he called an exterminator. Because if the door was locked, no one could get your information. And frankly, nobody really wanted it. It wasn't useful to anybody. Okay?

Twenty first century like it is.

I'm a big Star Trek fan, so I always picture Star Trek when I'm thinking about futuristic things. But, honestly, what's... What are our practices gonna look like mid twenty first century? That's, like, say, 25 from now.

Whenever you see a picture of dentistry's future, there are screens. Okay? This this is our our picture. In our heads, it involves a lot of information going back and forth.

K? How will this information flow in and out of them? How will we manage it and control it? Does it seem super futuristic to you?

The habits that you start making for me now will be will be the ones that sort of... That guide how we move forward.

All the stuff we have now. We have milling machines and scanners in our office. We have lasers. We have cone beam CTs.

We even have microscopes now that channel info directly to our computers. And this is just a small sampling of of what we have. All of this is vital information that needs to be protected. Okay?

We're able to store and transmit our patient's information. It it appears anywhere. I mean, we might have it here on our desktop.

It'll be, you know, on an iPad somewhere.

I... I'm not sure what the maximum number of screens you can cram into one treatment room is. In this case, it was three. Actually, four if you counted her phone.

Even here, your phones. If any of you were, you know, like like me, you may have your phone in one hand right now while you got this webinar on. No. You would you would never do anything like that. But these are all places where information about our patients can end up legitimately. And then there's the cloud. This cloud thing that we're all, you know, aware of in a sense, but also wary of for some reason.

Does this affect the practice of dentistry? Let me count the ways. I mean, I will jump ahead and say that the cloud is where dentistry should be for the most part now. Not because it's perfect, but because it's better than what most of us have been doing for most of our careers. We'll get a a little bit more on that later.

We are rapidly and thankfully moving away from this idea that our software, that our... Everything that we have information wise needs to live on a server under our desk or in our closet.

That is a, in some ways, a comforting thought, but it's it's dangerous.

Again, in my opinion, I'll explain to you why.

So let's talk about some of the threats facing us now. And this... I was saying before the... I was discussing this with some with some of our hosts before, the webinar. I give this webinar fairly frequently, you know, at least every... Once every few months, and it's never been the same twice.

Okay? Because things change.

It's almost 2027. We're getting ready for 2027, and the threats are changing again. Okay?

First thing is that scams and, you know, illicit attempts to get your information are much harder to recognize. And I know we're tired of hearing, you know, change your password frequently, blah blah blah, don't click on links in emails, blah blah blah. We get we hear that stuff so often, but things are different now. You used to be able to tell a scam because the grammar was bad or there was a... Something misformatted. But AI now, good as it is for some things in dentistry, helps criminals write very polished, personalized messages. Many more scam emails and texts come to you, even in your practice, addressed to you personally or with your practice name on it.

It's automated now. And it... It's much more important to be wary of these things now because you will you will overlook them because they seem so real. You can even imitate voices now. And I've seen this in practice.

Second thing on that list, your vendors' security. Your vendors' contractors. That would be like your practice management company. Like the people who manage billing services for you, or messaging services, the patient reminders, storing your data, things like that.

Verizon's... Verizon is a very good recap of cyber attacks in the business world, even segregated by by market segment, health care in particular. In 2024, about 15% of, you know, breaches that rose to the level of requiring notification of of a HIPAA violation, about 15% of them involved out of premise, vendors or contractors.

The 2026 report, it was 48%.

In dentistry, this implication is... Really means much greater attention to PMS software, IT providers, clearing houses, other services holding your information. When you have a billing service or an insurance verification service, you need to be sure that these are legitimate companies who have really tried and tested their methodology because they have access to all of your patients' information. Okay?

Last thing is another, another point in favor of the cloud, not obvious at first, which is software flaws, flaws in operating systems, flaws in Windows, flaws in the the software that we use are being exploited much quicker they used to be. This is not so obvious, but it's a weaker... A weakness in the server under your desk because keeping Internet connected systems updated promptly has become more urgent. And when you have your software as a service from the cloud, that's updated constantly. Anytime there needs to be an update, it's done on the fly. You ain't even aware of it. When was the last time any of you updated the operating system on your server?

Some may have done it recently. Others may not even know. Some of you may leave it to your IT team to help you with that. But you need to be aware that if you have a server, the risks now associated with not updating... Consist... Consistently updating all of your software, very high.

Okay? I keep using this term cybersecurity. You know, we're gonna be talking about HIPAA compliance. And and sometimes these things get confused, and could've... You know, they are related. They're not the same thing.

Okay? They they feed into each other. Cybersecurity, I think, really is the protection of of our practice, of the information in our practice.

HIPAA is really designed to protect our patients, to protect their information, to protect their access to their information. They go hand in hand, And improving your posture in one of them does help you with the other, and they feed back and forth. I kind of switch them around a little bit. I do think that the base of this is cybersecurity. I think data loss is a bigger threat to your practice than just the HIPAA violation you were risking, because without that data, you're out of business. Okay?

There are two sides of the same coin coin, though. HIPAA is truly an administrative and organizational requirement. It does help us comply better. So what what kinds of things have happened lately? You know?

All these are within the past year or so. Some, you know, much less than a year. DentiQuest, if any of you guys use DentiQuest, they're a a back end, they're a back end for a number of insurance companies as far as passing patients' information around. Massive breach.

And all the information that they have comes from us. So it's our patient's information. In the middle there, there's a Nevada dental practice called Absolute, which was compromised. Huge DSOs practice, you know, with a number of, I think they had...

It was over a million records that were compromised. This compromise came through their IT provider. Their IT provider was compromised. And since their IT provider had access to their computers, they were compromised. Okay?

It spreads the risk beyond just you. E assist. Okay? E assist is an outsourced billing insurance verification company.

They were con... They were breached because one of their employees clicked on a malicious e... Email link by accident. And everybody was compromised because they had everybody's information. Okay? I'm gonna give you one more that's actually I put in this morning.

We interrupt this program. This was an announcement yesterday. If anybody in the audience has a website that is, that uses PHP, it's a back end software you might not know, but you should ask your IT provider because, there's two major security flaws that were uncovered in PHP in the past forty eight hours. They've been patched, and the patches have been issued, but not everybody has applied them.

These software flaws allow attackers to get into the data inside your website, and a lot of us now have a lot of functionality in our websites. In my website, my patients can make appointments. You know, they can access my, my scheduler and see when they can make an appointment. Some of you do billing through your through your website.

With that in mind, you wanna take a... Take take your phone, take a picture of this this this, call your, web host, your hosting company, or whoever manages your website, ask them if your website uses PHP, and if so, have they applied the fix? Have they applied the patch? Because it has been one of the major cybersecurity consulting companies. I think it it was either Rapid7 or Cloudflare, I think, has seen this in the wild being used, to attack websites. So check it out.

Bottom line is there are people out there who would like to get to know you better.

We picture them like this, you know, with the the hoodie and the laptop.

Frequently now, it's not a person anymore. Now it's a machine. They don't need to sleep. They don't need to eat. They just scour the Internet for a misconfigured router, unprotected network printer, a poorly segregated Wi Fi hotspot that your patients might have access to, and then you're exposed. You're compromised. Why?

Why do people do this? Right? I mean, it it boggles the mind. Right? Why...

Can you really make a lot of money doing this kind of stuff? The answer is yes. Okay? Primarily identity theft.

Medical records are full of the kind of information you need to steal somebody's identity. Think about it in a name, date of birth, mobile phone number. Those things are just as sensitive as a Social Security number. With a name, date of birth, an address, mobile phone number, you you can do an awful lot, you know, as far as stealing somebody's identity.

Okay? Health records are more valuable in this way than credit card information is. Credit cards...

Companies that manage your credit cards are really on on the lookout for...

They'll they'll cancel that card. They'll cut off access pretty quickly.

You know? We don't have the same security posture.

Ransomware is still a big problem. Okay? It's, you know, it's being sort of surpassed by certain other threats out there, but it is still a huge problem, and I consider it low hanging fruit. It's a... You know, ransomware is a major way that individual practices and sometimes groups of practices get compromised.

The the the reason is that you don't have to sell anything and you don't have to do anything with the data. You just have to stop us from accessing it, and we will be scared enough to pay you in a lot of instances to get that information back, whether we get it or not.

This is all much more complicated now because not just our personal lives, but our professional lives are largely online. And and people who have this nervousness about the cloud, I kind of put up a slide like this, and I say, all this stuff exists only in the... How much of your information does Amazon, Facebook, and Instagram, and Google have? Between the four of them, they could put together, like, a CIA, NSA level dossier on any of you.

That's how much information is in the cloud. I use these things in my practice.

Okay? I use these things in my practice. Research I do through PubMed. I have a lot of files on Dropbox. It's not where I put patient sensitive stuff, but I use it for a lot of things. I use LinkedIn. I I I make videos on YouTube.

It's very important to keep it segregated. Okay. We think about these things and don't realize that we need to have a personal life over here and we need professional life over here, and there's very good reasons they should not be combined. Okay?

And I always ask in your office, you know, what are your team members doing on their lunch break? If any of you out there are team members, don't get upset with me. Think about it. I'll say it the other way.

What's the doctor doing on his lunch break? You know, anybody could be surfing their their their Facebook, you know, checking out, you know, what are the Kardashians doing on on on TMZ or what's going on on, you know, watching a movie on Netflix.

No.

Okay?

You you cannot do this any longer. Okay?

The machines you use in your office must be for business, must be for dentistry only. It's a big mistake to allow this kind of thing to happen. It's a huge it's a huge exposure because people in their personal lives don't have the same level of care that that we're supposed to be applying. And there's a a big risk that something will be allowed to access your network that you don't want.

Okay? I have to give it as we do. You wouldn't use your hygienist's cavitron to clean under your fingernails. Right?

Business and play... You you do that do that at home. Do that some other way. There are any hygienists out there that just cringed at even the thought of... But this... That's what I think of when I see stuff like this.

Okay? Major routes ransomware gets into your office.

Surfing websites and clicking on a banner ad or a a link that's probably infected.

Second is checking your own personal email, clicking malicious links that might be in phishing emails that seem much more real than they used to. People.

Us, we're the unpatchable security vulnerability. Right? All these things that we use now, if you have your patience able to access Wi Fi in your office, better have a separate firewalled router that is not connected in any way to your office network. Your IT company can do this. If your IT company is not sure how, a security company can do this for you.

It's very important that you don't use the same the same, you know, Wi Fi access point to access patient information professionally that anybody else is using to sort of, you know, surf the web. Okay?

And I I have the the the AI codes up there, the AI logos up there. Because when I talk about AI and I talk about using curve or Pearl or Mango Voice or some of the other dental specific companies that do this for us, that's different than using ChatGPT. You can't do that. Okay?

Not with patient information. Even if you don't have the patient's name on it, k, talking about a patient and getting, you know, a letter written or getting a clinical note written just in ChatGPT, guess what? That patient uses ChatGPT too. They might be in your waiting room talking to ChatGPT about this procedure they're about to have.

Okay? There's a lot of leakage of information. It's a very unsafe thing to do because you don't have a business associate agreement with Chad GPT or Claude. They're not responsible to you.

They...

You don't own that information anymore. Those are huge risks that go away when you deal with a reputable health health care based company that does this for you.

Alright. Yeah. Right. Twitter is not Twitter anymore. Now it's x. Sorry about that. Okay. By the way, if your email address is still, something like doctorbob1975@aol.com,

please stop. Okay? It is not that hard now to get a dedicated email address, your own, your own URL, and a dedicated domain owned by your business. You have much better security over that than something like this.

It also just...

If anybody ever calls you calls you out on something or if there's ever an investigation or something, that says, I don't take this stuff seriously. So think about it. Keep that one for your for your, you know, your invitations to go on a fishing trip with your friends, but not for dentistry. Okay?

Those are mine.

Mitchell studio fifty seven dental dot com is my professional email address.

My other one?

I...

Yeah. I I use...

For my, yes, for my my, avatar, I use ***** Wonka. There. It's out. I'm a huge ***** Wonka fan.

Backing up your information. Once again, something I don't worry as much about now that my practice is in the cloud. Okay? So, yeah, they have to back it up, and they have to keep it secure, and they do a much better job of it than I can.

If you do it yourself, are you doing it regularly?

If you do, you're probably doing it wrong. How do I know this? I'll tell you in a second. And if you do it right, you still might be doing it wrong.

We had the ultimate test of backups here in New York a number of years ago. We called it hurricane Sandy. There were a number that...

I was I was on the IT committee for New York State at the time. There were a number of dental practices on the South Shore Of Long Island and in in Brooklyn that were drowned ground level, and they needed to get their information back from backups. And some of them didn't work. Okay?

Some of their backups didn't function or they function only partially because they hadn't been tested. If, this is a quick one, but if you're backing up your information and most hands go up in an audience when I talk about this, you gotta test the backup. Okay? Just because you get a message that says fifteen fifteen million files backed up, x number of gigabytes, success.

That doesn't mean it was back... That means that the routine was run. But until your IT people take that backup and reinstall it onto a computer and prove that everything works, which should be done periodically, at least once a year.

Okay? And if they're not doing it, tell them you want it done. And if they're gonna charge you something for it, just pay it. Because if you have a backup and it doesn't work, the people in this office here, they had to reconstitute so much of their practice from little scraps of paper.

And that's not even necessarily possible now because so little of what we have is on paper now. So I I shut her to think at what would happen. Okay? So just...

You won't think about it till it happens to you, but I'm I'm gonna make you think about it tonight.

Here's another really bad one that happens when you work with an IT provider that might not be totally on top of their game.

Remote access. If you're if you're not in the cloud and you wanna access your computer from off-site, this is the way you do it. They set you up so you're gonna be on the beach, you know, chilling, sunning yourself, and you have PC anywhere. Go to my PC. Log me in. TeamViewer, there's a bunch of these packages that can be set up to access your office server.

One of the most notorious is Microsoft's remote desktop. These things can all work fine. They can also be misconfigured and leave your server massively vulnerable and open to almost anybody who knows how to do it to get in there if you have this type.

Too much tactical deep... Detail for me to go into. It's not really the purpose of this lecture. But if you're using anything like this, it merits a discussion with your IT people about how they're doing it and how sure they are that it's secure. Okay?

I'll briefly mention that if you have to use passwords, you know...

If you switch to passphrases and if you switch to, you know, second factors, that's that's better. But we've been worrying about our passwords since, like, 1983. That was when the movie War Games came out and Matthew Broderick, so young... God, he was so young. Broke into the school's computer to change his grades because they had a password written on a piece of paper by the by the side of the computer. And when a password is too complicated, guess what? People still do that.

You know what the most popular passwords are?

They're listed. There are lists of... Most popular password out there, I think, is 123456. Okay? Your bank won't let you use a password like that. If you're allowed to use whatever you want, you should use a passphrase. Okay. I'm from Livingston, New Jersey.

Our football team was the Lancers. So if if I was a a big football fan, I'd probably use something like Livingston Lancers are number one. It's long. It's easy to remember.

It's got different kinds of characters in it. If I lived in New York City on 1265 York Avenue, I might use something like that. They can have spaces. Okay?

Make them longer.

And these things, mixed characters, long phrases, don't use the same one for everything. That last one, change it frequently, Don't do that. Okay?

That's a problem because when you can't... When you when you don't think you're be able to remember them, you make them too easy, and then they're easy to guess. Do you think your password's been stolen? There's actually a... There's an app for that.

Okay? So if you're concerned that your email might have been compromised, this is totally safe. I never say anything is totally safe, but this is a, security, company called 1Password, that has this website enabled. You put your email address in there. It's called have I been pwned. You can find it very easily.

And if your email address has been found in any type of leaked, you know, assets, leaked, you know, hacks or anything like that, they'll tell you. And then if you can see what had happened, you can know if you should, change your password.

Apropos of the cloud.

Okay? Apropos of the cloud, two factor authentication is not optional anymore. If you are considering a cloud based service or something like a, you know, a insurance verification service or a credit card processor, anything that you have to log into that does not mandate two factor or that does not have two factor authentication, meaning that when you log in with your password, they still send you a message either to your phone or to another device that you have to, log on and you have to assure just like with your bank when you log on from a different computer. Second factor, it's much, much more secure.

If you have a company that's not...

If you're considering a company and and you ask them, do you have two factor with them? And they say no, don't even bother. Okay. Good.

That's an indicator that they're not even taking it seriously. K. This is something that was a little bit extra, you know, a number of years ago now. That's the bargain basement.

You have to have two factor authentication or you're not taking security security seriously. K? Those are the highlights on cybersecurity. Obviously, it's a much richer and deeper subject.

I do have a half day lecture on it, if anybody can can tolerate sitting through it. But, you know, just get in contact with me if you wanna do it at your dental society or something like that. Now we're gonna talk about the elephant in the room.

And I... We've said the word a couple of times, but those of you who are really sharp out there will realize that I'm talking about the elephant in the room, but that's not a picture of an elephant. So it's not an elephant because I never get laughs at this joke. That's my HIPAA. I like a friend... I'm friendly a friendly HIPAA to be my my my HIPAA emblem.

Nobody ever laughs at that joke, so don't feel bad. When I'm doing it on a webinar, it's okay because I can't tell if nobody's laughing at the joke.

Once when I was teaching a course at the ADA meeting, some guy...

I asked...

Actually asked if anybody knew what HIPAA stands for, and somebody asked me if it was a female hippopotamus. I I couldn't tell if he was serious or not. Hipaa has been around for a long time. It was actually passed into law in 1996 even though it wasn't implemented until a number of years after that.

The Health Insurance Portability and Accountability Act, it was really a bunch of different things that came about over time. You know, most recently then in 2013, there was the omnibus rule. There was a breach notification rule. There's actually another overhaul of the rules with some changes to privacy and security rule.

But as they evolve, I I still just call them HIPAA. Right? And it's a big subject. We're gonna talk about a few of the most...

We're gonna hit some of the highlights right now. Like, for example, as of most recent, you know, data compilation, which was last year, 2025, one of the most common avoidable...

Strictly avoidable violations that the doctor's offices get hit with.

Okay? We always think of HIPAA as a barrier to information. Like, patient wants something. I can't give you that because of HIPAA, or I can't do that... I can't send... Email that to you because of HIPAA. I can't...

HIPAA wasn't really meant to be a barrier. It was meant to give patients safe access to their information. That's why it's a...

You know, portability is one of the p's. Is the p in HIPAA, is health information portability and accessibility.

So it's not supposed to be inaccessible. Failure to provide timely access to a patient's protected health information, it's what PHI means. Okay? That is a a serious violation. Okay? It's not... The the things that you get hit mostly for are not failure to use, you know, 256 bit instead of 128 bit encryption on your server or failure to use an encrypted email account. These kinds of things.

Unauthorized disclosure of your patient's PHI on social media. We're Instagramming everything. And, frankly, with a patient's authorization, it's a great way to show off your practice, but you better get permission because they're entitled to deny that.

Last, online reviews. You get a bad review, the number of doctors that expose, patients' protected health information in online reviews It's astounding, and it's it's a serious violation, and they take it very seriously. Okay?

Failure to provide timely access. Okay? The p, remember, the p in HIPAA stands for portability. There was a guy...

And this was a violation. It was a doctor David mentee, and this was a a few years ago. A a a parent wanted their kid's information sent to a new doctor. He just didn't do it.

Parent asked again. He still didn't do it. Didn't do it. Didn't do it. They filed a complaint. Okay?

The office of civil rights, which administers HIPAA for the Department of Health and Human Services, they actually came... They didn't give him a big fine.

They've realized he was a little technical... Technologically backwards, and he wasn't sure how to do it, and he was a little confused. They helped him. They helped him set up a a method by which he could safely send the, the information. A year later, the parents still hadn't gotten the information. So the guy filed a second complaint. That time, there was a settlement against the doctor for $15,000. What I'm trying to say is the HIPAA police, as I like to call them, aren't out there to get you.

They want compliance with the rules, but this guy was begging to be fined. Right? I mean, he had every chance to do it, and he didn't do it. We need to act on a patient's request for access to their medical records within thirty days.

That's an asterisk on that because it's very likely that that will become fifteen days or two weeks, at the next revision. Really, nowadays, it shouldn't take more than a day to get somebody's information to them if they want it. Right? You know, why should it take more than that?

The... This... Another one...

Yeah. It's a DSO who was fine...

Got a fine for overcharging somebody for giving them their information. They charged them a $170 for providing their information. You can charge a fee for this, which I think is kinda silly because when somebody's leaving my practice, it's not the time I wanna pick them off by asking them for money for...

That's just for something that essentially doesn't cost me anything. But it is stated that the the fees must be reasonable and based on the cost. You can't just charge...

Say, oh, the doctor has to review it, and his time is worth $300 an hour. You can't do that. Okay? Just send patients their records.

Social media, unauthorized disclosure. Remember this guy? Hoverboard guy?

This guy who's thankfully no longer a dentist and no longer has a license to practice, who was, doing an extraction on somebody while riding a hoverboard and and super intelligent streaming it on on social media. It doesn't have to be this egregious. Okay? There are a number of instances of patients, you know, who were taken aback by seeing their photos in social media posts by their doctors. And without authorization, without a piece of paper that says, okay. I authorize this. You can get in a lot of trouble for that.

Now as for a patient photograph, you know, when is a patient's photograph PHI? When is it protected information? Is any photograph...

Is a close-up of a molar? Is a close-up of an x-ray of a root? You know? So they don't specify.

But to me, if the patient could identify it, that's pretty risky. So here's two very famous smiles.

And the one on the left in the... Let's see.

Anybody know who the one on the left is? Let's put a... Put it in the chat. Smile on the left of the screen.

Put another couple of seconds.

Very distinctive smile.

Yes. Okay. Linda. Got it. It's Post Malone. And the other guy, George Clooney. Okay? But when you look at the two smiles, obviously, somebody who knows who Post Malone is gonna be much more likely to peg that smile.

But is George Clooney's smile identifiable in that picture? I would say it is. Not to everybody.

George definite... Oh, I see Sheela also says that George needs a night guard. Yeah. If anybody in the audience is... Happens to be George Clooney's dentist, for god's sake, make the guy a night guard.

Very good, Sheela. I like that. Yeah. Somebody else posted Tom Cruise.

Here's my rule for this. If I got a close-up of an amalgam finger or I'm doing a video of procedure, I'm not too worried about it. If the patient could recognize themselves in the photograph, absolutely do not use it. I don't use any smiles anymore, even close-up smiles unless the patient has previously authorized it.

Oh, I see another good question, but I'm gonna I'm gonna keep that one for the for the end. That's a good question, but I don't wanna address it right now.

So, George... Yeah. Okay. Enough enough of you, George.

Unauthorized disclosure of PHI when responding to online reviews. This one kills me. You know why?

Has anybody out there...

Just put a thumbs up or something if you've gotten a bad review, you know, in the chat because it it happens. You know? People... You can't make everybody happy, and some people just go right to the Internet, and and it gets you. It gets you right here. It makes you mad.

Pisses you off. You wanna respond to it, especially when they're wrong, you wanna respond to it. Be careful. Okay? Because there's a common common perception that if somebody complains about something using specifics that they've given up their right to protect that information. If they're... They can talk about it, then you can talk about it, and that is absolutely not true.

Okay? They do not give up their right to control that information or give you the right to to, you know, expand on it in any way, shape, or form just because they did this. And it's not really even productive to do it.

Review like this is a real one. I don't understand why all the positive reviews. I would agree this is a very clean practice with a respectful staff. Yeah. Sounds terrible.

Friendly and outgoing. However, they seem like car salesmans... Car salesman trying to butter you up and sell you a product and overcharge your insurance. I went to five different dentists. Warning. I went to five different dentists in this company, told me by far the worst. So what would you like to answer? I'll do it for you so you don't have to.

Are you kidding me, Karen? When you showed up an hour late for your appointment, I attempted to examine you, but there was more debris on your your few remaining teeth than there was on the streets of New Orleans after hurricane Katrina. You could benefit from a shower also. You went to five different dentists? Try a psychiatrist instead because no dentist can fix what's wrong with you.

There. You feel better? I did it. You can't do that. Okay? The reason you can't do that, I've told you already, because you can't talk about what happened in your office even if the patient has already broached the subject.

It's also not productive. Your response to a negative review isn't for the person who wrote it.

Okay? It's for everybody else who's gonna read it and try and figure out which person is reasonable and which person is the lunatic. You want the review writer to seem a little unhinged, so you write a response like this.

Thank you for taking the time to offer your valuable feedback. We take your concerns very seriously, and we're genuinely sorry if your experience with us was not satisfactory. We are committed to providing all of our patients with the highest quality... Possible quality of care. We promise to offer you a better experience if you visit our practice in the future.

Okay?

Translation of that, if anybody is from the South, I learned this when I was visiting some friends during a a mission trip in Kentucky. That means bless your heart, which which which doesn't actually mean bless your heart if you're in the South. Okay?

This is another set of fines, several. This was NuVision, which is another DSO. It was a $23,000 fine for replying to negative reviews on Yelp. Why would I... Why would you bother? Nobody even uses Yelp anymore. The doctor disclosed protected health information. It was absolutely indefensible from a from a health... From a... Both from OCR standpoint.

K? We are getting near the end. I just wanna go through a couple of more brief points, and then we're gonna have time for some q and a.

We use this term all the time, the HIPAA police. Right? The HIPAA police is the office of civil rights department of health and human services. They're responsible for federal enforcement of HIPAA privacy, security, and, breach breach notification rules. And when we picture these people in our heads, this is what we're picturing.

The HIPAA police, we're we're picturing Agent Smith, you know, in the in the in the matrix. Okay?

But that's not who they are. They're they're bureaucrats. Okay? And they are trying to administer a set of rules and make sure that we comply with them.

They're not...

And I've spoken to these people. I mean, I've I've...

You know, there there were times in...

When we were working on stuff in New York State where we had access to different representatives of OCR. They're they're neither good nor bad. They're doing a job.

They wanna make sure that we're complying with this stuff. And if we want to, we can. We can at least make a better attempt to than many of us are doing right now.

I'm gonna take a little bit more time to be a little more specific about the stuff that we're protecting.

Okay? The stuff that we're protecting, I'm gonna be serious now. PHI, what does it stand for?

Usually, people will say private health information or, you know, personal health information, but what it really means is protected health information. Protected just means there's a law, but you have to protect it. And it's not only stuff on your computer.

Okay? Once you are a covered entity and you're responsible, as we all are, for complying with HIPAA, all the information about a patient, whether it's a conversation you're having a little too loud in a hallway, whether it's written on paper, whether it's in a computer, it's all protected health information. It's not just what is electronic. It's a common fallacy.

What is and isn't PHI? So here's an example I like to use to kind of personalize it. You see a piece of paper on the floor and you pick it up and it says this, comprehensive exam, prophy, medical history, HIV positive, hypertension, allergic to penicillin, recently discharged from a psychiatric inpatient facility for schizophrenia and bipolar disorder, current medications, blah blah blah. Is this protected health information?

The answer is no.

It's not.

Why?

Core principle of protected health information is that it can be used to identify somebody.

Okay?

It's not just is health inform... It's health information that could be identified to a particular individual. And this piece of paper doesn't have the person's name on it or anything that could be used to identify them.

If the piece of paper says John Smith and their address and nothing about his health, that's protected health information in your practice.

John Smith and his email address, John Smith and his date of birth, all protected health information. Okay?

You can get around this in certain ways. You know, in an emergency, in a pinch, you don't have access to your regular system. You gotta get an x-ray to somebody. This is an email I sent to a doctor down in Florida.

Dear doctor Siler, please find the X-ray of the patient we were discussing earlier. Best, Mitchell Rubenstein DMD. Now I de identified it. I didn't put the patient's name on the X-ray, which, of course, we know is not a great thing to do, but he needed the X-ray, I wanted to get it to I had given the pay... Name to him in a phone call.

Not totally safe either, but I was trying to comply as best I could. I had a patient who was in this guy's office. He was in pain, wanted the X-ray. This is my...

Probably my last little lesson to you today is that everything you do with this has to be something you're comfortable sitting around a table and explaining to somebody. No. I shouldn't be identifying X-ray. They should always have the patient's information.

I did discuss without the patient's explicit permission this case when the patient showed up in this guy's office, and he got on the phone and said, yeah. You can talk to the doctor, but I didn't have anything in writing. Okay? But this is a patient of mine.

He was in pain. They wanted the X-ray, and this is how I responded to it. I would have been comfortable defending that if anybody later complained about it. And this is a a factor that we will think about that others that are not doctors won't necessarily think about, but it's important.

Okay?

It's always safer to assume that something is in fact PHI even if you're not sure. That's the safe the safe thing. Okay? The identifiers. What makes it PHI? And this is where we will close for the evening.

If it has the name or address, anything more specific than the state, dates, not just their birth date, could be the date of their high school graduation, could be the date of... That they began their employment at a certain company, Any number, phone numbers, fax numbers, email addresses, Social Security numbers, medical records, health plan identifier, the the number that their their medical insurance uses to identify them and their account number, Your vehicle. You know, if you have a, you know, valet parking and they have, their their vehicle ID plate, their, web URLs, IP addresses of the computers they access, and things. Photo... Photographs, we talked about, not just their face. Biometrics, their fingerprint or... There are practices now where they take biometric data from patients to identify them. All that needs to be detected. And then in true government fashion, the last of the identifiers is basically everything else.

At the time this was written, there were no hashtag. There were no, you know, handles. You know? So, you know, now if somebody's Instagram handle is... These are some of my favorites. Shaquille Oatmeal or Regret This Already or The Beer Barrel Booster, all is... Qualifies as identifiers. Okay? So be careful about all this.

I am gonna close the lecture right here because the next section is a long one, and I'd really rather have some time for...

I saw some spectacular questions in the q and a. And and, hopefully, we're kinda collecting those, and I can answer them in a little bit. And what I would like to do now is ask our wonderful moderators to come back on and to bring us into the q and a for the evening. And I I I do wanna thank you all for being here.

I know it's...

Again, it's getting late, especially if we're on the East Coast. We've all had a long day, but this is a subject that I think is important. And it's a it's a subject I think is important, and I think I try to get people to pay attention to it in a way that may be a little bit more fun. And and, hopefully, I was able to accomplish that tonight.

So thank you very much.

Well, thank you, doctor Rubenstein. That was... I... My pencil, which I still use, believe it or not, in the AI world, is dull now. I took so many notes. We do have a lot of questions. I think we need to have you back for part two.

There's so much going on here. And especially as the new year starts, there's gonna be probably new additions. Like you said, every time you do this, it seems to have an update. So Yeah. My first question for you, and this is not in the chat. But if we're sitting here today and we were... You know, in the beginning, we talked about how confident are you with where your practice is, what would be the number one thing...

Takeaway from this webinar you should go do tomorrow morning?

Risk assessment. Update your risk assessment. This is the one... So the great question. I could... If if I... You know, I I swear I didn't tell Sheela to ask that question.

If anybody ever accuses you of anything or complains about anything HIPAA related, this is like... If if any of you have ever been pulled over by the police in your car, sirens, the lights, they pull you over, you roll down your window, they come up to the window, and they say what?

Any of you.

Registration, please.

Registration, license. License and registration. Right? We know exactly what they're gonna say because we know that.

That's what they're gonna...

And if I say to them, if my violation was nothing, I may have crossed a double line or whatever. If I say, oh, my my what? Oh, my my license. Oh, god.

Am I supposed to carry that on me? You know? All of a sudden, that police officer is on high alert. There's something wrong here.

This person isn't taking anything seriously.

Your risk assessment is basically a project you go through with your IT team or on your own. There are several ways of doing it, that categorizes what kind of information you have that's protected, where you have it, how you store it, what computers you have it on. And it's actually a very useful document.

Most of the time, it's useful if there's ever a disaster or a flood or a fire and everything in your office is destroyed.

That goes to your insurance company, and then they can use it to help you recover because it catalogs all the computers, all the... Everything that you had that... In your office.

If anybody comes to question you from OCR and they ask to see the risk assessment, you better either pull it up on your, your computer because it... There are automated company... Automated ways of doing it now online, or pull it off the shelf and hand it to them and say, here's my risk assessment because that's the... Any violation that you read, whatever was wrong, they they lost an unencrypted device. They, you know, sent an... A a mass email of the wrong...

The list of violations always somewhere seems to have in it failure to maintain a proper risk assessment. Okay? So that is the... If anybody wants to tune anything up, don't pull... Go to your office and... Where's your risk assessment? You pull it up... If you pull it off the shelf and you blow on it and dust comes flying off of it, big problem.

Okay? Yeah. Because it's supposed to be a work in... And it doesn't need to prove that you're perfect. There can be things wrong that you're working on.

I love that.... That you've taken it seriously. Without a risk assessment, like nothing else, they're not gonna take you... They're they're they're gonna assume this person is not even interested in complying.

Absolutely. Well, I love that answer. I definitely think we should all do risk assessments. I I wouldn't wanna do one in the office I'm working in, but I will let all of you do that.

No. I'm kidding. Great way. Right? Just like that's why we have insurance for everything. Kimberly, I know the chat is on fire, so take us away.

I'm going to share the QR code for CE in just a moment and also invite you on this call to, again, come back for our second webinar and to, sit with both the Pearl and the Curve team to be able to see if, you're ready to take that next step with cloud based or with with AI and radiology, voice notes, insurance verification, all those things that we offer so that you can have some time with your team, to sit through that and see where you're...

When you're ready to take the next step. I'll share those codes in just a moment, but I wanna, I wanna turn this over to Kimberly because we're up to, like, 22 questions.

I know. We have a we have a lot. I was getting a little scared here, but we... We'll go fast, and I and I was looking through them. But speaking about both Curve and Pearl, a question came in fast and furious right at the beginning. The PHP issue that you brought up at the very beginning of your webinar, doctor Rubenstein, how does that affect curve and Pearl and other vendors that you work with? And before I say this, you did get laughs, quite a few of them, at your HIPAA HIPAA joke. So...

Excellent. I like that.

First, I do...

Although the the PHP vulnerability is is out there, a number of the a number of sources on that, it is brand new. I I will credit the the first word I got of it was from a company...

A guy at company called Black Talent, which is a security company that I actually, that actually works, does work for me in my office, keeping my stuff secure. As soon as it happened, I got a message from them. PHP is basically part of the...

It's it's part of the infrastructure of building a website. If you use WordPress or another type of website, you know, development platform, they...

WordPress probably does, and a lot of other...

Others use it too. It basically permits anybody who knows the...

How to act...

How to exploit the vulnerability to access the underbelly of your website, to get into the guts of your website. And if your website interacts with your practice management...

Like, for example, mine does. Since I use Curve, there is a link that can be teamed up, with...

On my website so patients can self schedule their own appointments. It's like...

It was actually one of the reasons it was one of the reasons I went to a cloud based system because none of the other things could do that.

So I called my web developer and they said, yeah. No. We we applied the patch and and for all... There there could be another version of this. But how does it... So it doesn't... I don't think it really affects the vendors specifically unless... Except to the degree that their their website is built on PHP.

For dentists specifically, it's because we have a lot more functionality in our websites now. A lot more. You know, a lot of them are able to do, you know, billing services and check insurance things, you know, through links.

Will you have access to those links if you've compromised the website through the PHP vulnerability? Maybe. You know? This is really not something that I want anybody to get into the weeds on.

This is just a question for you web developer. You specifically, do we...

Does my website use PHP as part of its infrastructure? And if so, have the two patches two patches shared yesterday been applied, you know, to your, to your instance of PHP? If the answer is no, then why or when are you gonna do it? Don't always do these things so quick.

You know? Sometimes there's not a sense of...

Like, without a big news story of a major breach, sometimes the, you know, the urgency is not there. And so people picking up the phone and making a call will sometimes make it happen.

Appreciate that. Thank you so much. Okay. And I'm trying to, patch a few of these, together. There were a couple comments about even replying to the patient review. And is even replying at all, even with a general answer, a violation because you've acknowledged that the client... That the person complaining was even a patient in your office?

No. It's not a violation necessarily. You don't necessarily have to acknowledge that the person is a patient.

You can word these things very carefully. You can say... When I say we do we do our absolute utmost to make sure that our patients are well cared for, I haven't said the person I'm speaking to is a patient or not. I mean, you think about what you're saying and what you're not saying.

You say it in a way that's very broad and generic. And why? Again, you don't necessarily wanna address this person. This... That's not the way you address a complete... You know, the response is really for everybody else.

You want them to say, oh, look at this look at this guy, this gal, this dentist. They're so reasonable. This person's being so nasty to them, and they're being so reasonable. They seem...

Yeah. Sometimes it can...

It it doesn't have to be a net negative thing. Sometimes these unhinged reviews...

I mean, anybody who would would not recognize it as being unhinged, you probably don't want that person in your practice either. So the the short answer is no. There are plenty of ways, creative ways, and I go into this in my longer lecture a little bit, but there there are plenty of ways once you see the idea of it, to do this without revealing they were ever a patient.

Okay. Perfect. Thank you. I'm bringing up this next one because I know it caught your eye when you were, middle of your webinar. But, the vigorous online, debate that exists right now about do dental offices need a signed release to send records if there's someone requesting them? Is it information blocking, etcetera? What's your comment there?

I, again, go back to the, the idea of sitting around a table, you know, with people, like, and justifying what I've done or what I've not done.

In my practice, I do not require a signed release from anybody unless I am suspicious that there's, you know, some reason I might need to prove this to somebody later. Most things make sense. You know, I have a patient who's been telling me they're moving to Oregon for the last year or so, and now they're moving. They say, I'm gonna call you and see if I can get... They call me. I recognize their voice. I ask them the date of birth, of course, and my office manager does. And now, because AI manages everything in my practice, whether it's Curve, whether it's Pearl, or Mango Voice, who Curve also works with, every call I make is interpreted and recorded and, you know, so I have a record of that call.

So in that sense, no. I don't need to. Now if a stranger calls me somebody I don't know and says they represent this authority and they want this person's...

Well, that's a different story. You know? Now I'm a small practice. I'm the only doctor.

I have five people, you know, in my office. Do you need a specific policy in a larger practice with more people? I I think you do. You know?

But it doesn't have to be everything needs a signature. Sometimes I think that is a barrier.

You know. And and, again, I go back to this guy. This was a a true story that, you know, this patient of mine ended up in Florida, and he was with an older doctor who was not very tech savvy, and they didn't really really good at... They couldn't really get into... You know, click the link on my secure, you know, email portal to get the thing. And to me, plenty of people said, well, you just shouldn't have sent it. I mean, they could take their own exit. You could do whatever.

And I said, that just didn't seem reasonable to me. And it may be because I've had a chance to talk to some of these people, to talk to representatives of health and human services and OCR. And, I mean, these people are... They're people. They go to doctors. They... You know, those are not the situations that you see big fines on.

The... That's not... Now I'm not saying it can't happen. You know? And when some... And people will sometimes come to me, experts, and and some... I air quote it, but they they sometimes are experts, and they'll say, well, that's a violation technically.

And I'll say, you know, you may be right. And and so might be, you know, driving 56 miles an hour in a 55, you know, but I'm not really worried about getting my car impounded for that. Taking an off ramp at 90 miles an hour, yeah. 56 in a 55?

There are there are degrees like that. And things should seem reasonable. Okay? Because that might not be a great answer as if we're looking for a system.

And there's certainly nothing wrong with...

Now I have forms for people to sign, you know, for social media, for photographs. If I'm gonna use a photograph on my website, always have somebody signed for that. Why? Because, you know, that's just...

That's so I can I can be sure they really understood what they were getting in? What what they were approving. You know? Because this might be some...

Oh, he's gonna use a picture. Maybe he's gonna give a lecture. And they don't realize it's gonna be, like, splashed across my website, their their smile makeover or or what it is. So I have them sign.

That's the way I do it. I think whatever whatever system you use in your practice, it should make sense to you. Okay? That...

That's...

And if it doesn't, then whoever you get advice from on this, penetrate that a little. Like, ask, you know, what about this? What...

You know, this...

It should make sense to you. It's not beyond your understanding. Sometimes we feel like this stuff is beyond us, but it's it's not. It's meant to make patients better able to control their information and have access to it when they want and have it not go where they don't want.

That's conceptually pretty simple.

That makes so much sense. And actually, it goes into... And I won't keep going forever with the questions, but I think this last one is really important.

I can say as long as you can. So just... Okay. You you me know.

Sounds good. Linda in the chat though said, what do you do for a practice practice that has open operatories and bays like pediatric? A lot of ortho offices do. Obviously, you can do privacy screens.

I mean, I can speak from the Pearl side. Obviously, we have a PHI toggle that you can turn on and off to prevent wandering eyes. I'm certain that...

I mean, you use Curve. I'm sure Tyler from Curve can can comment on what we have with Curve, but looking for other suggestions on what could be done there.

Well, there's two kinds of information to get shared in a situation like that. One is visual or something on a screen. The other is people's conversations. Those are the things that are a little bit more exposed, you know, in an open bay setting.

But you gotta real... I mean, if somebody's being treated in a practice where the bays are all open, they're aware that... I mean, there there are... There's an awareness that, you know, you gotta kind of... And so you should be sensitive to it and make sure that you're not, like... If the patient's talking low, you don't start talking... You know, you try and, you know, match them on it. But as far as visually, yeah, there should be screens. It shouldn't be that easy. Now it's not gonna make it impossible, but there should be an effort to make it less, you know, less easy, more difficult for people to sort of casually cut... See, you know, see information.

But it's never gonna be impossible unless you have one patient in your office at a time. You know? There's always gonna be a chance that something's gonna be exposed. You know, we don't need to be perfect. We just need to try and be better.

And as... And if we're making that effort, you're gonna be ahead of so many other people out there that you're gonna look pretty good by comparison. You should just take it seriously for yourself. Like, make sure that you would do what you would want if you were the patient.

Alright. That makes a lot of sense. And, speaking about being better, I have a follow-up on there. But there was a question that I missed earlier that just from, like, a a housekeeping standpoint.

There's some questions about CE certificates. There was a QR code on the screen earlier. If you missed it, it's also in the chat. Sheela's place...

Oh, there it is again. So you can scan the QR code and or can click the link. If you're watching us on your phone, then click the link that's in the chat, and that will be able to access it on there.

But speaking about just being a little better, couple questions around the same theme.

Online, if you're using something, does incognito window really work? Is it really safer? And or if you're using the app versus the browser, is there a difference in the security that is experienced?

Any particular app that you're talking about?

I mean, they're they're all any app.

Like, you know how you you can, access Facebook on the web portal, or you can access it via the app either on, your phone or whatnot? Like, think... Like, those those differentiate. Is there a difference in security if you had the Curve app versus the web browser? Yeah.

That's a good question. I don't, for... I was just typing because I'm just putting my email address in the chat. So if anybody else has questions later on, if they wanted to just email me a question or ask something about Pearl or Curve, they can do it.

Well, the app always connects to the Internet anyway. You know, the app is not as... Truly is... It's just a different connection to the to the Internet. So I would have to say, I mean, I'm not a technical person in that way. I'm gonna ask...

I'll I'll ask my son. He's a cybersecurity security consultant. He's my he's my phone a friend when I get a, you know, a, you know, a question I don't know the answer to.

So, no, I I wouldn't necessarily assume that the the app is any more secure than the... It really is who who. Okay? I mean, there are there are a 100 new companies doing AI stuff out there advertising on Instagram to dentists to come, you know, they'll do clinical notes, they'll do this, what what... Whatever for you, you know, but how long have they been around? What does their business associate agreement look like? You know, what are their... Are are they... I mean, some of these companies, honestly, whether they're doing insurance verification or... I mean, I've seen this. They're just making it like a thin, you know, a thin front end layer over, like, a chat GPT, you know, a chat GPT, you know, back end, and none of it's truly secure. You know?

Compare that to what, you know, you guys are doing. There's a difference. Okay.

So to your point, I'm gonna cut you off there because you mentioned that vendors should have a BAA. There was a question in the chat about that. What type of vendor should a doctor in an office have a BAA with?

Great question. Any vendor that...

With the weird exception of a dental laboratory, I don't know why, but the...

Any vendor who has access to your patient's protected health information. In my case, that would be Curve. That would be Pearl. It would be Mango Voice.

It would be half a dozen...

It would be...

Well, it would be Surf CT, who's my IT provider. It would be Blacktalent, who's my security company. Anybody who has...

Through their course of business has access to your patient's protected health information, you need a BAA, which is a business associate agreement, which is simply a document that outlines how the business associate is going to act to protect protect the health information and what they're gonna do in case it is breached. It's not a get out of jail free card, but that's just like the, that's just like the risk assessment. You know? If you have a...

Working with a company that has access to all your stuff and you don't have assigned BA for them, it's like...

That's like telling them, yeah. I don't really care. That...

Because that's not that hard to get.

You know, when I signed up for each... To to work with each of these companies, which was a number of years ago, you know, I... Some of them just, as a course of business, sent me one. Others, I had to ask. Okay. Whatever. But they're all filed away. You know?

You need one for anybody who could, without your necessary... Your permission or your immediate approval, see or access any of your patients' protected health information.

Okay. Perfect. And I know Tyler has some insight on the incognito windows browsers versus app when it comes to your land, so jump on in.

Go ahead, Tyler.

I was about to say doctor Rubenstein's correct in terms of the the app or the browser. It doesn't matter. What matters is the vendor. Is it up to date with security?

Do you have multifactor authentication? So it doesn't matter how you access it. Just are those things applied. And similarly, with incognito mode, all incognito mode does is makes your computer forget what you did.

It doesn't actually protect you. There's no protection around incognito. It just says don't remember browsing history. Don't remember don't remember anything, but you can still be vulnerable.

And then I also saw...

Just speaking of multifactor authentication, we do have it.

And Glad you saw that.

I was gonna ping you on it.

We left it up to the practice to decide. We mandated it a while ago.

We left... But a lot of people complained, so we then left it up to the practice. But, actually, for any curve users, we will be mandating it next year. It's become that important. It's no longer an option.

Woah.

Got the thumbs up. I get it, though. Sometimes you're doing the right thing and people complain because it's... Guess what? Security's annoying. Security is inconvenient.

It's... That's constantly the pull. The more the more conveniently you can access information, the less secure it is. Convenience, secure...

Such as it always will be. You know?

So we're...

I have a rapid fire question for you right now. This is a quick answer. I know it. How often is the risk assessment? Should... How often should it be done?

So it's mandated that it should be assessed or updated yearly. To me, I work with a company that does it through an online portal called... Companies called Abide. There's a few companies that do this. Basically, I do it all online. I answer questions.

I then get a list of action items that should be addressed, and then we...

It's a a work in progress. And periodically, if I haven't adjusted it, I'll get an email saying, did you ever get to...

You know, they'll they'll pester me, which they need to because I'm I'm busy. I got stuff to do. That's that's how it stops from becoming a dusty book on a shelf. Abide is one company.

There's another called Health First. They Health First makes, like, emergency drug kits and things like that, and they also do an online compliance portal, a pretty nice one. There's a few others also.

Awesome. Thank you so much. I know that there's so many other questions. Sheela, has some other things to say, but just know doctor Rubenstein gracefully gracefully, graciously put his email in the chat. His public one, not his one that's related to ***** Wonka.

I tell... Yeah. Yeah. That's that's my work email, which is fine. But, seriously, any... If anybody has a question they wanna email me, I'm... Or find me on Facebook or what... I'm not that tough to find. So feel free.

Perfect. Sheela, over to you.

Thank you. And thank you, Kimberly. Great job. They're helping us with all those questions. So many more.

Again, love to have you guys join us for the follow-up. We definitely need to do a second one. This webinar, as stated in the chat, will be sent to all of you and also lives on hellopearl.com webinars.

You'll be able to access that and many more. I think in closing, excellent topic, very thankful, one we need to be mindful of so we sleep better at night. Working with our Curve team, we're just thankful that our companies are on your list, doctor Rubenstein, and we love partnering with Curve, especially because, you know, when you're looking at X rays in real time and you're seeing those little pink and yellow dots, you can see it right inside of Curve, and that's a huge win for the workflow. Again, thankful that we're all on the up and up and proud that Pearl is that global company that's cleared in over a 120 different countries.

So you need to pick your your AI providers.

Just wanted to, again, thank everybody for joining us, on this webinar this evening. We appreciate you spending time with us. And doctor Rubenstein, we cannot thank you enough and our Curve team.

It's a pleasure.

Everyone have a great evening.

Thank you all.

‍

‍