You are here: Home / Archives for HIPAA

Taking Leaps: Fortnite, HIPAA & Psychotherapy

May 31, 2018 by Leave a Comment

“You keep dying,” Sam* said. The annoyance in the 9 year old’s voice was palpable. I looked at my avatar lying face down on the screen. Another of the 100 players in the game, appearing as a brunette woman in sweats sporting a ponytail, was doing a victory dance with her rifle over me. Sam was nowhere to be seen on the screen, but I knew he was hiding somewhere in the game, and seething.

“You’re disappointed in me,” I said calmly. A moment of quiet.

“Yeah.”

“You were hoping I’d be better at this, as good as you or maybe better, and it’s frustrating.”

“Yeah… Can we try again?”

And so we tried again and again, and while we did I talked with Sam about the other adults who were disappointments to him, who kept leaving or letting him down. And I guessed that we were also talking about his frustration and disappointment in himself. And at the end of our appointment I promised I would practice Fortnite, the game we had been playing. We had turned on our webcams again so we could see each other to finish the session, so I could see that he brightened at this idea.

“Nice to see you again,” I said. He smiled faintly.

“You too.” His screen went dark.

As I reflect on the work I do with patients, meeting them where they are at, I am struck by the same issues, opportunities, and conversations that can happen in an online play therapy session. I only wish more of my colleagues would try it. What gets in the way? For some it is a dismissal of emerging technologies which masquerades a fear of trying something new. For others it is a worry about running afoul of HIPAA and being sued. If you are one of those people who wonders about how to integrate video games online into your therapy practice, read on.

 *  *  *  *  *

Quick, without Googling it; what does the “P” in HIPAA stand for?

If you are a psychotherapist or other health provider, you probably guessed “privacy.” At least that’s often the consensus when I ask this question at my talks. It would be understandable if this was your guess. You’d be wrong.

The correct answer is “portability,” the basic premise that individuals have the right to healthcare treatment that moves with them as they go through the vicissitudes of life and work. That is also where technology comes in– electronic health records, telemedicine, etc., are ways that technology increases portability by collapsing time and space so that the patient and the healthcare professional can get to work.

In therapy, that work traditional has happened in an office setting. And in the case of children and youth especially, that meant play therapy which was bounded by the space and time of a physical office. From Uno to Sandtrays to the infamous “Talking Feeling Doing Game,” we have often assumed that play therapy needs to be the games of our own childhoods. But 21st century play can, and I maintain should, include 21st century play. That’s where video games come in.

In the days of the Atari 2600, there was no worry about patient privacy, because the system was hooked up directly to a television that didn’t even need to be connected to cable. But nowadays with SmartTVs, PCs and PS4s, video games are often played online with many other people and seamlessly connected to voice chat. This can be a concern for the psychotherapist who is unfamiliar with newer technology, especially with games like Fortnite, which boast Battle Royales having as many as 100 players at a time in the same game instance.

Videoconferencing programs and online therapy using video/audio chat have been around long enough to have specifications that adapt to HIPAA’s privacy requirements, largely because there is market force behind developing products that can be sold to the healthcare industry. Video games and their platforms, on the other hand, do not have a similar demand to give them an incentive to supply. Games like World of Warcraft, Platforms like STEAM, and streaming services like Twitch were designed for gamers, not therapists, and it is unlikely they will go through the technical and legal procedures to become HIPAA compliant anytime soon.

Some therapists have begun developing their own video games, which, like most therapy games are dismally boring. They are thinly veiled therapy interventions that are disguised as play, but lack any of the true qualities of play. True, they are more likely private; but they are also boring, and easily recognizable as “not playful” by patients. Mainstream games have broader appeal, critical user mass, and better graphics and gameplay in many cases, and are more immediately relevant to the patient’s life. But they are definitely not HIPAA-compliant. So what to do?

 *  *  *  *  *

My solution, which I’m sharing as an example that has not been reviewed by policy experts, lawyers or the like, has two parts:

  1. Due Diligence– Research the existing privacy settings and technologies to maximize benefit and minimize risk to patient privacy. So for example, I structure the “talk” part of therapy to happen over HIPAA-compliant software like Zoom or GoToMeeting. We start on that platform with video camera on, until we begin playing. Then we, turn off the camera to save on bandwidth and talk over this software, not the game. Previously, I will have sent the patient or their parent a snapshot of the settings of the game we are using with the voicechat disabled if possible. We also want to lower or turn off the game sound so we can hear each other. So in the case of Fortnite, the settings would look like this:

 

2. Limited HIPAA Waiver- This is the part most therapists overlook as even being a possibility. You can ask patients to sign a release waiving in a limited capacity their HIPAA rights in order to use noncompliant technology. It is entirely voluntary and I’ve yet to have a patient decline. I use a informed consent form that I developed that looks like this:

 

These are examples of how to engage with online technologies in a clinical way that is thoughtful yet forward-moving.

 *  *  *  *  *

Whether you love Freud or hate him, most experts agree that he was one of the fathers of modern psychiatry. He was also an early adopter. He based his hydraulic model of the drives on steam technology of his era. His concept of the “mental apparatus” was likewise integrated from the advances in mechanics and his formulation of ego defenses such as projection occurred simultaneously with the Lumiere brothers’ creation and screenings of motion pictures. Regulatory concerns aside, therapists can be early adopters. Doing so would probably help our patients no end, and definitely cut down on my waitlist.

* “Sam” is based on several patients whose identifying information has been disguised to protect patient privacy.

Find this post interesting? I can speak in person too:  Click here for Public Speaking info & Press Kit. And, for only $4.99 you can buy my book. 🙂

Filed Under: Gamer Therapy Tagged With: , , , , , , , , , , , , , , , , , ,

Protect Your Online Privacy: Start Blogging!

February 9, 2012 by 8 Comments

Many therapists have lamented about the lack of privacy the internet has created.  More to the point in my view, the internet has taken away the veil of secrecy psychotherapy has frequently sought refuge behind.  It used to be that the anonymity of large urban areas, or the possibility of a commute to the suburbs insulated therapists from their patients after the analytic hour came to a close.  I friend of mine once went for years before discovering that Therapist A, who had referred him to Therapist B when treatment was stymied, was actually married to Therapist B.  They did not share last names, but my friend in a moment of high curiosity and low impulse control drove over to Therapist A’s home address and discovered Therapist B’s name there as well.  He terminated therapy thereafter.

For myself, I learned that privacy is to a large extent illusory, not from the internet, but from my first job.  I worked in a community mental health center on a 13 mile long by 7 mile wide island which was 2 1/2 hours by boat from the mainland.  You get used to a diminished sort of privacy on an island.  I couldn’t avoid my patients if I wanted to, unless I wanted to avoid the library, most restaraunts, coffeeshops, the beach, or the one movie theater we had in the winter.  Nor could I find privacy in limiting the type of work I did there.  The Community Mental Health Center was the only one on the island.  We were responsible for, and I did, school counseling, Psychiatric hospitalizations (which involved flying with often psychotic people in a Cesna six-seater airplane,) outpatient therapy, Alcohol counseling and DUI classes, drug testing, and court-ordered counseling for domestic violence perpetrators.  I can still remember how when a colleague and I went out to dinner at a local pub one night one-third of the people at the bar left.  It wasn’t just my privacy that was affected here.

You have a choice in situations like that.  You can hide out in your house with a cat and television (which I did at first) or you can start living your life in the community and negotiate boundary crossings on a case by case basis (which I settled upon as my strategy.)  I learned to cultivate a sense of never-too-uptight-never-too-relaxed when I was in public.  It became second nature in many ways.

When I moved to Cambridge, MA, it felt very anonymous by comparison.  But as many practitioners in “The most opinionated zipcode in the US” will tell you, Cambridge is really a village in many ways.  I still ran into people, and by this time, technology was becoming more of a factor.

As Thomas Friedman has observed, “The World Is Flat” in the 21st century.  Globalization and technology have removed many of the barriers to, and some would say protections from, knowing each other.  Our patients can Google us, Yelp hangs up a business page of us whether we like it or not, and are often only one Facebook friend away from connecting with us.

Even if you want to make the poor business decision of staying off the internet in terms of a website, eventually your contributions to the Democratic Party, your address, and notes about you in your alumni magazine are still going to find their way out to the world.  We’re all on an island today.

So what can you do?  Well, my advice is to start blogging.  I know sounds counterintuitive, but it makes sense on a number of levels:

1.  Buddhism tells us to move into the places that scare you.  We exert so much energy trying to avoid things, find a spot where we can stay safe and stop the awkward and uncomfortable learning process.  And yet we ask our patients to do the exact opposite so often: to look underneath those rocks, descend into the depths of the psyche, face their fears.  Our obsessive quest for privacy is perhaps not that different.

2.  Make the internet work for you.  One of the best ways to protect your privacy is to generate a lot of content that you consciously know is public-facing.  Google “Mike Langlois, LICSW” for example.  Go ahead, I’ll wait.  What came up probably is pages of my website, professional picture, Youtube videos, and blog posts.  Dig a little deeper and you’ll see me commenting on a few blogs.  This is the practice of radical transparency.  All of that content was written with all of you in mind, my patients, colleagues, friends, family members, potential coaching clients, high school classmates, potential employers, my future children and grandchildren and the FBI.  The way Google and other search engines work, the more content I put out there that is public, the further back any unintentional pieces about me will be.  By embracing that the world is flat I have learned to cultivate a style that I can negotiate in my work life while still feeling authentic.  And it is great advertising, or fair warning, if you are considering working with me.

3.  Radical transparency protects your patient’s privacy as well.  Whether we like it or not, therapists are finding themselves on review sites like Yelp.  Yes, anyone can post a review, and no, Yelp will not taking it down if you ask.  More importantly, your patients might not understand the ramifications for their privacy or PHI if they post a review.  Keeley Kolmes has great resources on this, and you are welcome to use my version of her version as well.  Take a look:

Notice that half of my allotted space is not advertising, but a direct message to any potential commenters.  Rather than hide out and try to get Yelp to take my name down, I have used it as a platform to market my business, model what I feel is ethical professional standards, and provide some information to patients in the spirit of informed consent.  Do I want to get bad reviews?  Of course not, who does?  But that is not an excuse to hide my head in the cybersand.

4. Last, but not least, get over your bad self.  Sometimes listening to our colleagues you would get the feeling that they are dealing with the paparazzi, not the public.  Sure patients and others may be curious about your life, but really most people in the blogosphere just aren’t that interested.  On a good day, my blog gets 200 views, on an amazing day last August I got 689 views.  There are 7 billion people on the planet.  Feel free to correct my math here but according to my calculations that means on a busy day 0.000009842857142857142% of the people on the planet are checking out my most visible presence on the internet.

Am I saying you should blog for the sake of blogging? No.  I am saying that there is a Copernican revolution going on in the 21st century, and therapists need to join it.  Rather than avoiding technology and the internet we need to start understanding it and harnessing it.  You can be googled whether you like it or not.  Yelp doesn’t care about contaminating your transference.

Being professional is about how we rise to the occasion of Web 2.0, not deciding to skip out on the party.

Like this post? There’s more where that came from, for only $2.99 you can buy my book. I can rant in person too, check out the Press Kit for Public Speaking info.

Filed Under: Gamer Therapy Tagged With: , , , , , , , , , , ,

Ethics & Technology: A Mild Rant

October 27, 2011 by 7 Comments

Like this post? There’s more where that came from, for only $2.99 you can buy my book. I can rant in person too, check out the Press Kit for Public Speaking info

Filed Under: Gamer Therapy Tagged With: , , , , , , , , ,

Radical Transparency

October 9, 2011 by 4 Comments

By now you may have read the story of the student in Manchester, NH who was arrested in his school cafeteria by a police officer who lifted him out of his seat, and forced him into a prone position on a table.  Another student captured the video, and you can see it and the story here.  Although the police handling of the situation was clearly disturbing, even more disturbing are the voices of the teachers caught trying to get the student recording to stop, and then attempted to take the phone away from him.  By his report they did make him delete a couple of pictures, but the video went undiscovered until it went viral.

It’s time we get real about transparency in the professional world.  My prediction is that the school administration will address this situation by trying to either enforce a no-cell phone policy or create a policy that prohibits the use of electronics on school grounds to record such incidents.  I hope they don’t, and use this as an opportunity to open some conversations between school staff, parents, students, and officers.  But I will be pleasantly surprised if that happens.

Professionals who work with people “in their care,” be it therapy, education or something else, often cite privacy concerns when it comes to transparency.  I’m convinced that the reality is often that they want to protect their privacy as much as if not more than that of their patients.  What happens behind closed doors is secret.

Remember that phrase “you’re only as sick as your secrets?”

Other professionals want to commute to work so they have a “private life.”  They are outraged with the amount of information available about them online, information that their patients, students, anyone, can access about them.  When I do public speaking about technology and therapy and education, I often find that privacy concerns boil down to this sort of fear and outrage.  Sure, HIPAA is brought up, but that is usually in the context of another fear, getting sued.

I practice and encourage my colleagues to practice what I call “radical transparency.”  I define Radical Transparency as engaging with technology as if it is always in the Public sphere visible to anyone.  To be clear, this does not mean either never using technology to communicate about one’s personal or professional life.  Nor does it mean telling everyone everything all the time.  Rather, radical transparency means that before you “utter” anything via technology, and before any choices you make with technology, you consider what would happen if it one day comes to light.

I’m not saying you have to like radical transparency, I’m just saying that it is time we get clear with our relationship to technology and others with it.  And I’m not saying I am perfect with it, but I try to comport myself with authenticity.  If you search online you will (hopefully) not find my public posts or comments cutting or snide.  If you somehow got hold of my emails over the past few years, what would emerge is an acerbic, funny, tart guy who is prone to arrogance and does not suffer fools gladly.  You’d find a good deal of kindness and wisdom as well, but certainly you’d find frustration, self-righteousness and negativity.  In short, you’d glimpse my human condition.  But there you have it, I am prepared to accept the revelation of any warts that may come along.

Radical transparency, I am suggesting, is not just about what you “put out there” on the internet.  It is not about gussying yourself up so you are acceptable to everyone.

Radical Transparency is about getting clear, clear with yourself.

I have found two spiritual traditions especially helpful with this idea.  The first is Buddhism, which talks about nonattachment and going to the places that scare you.  But in this post I want to focus more on the second tradition which has influenced me, and I think may have some good insights into technology and our place in the world.  That second tradition is Quakerism.

What I have learned from Quakers and my own connection to the Society of Friends, is the importance of gaining clearness, and discernment.  One quote that sums up what I am saying is from an article written by M.L. Morrison in the book Spirituality, religion and peace education.  In it she says:

“Key to a Quaker philosophy of education is the belief that each individual has the capacity for discerning the truth.  The truth does not solely come from the teacher or mentor… The process of getting clear about a particular discernment implies testing it out in a community of fellow seekers.  In this way individuals are accountable to the communities in which they live and learn and the community can support the strength and leadings of its members.” (Italics mine)

What if we started seeing the world, online and off as that sort of community?  Get clear with who you are and what you’re about.  Be authentic.  And after you have achieved a certain amount of clarity have a discerning attitude about what you put out there about yourself, and above all behave as we feel we ought.  Am I saying that we all need to adopt Buddhism or Quakerism?  Of course not.  But we need to start focussing first on who we are in the world, not who shouldn’t be videotaping us.

Technology is not going away folks.  And adolescents are rightly exploring and testing the limits of it, because they will be using it to maintain, more accurately repair, the world we have given them.  September 11th taught these kids that media can be used to bear witness to terrorism and injustice in real-time.  And since then, Youtube has proliferated with videos of the atrocities professionals have perpetrated.  I have seen a juvenile collapse walking around a courtyard of lockup, only to be kicked and ignored by the warden when he was in need of medical attention.  I have seen a college student tasered in a library.  We have seen an Iranian woman shot to death and die before our eyes.

And these images change us, and they go viral.  This is what globalization is, this is our whole planet struggling to get clear.  And there are lots of people, those in power, who want the status quo.  Keep the doors shut so people have to “go through the proper channels.”  But technology is trending towards dialogue and democracy.  You just can’t get away with being cruel unobserved and often unchallenged.  Make fun of a teen who may have Asperger’s and he’ll post a rebuttal on Youtube.

These are the same people as the teachers who try to take away the student’s cellphone, or the administrators that forced Matt Gomez to shut down his class Facebook page.  All the parents had signed off on it, but concerns about privacy were still cited.  And that again, I believe is often a professional rhetoric for “controlling access to information.”

I have worked on the inside of several school districts, and in all of them I saw stellar educators, people who were always taking risks and getting creative.  And I saw lots of lazy, verbally abusive educators there as well.  The way our education, and our mental health, systems are set up there are a lot of disempowered angry people working with even more disempowered angry people.  And many are in the middle, trying to just keep their head low and not make waves.  I know, because I have been all of these at one point or another.

This is not going to be as easy from now on.  If you swear at a student, someone’s going to record it on their phone and have it posted on Youtube before you can blink.  If you gripe about a patient on your Facebook page they’ll find it and call you on it.  And those of you who are trying to just keep out of it all, we’ll see you too.  And more importantly, you’ll see you, and when the kid you ignored being bullied because you didn’t want to deal with it that day kills himself, you’ll have to live with the guilt that thousands of people he never knew reach out to assure those like him that it gets better, while you, the person who saw him every day or week just sat there and did nothing.

Talking about patients online, getting rough with a student, shooting a woman–Yes, these are all very different events.  But they all connect around the idea of an ethics of radical transparency.  Or as Rainer Maria Rilke put it in “Archaic Torso of Apollo:”
for here there is no place
that does not see you. You must change your life.

Like this post?  There’s more where that came from, for only $2.99 you can buy my book.  I can rant in person too, check out the Press Kit for Public Speaking info

Filed Under: Gamer Therapy Tagged With: , , , , , , , , , , ,

How to Have a 100% HIPAA Compliant Online Presence

January 17, 2011 by 38 Comments

Fort Knox photo courtesy of Flickr

Many of you have asked me about protecting the privacy of patients in your practice online. Since this concern with privacy often feeds into the anxiety psychotherapists have about using social media, I wanted to offer you a way to build your online presence with an eye to best practices and a sense of confidence. So here is my instruction manual for having a practice that is 100% HIPAA compliant and respectful of patient confidentiality and therapist privacy. Do these things and you will never be in trouble.

1. Don’t talk about your patients online, ever.

People who work with me know that I am nonnegotiable on this one. Yes, in the 15 years I’ve been a therapist I’ve had plenty of poignant and instructive cases I could present and patients I could discuss. No, I am not going to tell you about them. Not on the internet anyway. The internet is not like a team meeting or case presentation, where you have a closed group of professionals discussing patients and asking for consultation. Anyone can read the posts, and patients can easily identify themselves (or imagine that they do) in your blog post. And if Facebook resets your privacy settings one day and I’m your 2:30 patient; and if I Google your Facebook as patients do at 3:25 and find you’ve just updated your status to say, “Just finished with the tough patient for the day, it’s all downhill from here;” then I will know, be offended, and if I’m savvy and litigious get ready to make some money to pay for the new therapist I’m about to hire.

And a special shout out to those of you who use forums such as LinkedIn and Psychology Today, even if you think your forum is open “only to professionals,” does it not occur to you that your patients are or one day could be in your profession? I look at some of the many forums I am on sometimes and I am horrified by the headings, which often resemble these:

“Wow, this patient is so self-centered!”

“What’s the funniest that thing your patient said in session today?”

“Potential clients wants to see me instead of my colleague they see now.” (Let’s hope the colleague doesn’t read the forums.)

and “I don’t want this borderline back! Help!” (Complete with a page long “brief” case presentation!)

Several of these have so much identifying information it’s not funny. And as for LinkedIn, most discussion groups are now open and searchable by web, so when you write in asking for advice about an adolescent smoking pot don’t be surprised if she ends up seeing it.

In closing on this one: I know we all need to vent and ask for help with patients from time to time. That’s what supervision is for, go buy some.

2. Life is temporary, the internet is forever.

Before you post anything, ask yourself how you would feel if it was printed on the front page of The New York Times or some similar print edition. Everything you post on the internet is housed on a server somewhere; backed up usually; then often trawled for and picked up by Google and made searchable. Once you put something on the web it stays there, even if you think you deleted it. So ask yourself, “Is it a good idea to have what I’m about to write floating around wherever it will forever?”

3. Don’t create an online identity that you aren’t prepared to have connected to you.

The nature of privacy is changing due to technology, and that means we can’t be assured that any identities we assume online will remain private now or in the future. Servers get hacked, laptops get stolen, and people, patients included, are very resourceful in satisfying their curiosity about us. So if you have specific groups or personas that you want to let loose on the world via WoW, alt.com or anywhere else, be prepared. If I can’t imagine myself being able to hold a conversation with a patient about their discovering a potential “secret identity,” I don’t create it. I know this may sound harsh, but this is one of the privileges we give up for the privilege of doing the work we do.

4. Don’t subscribe (or unsubscribe) to things you don’t want patients or colleagues to know about.

Subscribing to things is a choice, and you need to be prepared to have those choices made public. This ranges from sites which tell you how much a person donated to the Democratic Party to a blog or listserv. And in terms of collegial relationships, do not risk appearing deceitful by opting out of a Constant Contact list and then telling the colleague how much you enjoy their newsletters. Yes, this has been done to me, and I try very hard to resist telling the person that I can tell them the exact date day and time they unsubscribed on my CC account. Subscriptions and unsubscriptions are expressions of your agency online, express your agency with integrity.

5. Understand how email works.

Recently I agreed to provide coverage for a colleague, and when they offered to email a list of who I’d be covering I requested that they mail it. This surprised them, because they know what a technophile I am. When I explained it is because email is not secure they replied that the mail isn’t secure either, and that envelopes often arrive opened. That is an unfair comparison between email and mail in my opinion.

A more accurate comparison would be if you write a letter, make a copy for yourself and send me a copy; and then someone opens the letter at your post office, makes and keeps a photocopy of it and mails it to my post office, where a second worker opens it and makes and keeps a third copy of it before giving a fourth copy to me. That is how servers work, that is how hosted emails work. If you don’t want four or more entities having copies of your emails, don’t send them. If you want to send encrypted emails, which are definitely more in keeping with HIPAA and HITECH, I recommend Hushmail.

6.Keep current with the technology if you plan on using it.

You know I encourage you to try and use technology as much as possible, so the above may sound like an impossible and counterintuitive task, but there you are. If you are planning on taking pictures of your children with your iPhone and posting them on Facebook, make sure you know about geo-tags before you go about using Facebook or Craigslist. If you are considering using Dropbox or GoogleDocs for patient notes investigate whether these are verified as HIPAA compliant (I’ll save you time on this one: They are not. Don’t use them for patient notes.)

If you want to play around with some new technology, research it a little (Google “[whatever you’re playing around with] and privacy.” If you want to keep current with technology and best therapy practices, I recommend you check out the Online Therapy Institute’s “Ethical Framework for the Use of Technology in Mental Health.” They are on the cutting edge of this stuff, and they have great courses as well as free resources.

So these are my suggestions for having an online presence that is HIPAA compliant and protective of your patients’ and your privacy. I know they are a tall order, but the privacy of you and your patients is worth the effort. Please feel free to add: Did I miss anything?

Filed Under: Business Tagged With: , , , , , , ,