117: How To Mitigate The Big Compliance Risk Inherent in Dentistry

Welcome to DSO Secrets. I know what it's like to be an entrepreneur in the dental industry. I've had my ups and downs, just like you. There's so much opportunity to be excited about, but so few resources to get answers. From here on DSO Secrets, we get you those answers so you can change the lives you're meant to bless and achieve your personal success.

When I was working as an associate rat at a school, I never imagined I could own these many practices with this amount of support. So thank you.

You have helped build my marketing mind

to a whole new level. You have this natural talent, this unique ability.

All right, hello, everyone, and welcome to another episode of DSO Secrets. I'm your fearless host, Emmett Scott. And today I'm so excited because we're going to be talking with Danielle McKinley, who is from PCI HIPAA. Is that a good way to say that the company name all the initiatives? Yeah. Great. PCI HIPAA is a leader in compliance and patient data protection. So I know many of you have reached out around ransomware, around compliance and so forth. And we love talking about how we can grow, how we can have bigger impact, but the reality is we're not going to have bigger impact if we're having compliance issues. And as someone aptly told me, great compliance is great business. So I'm excited to have Danielle today. And, Danielle, welcome to the show. You said before we started that you've been in this for 10 years in dentistry. So tell me a little bit your story on how you got into dentistry and why compliance. That always seems like the boring parts, but, yeah, tell us a little bit of that story.

Yeah, it is the boring part, right? It's the part nobody wants to talk about.

I guess we want it to be boring, right? We don't want it to be too exciting.

That's right. Yeah. You know, it happened. It was meant to be. It was serendipitous, so to speak. So I absolutely love helping. If I could be a philanthropist, that would feed my soul and I would be the happiest person. Unfortunately, that takes a lot of money first, so I got to put in the work, and this is kind of my version of it because I get to help doctors every single day with a piece of their business that they're like, I don't want to deal with this. I just don't want to deal with it. It's complicated. I want to treat patients. And we were fortunate enough to start helping practices with compliance through a relationship at LVI Global, the continuing education school in Las Vegas. And it's been a really fun 10 year journey of just talking to thousands of practices and partners and really helping staff simplify a complicated topic.

And what sparked going into compliance from lvi, how does that, Again, what sparks going into compliance from lvi, how does that happen?

Yeah, well, it happened really organically just by having open conversations with doctors. So originally our relationship with them was helping them with their payment processing, their credit card processing. And one of the, our partners and founders at pci, hipaa, had a data breach of their own and a light bulb kind of went off. And this was before data backup and cloud backup and things like that were in place. So we started asking questions and what we learned really quickly is that number one, doctors didn't know really what their requirements were. They didn't understand the risk and they didn't have a plan. And so we started to build a solution around that. And now we service thousands of customers nationwide.

What makes dentistry and healthcare such a big compliance risk? I mean, if somebody's just coming out of school, been focused on the clinical piece, they might not know things like Phi and HIPAA and some of that. So could you just hit lightly on some of that glossary and why we're more at risk than, I don't know, some other retailer or something like that?

Yeah, certainly. So again, compliance isn't something that's taught in school. So especially my startup doctors, they understand the risk more than a startup doctor did 10 years ago because of things like ransomware. So really the reason that health care is such a target is my dentists are always like, who cares? No one wants to know when the last time someone got a cleaning. Like, why do they want my information? And the reason they want it is not the health history. So cyber criminals are after the identity information of the patient profile, their full name, their address, their date of birth, sometimes billing information, Social Security numbers are there often, and that's the data that they're going after. So when you look at it from a target standpoint, they get a lot more bang for their buck when they hit a dental office or a family care physician. Because you typically have anywhere from 1000 to 3000 records is pretty average. And that's 1000 to 3000 identity profiles to compromise.

Yeah, it's weird to think we're like the ideal customer for hackers. Right? But that's where we are in the marketplace. And so they're constantly looking for ways to get access to this information, to this HIPAA information. And if they get access to, obviously it's awful because they now have access to patient information. Do we have requirements? Do we have to do anything like do we say, oh, sorry, that happened, okay, shut that wall, or what starts to happen once. Once they've done that?

Yeah. So that you do have requirements. Absolutely. And the best way to prepare for that is to have an emergency and incident response plan. Get an understanding of the breach notification laws because you do have some state and federal requirements and typically at the state level, the timelines are shorter for which you notify a patient. Right. So the very first thing you have to do when an incident occurs is a forensic investigation that's going to tell you how many patient records were affected and provide the list of who needs to be notified. And that can be a starting cost of $20,000, $30,000. So it's really important that you have a cyber and data breach insurance policy today and get to understand, okay, what are my responsibilities and how can I make sure that when that happens I'm prepared to complete them but also not lose a ton of revenue because that becomes my full time job instead of treating patients.

Right. I mean, when Target, Sony, all of these groups, they've gotten hit, send out the letters, do the media. It's not because somebody in marketing said, you know, it'd be really cool if we ran this marketing campaign that said we had this data breach. It's a requirement, right, by state and federal law that they have to notify everyone, et cetera, of that happening. So, yeah, really expensive, full time. Now the other bucket I think of is you've got all these regulatory agencies, right, who are also trying to protect the patient. Protect the. Well, I was going to say protect the doctor. I don't know that that's always the case, but definitely protect the consumer, protect the patient. And I think Brian Coleojo says there's somewhere around 22 to 32 different regulatory agencies, right. That are coming after, if you will, a dental practice. So can you kind of talk through some of those agencies or some of the ways that pci, hipaa, helps a dental practice with regulatory components?

Yeah, certainly. So there are a ton of moving parts. Like you said, there's a lot of pieces to it. So one of the best things a practice can do to get familiar with those moving parts is to take a risk assessment. A risk assessment required every single year. And I always say it as, it's like a new patient, where you have a new patient, you're doing a consultation before you're telling them, hey, this is the treatment plan. The risk assessment is your consultation for determining what path you need to take to protect yourself from all of these regulatory agencies. Right. So it gives you a really nice roadmap. And basically from the compliance front with hipaa, OSHA and pci, what we help with is the Health and Human services side, which is who governs hipaa, an Office for Civil Rights. And then osha, regulated by osha, and then the payment card industry that is all around the rules and regulations of protecting credit card data. Because what a lot of healthcare providers don't realize is that if you have a credit card breach, like all of us have had a credit card replaced at some point, a personal card. Right. What they don't realize is that that can also be a HIPAA violation. So it's very important that you're PCI compliant, because when you become PCI compliant as healthcare provider, you're eliminating a double liability for your practice.

Well, and you mentioned OSHA made me think of OSHA just rolled out a emergency, what do they call it? Emergency temporary standard, ets. And now there's a safe harbor for dentists. But if you're not meeting those safe harbor requirements, I mean, it's crazy what you have to do to redo your entire practice and ventilation systems, et cetera. So if you do the safe harbor components, it's cumbersome, but not overwhelming. If you don't, then you really expose yourself. So keeping up on some of these things is also difficult when I'm trying to come up with my marketing strategy. I've got technology components, et cetera. So I'm assuming pci, that's one of the things that you guys are also watching for, especially in this Covid environment. It feels like I felt like we were near the end. And then OSHA comes out with an ets, as if we're at the beginning here. Right. And so, so many things. So do you guys have consulting too, to help me be able to stay on top of this stuff?

Yeah, we really take on the work for you. So that's one of the big challenges is that these requirements are a moving target. It's not something that once you've got it, you're good. There's all these updates. And like you said, how do I treat patients, scale my business through marketing, do podcasts like this? So we, we take on the work for you. So we. Do you have unlimited, like, life support with us? We help you understand first, okay, where are you at? Where do you need to be? And then we have a platform called Office Safe that automates all the Policies

and procedures is like a technology platform.

Yeah.

Okay. And so is it like, is it a technology platform that integrates with my practice management software or is it a place where I can manage everything that I'm trying to do compliance wise and have it in one simple place?

It's the second that you said, so it's not going to integrate with your practice management software. We don't want to live in there. That's another set of risks because now we're able to access that. Right. So it's its own cloud software, it's an online portal that you can access anywhere with Internet and it's going to basically allow us to take on most of the work for you. There's some parts of the law, like Business Associate agreements, for example, you're required to be the sender, so we can't send it for you. Right. So in those scenarios for the small pieces that we can't complete, we really hold your hand through those parts and make sure it's getting done and we take on as much as humanly possible for you.

Can you talk about baas for a second? Because I don't think most dentists even know that they have the plumber come in or they have other vendors come in who can see their practice management software that they're supposed to be having vendors sign baas. Can you just educate us a little bit about that?

Yeah, happy to. So the Business Associate agreements is the one part of the law that truly is designed to protect the doctor. Okay. And it's there to really inform these third party vendors that, hey, by working with my practice or providing a service, you're coming in contact with sensitive information and under the law you have to protect it. If you don't, the onus is on you. So as long as you as a practice can prove that you have an up to date business associate agreement, you've got a log like listing out who your vendors are and you can prove that it was sent and signed. That's how you get that protection. So the biggest misconception around Business Associate agreements is they're like, oh my IT provider gave it to me, I got one from Dentrix Open Dental gave me theirs. If they are giving you the agreement that is protecting them, they're essentially saying to you, hey, I'm aware of this requirement. Here's a, here's my agreement that says, I know I have to do this, but if you haven't given them your own version, you're not getting the protection

and I'm guessing the software, then Helps me like keep all this documentation because otherwise it's just ending up in a file somewhere and then when I really need it, I don't know where I put it. Right, exactly.

Yeah.

That's the value of the software.

Software automates all those moving parts. So as your consultant, we'll help you define your list so that you don't miss anyone, you don't do extra work by creating a profile for someone that's unnecessary. And then you're able to send right through the portal and it tracks all the miscellaneous details that Health and Human Service requires and it allows the receiver to view electronically and sign electronically and it just captures everything.

Now, there's a whole other risk associated with taking government pay any kind of Medicaid, Medicare. I know that, you know, here's my little understanding of compliance, but I know there's a step up of requirements if you're taking more than 5 million. So someone who's, you know, got larger practice or set of practices, is that something else? You know, I've, I've seen dentists who decide to go and buy a Medicaid practice and I'm always like, okay, please get a lot of education. You're taking on a new level. But especially when you reach some of those bigger thresholds, you know, there's org chart and compliance officer titles you need to have in place and they need to have access to a board and, and those kind of things. Is that something you all consult on or is that outside your space?

Yeah. So the compliance requirements that we help practices meet are going to work perfectly for a practice like that. They're going to have things beyond it. We actually work with a consultant that specializes in practices that take Medicare and Medicaid. So the part that we really help them with is the MIPS portion where they're getting, they're filling out their paperwork for the incentive payments, so they're making a higher rate if they're solely servicing Medicare, Medicaid. There is basically four categories under that, that MIPS incentive program. We solve for one of them and that's all the compliance requirements.

So yeah, and you just brought up a really good point I just want to dovetail into is, you know, I had a private equity firm once tell me who had been in health care, said good compliance creates better revenue and profitability. And I thought, man, that just, it didn't seem intuitive to me at the beginning because all I saw was a bunch of cumbersome requirements that, you know, I was submitting to. But I didn't think of it as like revenue and profitability generation. But to your point one, your billing gets more clean, your conversations more clean. There's just, there's all this protection of the dental license, which I think is like the number one reason, like livelihood. But you actually increase profitability when you have better systems around some of this compliance. Now occasionally you're like, that makes no sense. There's no logic to it whatsoever. You still have to comply. But the majority of time, I mean, you just brought up like there's an opportunity for higher reimbursement by following these rules. There's a lot more of that out there, even in just operational process. I've noticed. Right. My billing team is better than most billing teams because of the compliance. Yeah, yeah. The doctor notes are better, the standardization is better. Right, all of that stuff. Yeah, yeah.

It all kind of, it all feeds into each other. Right. And that, that's. I'm glad you brought that up because it made me think of something else that's really helpful where we advocate for the private practice because we know every time you turn around it's another expense. So one of the things that we're really good at is our solution is a one stop solution. So you only need one vendor, you don't have to work with six to get all of the requirements met. And so we really analyze a practice and are able a lot of times to omit expenses that exist today. And we are able to turn compliance into savings even at that level because we're getting rid of expenses, it's offsetting the cost and they're still saving money and they're becoming more compliant.

We talk a lot about healthcare integration with dentistry and I think one of the things that we have to realize is the closer those two come, the more compliance is also coming. We've been able to hide in the background in healthcare and yeah, we've had this risk on ransomware and HIPAA and all of that that we probably haven't been as good as we should. But as the general public, especially regulatory bodies, start to see this integration of dental and health, I think one of the things we have to know is coming with that is they've been working a long time on compliance and we're just going to kind of have it dumped on us and we're going to be like, wait, where did this come from? It has always been there. We just weren't as organized as we needed to be. So I think no matter where you're at, starting to put together a plan. Right. I think that's the other thing that a lot of people don't know, you can get a lot of protection, right, Danielle, just by having a plan in place. I know at times it's, you know, my compliance officer said we don't have to execute on all of this, but by showing that we have a plan that we're working towards this, that gives us a large amount of protection. Am I right on that?

Yeah. And that, that falls under, like, safe harbor, where they want to see that over the last 12 months, you have implemented a plan and are making progress on completing that plan. So Health and Human Services is always going to be more gentle, so to speak, when there is a breach, audit or investigation. When you, you know, even if you're not checking all of the boxes, if you can show that you have a path to check them.

Yeah. So critical part, if you're like, well, Emmett, I kind of either 0 or 100%, this is one of those ones where being 10% with a 90% plan can get you quite a bit of protection. All right, so.

And, like, what it does, too, is it, like, what would happen? So let's say that you were audited and you had your plan and you're 40% there. Health and Human Services may say, okay, that's great, I see your plan, but you need to execute it within this amount of time. So part of working the plan and getting it there is so that you're not hit with this stop, drop and roll when something happens, because they've now placed this stringent timeline on you.

Well. And not having a plan, you look like you don't care. And they hate that. Right? It's like, yeah, yeah. They took all my information. Oh, well. All right, so. So, yeah, showing that plan shows that you care. You're being proactive.

All right.

Is there anything, like, if there was one thing, dental practices, because you got hipaa, you got osha, you got, you know, list them all out. You got credit card processing. You got some poor gal or guy who's been writing down credit cards and processing. So you've got all this stuff that, that is happening in dental practices. Where would you start? Like, what's the one thing. Monday morning. We're Friday today, Monday morning. What would I do?

Number one thing to do, Take a risk assessment just so you can know

what priority I should focus on. Right. Like, maybe for you, this is a lot bigger risk because you've got, you know, medication, sedation, meds that you really need to be focused on. You know, something like that. Right.

Totally. And I mean, for one, a risk assessment is mandatory. So it's something that you have to do every 12 months. Think of it like Health and Human Services way of forcing you to get access to updates. Because we talked about it's a moving target. Right. So the best thing by far that you can do, even if so there's going to be people that are like, I know, I need stuff. I haven't been doing anything, I have no plan. And then there's going to be practices that are like, you know, I feel like I've got a pretty good grasp on this. I feel like my team's doing a great job. Doesn't matter where you fall in that a risk assessment is going to give you the certainty that you need.

Okay, awesome. Hey, thank you so much. Danielle. Is there anything like in closing here? Again, I kind of like to talk about the abundance. I tell my poor compliance officer that all she does is go to horror stories all day long when she goes to these conferences. But the reality is, one, as I said, this actually can create a better, more effective business. And two, it's critical so that your knees aren't cut out from under you. But anything in closing that you would say to the audience here, yeah, look,

compliance does not have to be a burden. You can automate it, you can delegate it. You can get that certainty and that feeling that, okay, if something happens, I'm okay. And you can simplify it. Right. So I would say if you have questions, I love helping.

Yeah.

Do you want to give your contact info? If dentists care about protecting their license,

sure, I'd be happy to. So you can reach me. You know, I'll give a landing page so you can actually go to PC cihipa.com Danielle and there's some great tools on there. You can schedule a consultation with me. If you want a one on one dialogue, I'm happy to take questions. There's a free risk assessment you can access there. There's even an on demand HIPAA certification course where you can get some CE credits too. So those are some good tools that you could start with to kind of start to do some of the things we talked about today.

All right, give that website one more time and then we spell your name at the end.

Yes. So it's www.p as in Paul, C as in Cat, I H as in Harry, I P as in Paul, A as in Apple, A as an apple.com Danielle, which is D A, N I E L L E. Danielle, thank you

so much for being on. I hope this was helpful. Information. For those who have more questions, you can also come over to DSO Secrets Facebook page and until next time, keep smiling.

Thank you for listening to DSO Secrets. Join our community on Facebook @DSO Secrets and get answers and resources to some of your most challenging questions. If you want to get a copy of the seven secrets of any DSO, go to our website at dsosecrets.com and we will get that emailed to you. Remember, don't go at this alone. Let us be your team while you build your team.