Hungry, Hungry HIPAA… Data Protection: Best Practices

Written by David Mercy
Director of Business Development for IT Support LA

“First do no harm” is a concise summary of intent, although not the actual wording present in e Hippocratic Oath. Doctors in any medical field have TWO responsibilities in this respect to their patients. First: e physical well-being of the patient. Second: e well-being of their information.

Physicians are often more concerned with the treatment of their patients, and rightly so, however, HIPAA regulations and fines should also be taken quite seriously. Violations often happen inadvertently, but they can still place a great burden your practice. A patient will seek a second opinion immediately if their faith in their physician’s medical abilities becomes suspect, but what about the theft of their personal information? Breach of that trust can also lose a patient and incur negative ‘word of mouth’ affecting your practice and your standing in the community.

Since the passage of the HITECH Act in 2009, the network of government offices concerned with Health Information Technology has been given the authority to establish programs presiding over a number of areas to improve health care, and the main enforcement arm of this body is HIPAA, which is expanded and given more teeth with which to punish violators every year since. In July of 2016, e Health and Human Services’ Office for Civil Rights (OCR) greatly stepped up its auditing program. As Government agencies do, once they start levying fines and generating payments, they smell money. Just make sure that lovely green fragrance isn’t coming out of your medical offices.

Watch out for this side note: If you are sent an email by the OCR concerning an audit: It should come from ‘’. Check the address carefully – if it has an extra dash and ‘us’ at the end, as in ‘’, it is a Phishing scam encouraging you to click a malicious link (do not click).


Maybe, maybe not: Read the wording on your Cyber Liability or Data Breach Insurance policy carefully. You may be covered for some HIPAA fines, but not all, and although you may have $1,000,000 in coverage, there is often a ‘sublimit’, like a deductible, which could be $200,000, which monies you may still be responsible for. With many HIPAA fines being in the neighborhood of $50,000, that’s a hit directly on your own pocketbook.


Covered entity or individual did not know (and by exercising reasonable diligence would not have known) the act was a HIPAA violation.

$100 – $50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year. 

HIPAA violation had a reasonable cause and was not due to willful neglect.

$1,000 – $50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year.

HIPAA violation was due to willful neglect but the violation was corrected within the required time period.

$10,000 – $50,000 for each violation, up to a maximum of $1.5 million for identical provisions during a calendar year. 

HIPAA violation was due to willful neglect but was not corrected.

$50,000 or more for each violation, up to a Maximum of $1.5 million for identical provisions during a calendar year.

Note that fines have gone well above these limits: Advocate Health System: $5.55 million. CIGNET: $4.3 million. N.Y. Presbyterian Hospital/Columbia University: $4.8 million (N.Y. Presbyterian hit again for $2.2 million 6 years later). Triple-S $3.5 Million. University of Mississippi Medical Center: $2.75 million. Oregon Health & Science University: $2.7 million. Plenty of others have paid the $1.5 million and above.

There have been prison sentences and terminations to consider: 6 doctors and 13 employees of UCLA Medical Center were fired for merely looking at Britney Spears medical records when they had no legitimate reason to do so. Better to look at her album covers and not kill your career.


DO encrypt ALL patient information. Data should automatically encrypt when it’s backed up to the cloud, but you need to ensure that all data on your office network is encrypted as well. Faithfully encrypting your data makes some of the following irrelevant.

DON’T leave unencrypted data on mobile devices (laptops, iPads, iPhones etc.) Just ONE example: e theft of one of these devices with unencrypted ePHI incurred a $50,000 fine for a Hospice in Idaho. If found to have poor risk analysis and office policies, like a Massachusetts Eye and Ear Infirmary, fines could reach $1,500,000.

DO take care with passwords: Make them hard to guess (1234 or 4321 just doesn’t cut it) – make it easy for YOU to remember: ‘My anniversary is May 23’ becomes Mai523 – it’s harder to crack, plus you’ll never forget your anniversary. Don’t write them down, share them or use the same password for everything, because when cyber thugs crack it, they have the keys to your kingdom and the looting begins.

DO take notice of ANY email anomalies: If something is off, different than the norm, a red flag needs to go up – a different format for a vendor; if there’s a link or attachment where usually there isn’t one, for example in a PDF file; any message from within your company that is unusual – someone may have spoofed (copied) the email address. THINK TWICE before clicking any links or attachments!

DO keep all patient data safe, whether on paper or on the network. Nothing left in an unattended area, on a copy machine, fax and particularly at the reception area. You need to protect patient information in every format, no matter where it is.

For a complete list, please visit cyber-security-dos-and-donts/ In all honesty, many medical professionals don’t seem that concerned about HIPAA, but you should be. Once you’ve been stung by a massive fine, you are on the OCR’s radar, which is not a good place to be. Aside from chipping away at the profitability of your practice, neglect of any kind will negatively impact your reputation. It takes no more to be HIPAA compliant than it does to ensure that your network, in general, is secured against attack. Don’t wait for theft or a Ransomware lockdown of your data to cause you to act. An ounce of prevention is, after all, worth a pound of cure.


This article was written by David Mercy the Director of Business Development for IT Support LA If you would like to contact David you can give him a call at 818-797-5302.

Read More
Is your receptionist driving away new patients?

A few weeks ago, we released an article, “Your office is part of your marketing.”  This article touches on the general topic of branding your practice.  Every time a patient interacts with your practice it is an opportunity to brand your practice. What does someone experience when they walk in the door? How about when they call on the phone? How knowledgeable are the responses to questions they ask? What is their experience like? Is it professional? Is it consistent?

We help practices generate new leads but what happens to those leads when they pick up the phone and call the office? Is your staff trained to convert those new leads into patients? Updating your website for conversion optimization drives more leads but how can you increase you conversion rate inside the practice?

One of the elements we integrate into nearly all healthcare marketing campaigns is call tracking. When integrated properly, call tracking provides a great deal of information about whether your marketing is working or not. We can use call tracking to help understand which campaigns are generating leads and what types of leads they are generating. Another benefit is that our call tracking system allows us to listen in on recorded phone calls between new patients and healthcare staff.  From reviewing hundreds of these calls, we have noticed a few insights that, if correct, will help you convert and retain patients.

  1. Have a real person answer the phone.
    Sometimes in small offices, this can be difficult but we encourage all offices to have a real person answer the phone.  Patients calling in expect to be able to ask questions and schedule an appointment. If they are forced to leave a message, 7 out of 10 times they won’t.
  2. Ask for the sale.
    Often, in an attempt to be nice, the receptionist or person answering the phone does not attempt to close the sale.  This person may give away too much information and scare the patient or they may act indifferent about whether the patient schedules an appointment or not.  In our review of healthcare practices, we have seen that many receptionists are not trained salespeople but they are serving in that role. Invest in some basic sales training for this person and you won’t be sorry.
  3. Be helpful.
    It is shocking the number of practice representatives that appear to be burdened by a patient call. A patient calling in is great news because they are interacting with the practice.  Be friendly and helpful. Find a way to help solve their problem.  You can listen in on the conversations between your receptionist and new patients. Is that how you want your patients to be treated? If not, change it.
  4. Be knowledgeable.
    Many practices have a receptionist that takes calls.  Unfortunately, this representative also is forced to field difficult and technical questions. It is important to have a knowledgeable representative on the phone that can quickly and efficiently answer questions.  If that is not an option for your practice, it may be a good idea to have a hygienist or doctor on call to be able to take over the call in a more complex situation. If you have someone on the phone saying I don’t know or I can’t answer that, this reflects poorly on the practice. The receptionist needs to know what to do or say in each situation. Whomever is on the phone needs to be confident in their responses to questions.
  5. Be available.
    Let’s face it, some practices have strange hours. For the average patient, it is difficult to understand when the office will be open or not. If you have work-friendly hours, that is great. If you are closed every Monday or Friday, that can be a problem for some people. We have found patients often will delay care because they have a hard time remembering to call during certain hours.  In fact, when we monitor healthcare lines, we see a great deal of non-emergency call activity early in the mornings and between 5PM and 7PM in the evenings. Unfortunately, most practices are not available during this window. Even worse, many offices don’t answer the phone during the traditional 12:00PM – 1:00PM lunch hour, which is the highest volume time for calls for many practices.  Worst of all, we have discovered through our call analysis that patients are extremely reluctant to leave a message for the healthcare practice.  Instead, they will call back at a later time. If it is a first-time caller, they will likely call the next practice they find in their Google search and book an appointment with them.

These are just a few tips on how you can improve your new patient conversion and existing patient satisfaction. As always, each practice is different but the concept of creating a positive and consistent patient experience applies to all practices.  Review these tips and implement them and I guarantee you will have more and happier patients.

If you read this article and are interested in utilizing our call tracking system, feel free to contact us. It is very affordable and can help track the success or failure of your print and online marketing.  The recordings can also be a great sales training tool to help understand and advise your staff on how to better interact with patients.



Read More
The #1 best way to generate more new healthcare patients from your website

At Zipline, we spend a lot of time testing new ways to generate more business for healthcare practices.  While there are always some sort of hot new method to experiment with, if you are really looking to generate new patients, conversion optimization is the first place we recommend you focus.

What is Conversion Optimization?
Conversion optimization is the process of making minor changes to a website to see if they increase the percentage of traffic that contacts you or make a purchase.  This can be a difficult process for an inexperienced marketer but it is very much worth the effort. If you are new to conversion optimization, there are a variety of tools like Google Analytics, CrazyEgg, and Optimizely that can help.

Can you explain it in a way I can understand it?
Many practices aren’t excited by the idea of conversion optimization, but I guarantee if you spend the time to optimize your site, you will be excited by the results. Every dollar spent optimizing the conversion rate of your website amplifies the value of each marketing dollar spent afterwards.  Say for example, you have a conversion rate of 2%.  If you spent $500/month on marketing and got 1000 visitors that would translate into 20 patients, not bad.  If you wanted to grow to 40 patients you would need to spend $1000 dollars each month. You might say, not a big deal if the revenue from the patients is covering the cost. But let me show you what you can expect from a good conversion optimization campaign.

So what should I expect?
Imagine if you spent some time optimizing the conversion rate of your website.  A well-optimized site could have a much higher conversion rate.   What if we spent time optimizing the conversion rate of the site increasing it from the 2% to 5%.  In one month, with the same exact marketing budget, the website would generate 50 new patient leads. If you doubled your marketing budget as mentioned previously, you would reach 40 new patients. After spending time executing a conversion optimization strategy the same increased budget would yield 100 new patients in the same amount of time.

In this example, with a non-conversion optimized website you would spend $12,000/yr in marketing and generate 480 new patients, not bad. If you optimized for conversions, you could spend $6,000 and generate 600 new patients. So if you were to spend $12,000/yr after optimizing, you would pull in a whopping 1,200 new patients with the same exact marketing budget as if you didn’t optimize.

If it’s so easy, why doesn’t everyone do this?
Because it isn’t easy and most people don’t know about conversion optimization or its compounding effects.

So where do I start?
There are a number of great articles on conversion rate optimization online.  Take a look at some of those and don’t worry if they aren’t healthcare specific. While there are some healthcare specific conversion optimization practices, many of the methods you’ll find in these blogs span multiple industries and will work for any website. Also, if you would like assistance with your conversion optimization, we can help.  We even offer a a free healthcare website conversion rate analysis that you can take advantage of.  It will help you identify low hanging fruit you can focus on immediately.  During our free consultation, we will provide you with a list of tools you can use to better track your conversion rate.


Read More
Why a post visit survey is a great marketing tool for healthcare practices

Many practices frown on the idea of a post-visit survey.  Many feel that it will inconvenience their patients or take too much time from staff.  Others are just not interested in getting true feedback from their patients.

We believe that patient surveys are a great tool both for gaining insight into how patients view your organization and for extending your relationship with the patient.  Surveys don’t have to be long and daunting, they don’t even have to be on paper.  Today, a practice can create a short email survey using a free or low priced tool like Survey Monkey. You can even set the survey up to be anonymous so the patient is comfortable giving true feedback.  Using a digital survey also removes the need for staff to tally the results.  You can log into your survey account at any time and see statistics on response trends.  You can also read the individual survey responses if you want to dig deeper into how patients feel about your business.

While a survey can take time from both the practice and the patient, it also comes with a number of benefits. We have listed some of the biggest benefits below:

  1. It will help understand how your staff and practice are performing.
  2. It shows patients they matter and you care about their experience with your practice.
  3. It helps set a framework for extending your relationship with your patient outside of the office visit.
  4. It can be another opportunity to inform patients about your email list or social media accounts. You can even offer built-in opportunities to connect. This works great because they are taking the survey on some sort of device where it is easy to link to these other services.
  5. It can provide an opportunity to request online patient reviews.  These are critical for your local search engine optimization and they are hard to get.  We find that often people will leave them as an extension of the survey.
  6. It can provide you with insight into how your patients found your office.
  7. Patients can provide critical feedback that can help your practice better compete with other practices they have interacted with.  You also have a chance to respond to negative feedback before it translates into negative online reviews!

These are just a few of the biggest benefits we have found to patient surveys.  If you still aren’t a believer, we suggest you give it a try anyway.  We challenge you to collect 25 survey responses and tell us you don’t see the value in surveying your healthcare patients post visit.

Read More
How to get more online reviews for your healthcare practice

Online reviews are incredibly valuable in the healthcare marketplace.  If you are reading this post, it is likely you are already aware of some of the benefits of online reviews. But if not, I list a few of the biggest so that we are all on the same page.

  1. Online reviews are a fairly significant part of the local search algorithm used by Google and Bing when determining how your practice should rank for local search terms like “Your City dentist” or “dentist in Your City.”  While reviews aren’t the only factor, they do play an important role.
  2. They help users make decisions.  In the old days, people would ask a trusted friend who they used for healthcare care. Today, those same verbal recommendations occur, but they are often happening on social media.  Responses often come with tags or links connecting your practice’s website or Facebook profile directly with the person asking. Often, these users will dig deeper and a practice with many positive reviews is more likely to get the business. Also, Facebook will draw attention to other friends that have reviewed or like that business so it provides an additional opportunity for people to receive more peer validation of their choice of practice.
  3. Instead of asking a friend in person or on social media, potential patients will search the Internet for a practice in their area.  When they have found potential candidates, the online reviews help them decided which practice is the best fit.

The advice, positive or negative, from a friend or even a stranger, has a great deal of influence over their selection of a provider.  So how do practices get more reviews? Below we have outlined 3 quick tips for getting more reviews.

  1. Make it easy! Oftentimes we will find practices requesting reviews from patients but they aren’t indicating how or where the reviews should be made.  We suggest creating a list of a variety of locations like Google, Yelp, BBB, or Bing where patients can leave reviews.  The benefit to having a list is that many of your patients will have an account at one of the options already so they can choose the option that is the easiest for them. It is also helpful to provide links to the exact profiles. When it is just one-click-away, it’ll prevent users from getting distracted or confused during the process.
  2. Ask in person.  We have found that asking a patient in person to leave an online review significantly increases the likelihood they will do so.  It also opens up the opportunity for honest feedback if the patient had a lackluster experience.  This approach could come from the practice, a hygienist, or the front desk scheduler.  Having the campaign flyer listed in tip 1 helps to make sure that the person remembers to review your practice at a later date and time when they have the margin to do so.
  3. Ask when they have margin.  Your patients are in a hurry to get out of the office.  They may have good intentions to review your practice, but they may not have time immediately and once they get back to normal life they likely will forget about your conversation.  Find a way to collect the email address of an interested patient and put them on a mailing list.  Have the mailing list follow-up at about 7PM that evening with a personalized email, and then maybe again in about 5 days. This will give them a couple of nice friendly reminders at a time of day they are likely to have the margin to spend a few minutes helping your practice.

Bonus idea: Make it a part of your office exit, i.e. Exit Quizzer.  We have developed a small quiz program that can be run on a computer in your office. When a user is waiting to complete their billing process you can have them answer a few short questions. If their overall response is positive, the system will give them the ability to provide an online review. It will display on screen some of the most popular locations for the user to provide a review and allow them to step through the process online on that machine while they’re still in the office.  This system allows your practice to get real-time insight into your patient’s experience at the practice while also helping to generate online reviews.  If you are interested in learning more about an Exit Quizzer subscription, you can contact us.

These are just a few ways to help increase your lead totals.  Each practice is different and the flow of patients through your practice may impact how you implement these ideas. Hopefully, they will work as well for your practice as they have for our healthcare clients.


Read More
Your office is part of your marketing

At Zipline, we are firm believers in the importance of branding for a healthcare practice. In our opinion, every aspect of your marketing and patient experience should work together to create a consistent flow and image of your practice for your patients.

We have seen many healthcare practices who have a beautiful, modern website which creates the impression that you will be visiting a high-end health spa. But when a new patient arrives, the office is in a strip mall in the bad part of town and the interior of the office looks like a dirty old retirement home.  This same disconnect can also occur in reverse.  You could spend a great deal of money creating a luxurious office with high end service, but your website or marketing material fails to convey that to potential patients.

Both of these scenarios are likely to result in a negative impact to your practice.  In the first scenario, you are likely to lose the customer because they thought they were buying a Lexus and got a rusty Schwinn. In the second scenario, the rare customer that makes it to your practice will be pleasantly surprised but the bulk of the people that visit your website won’t bother to give your practice a try, instead, opting for the provider down the street.

How do we know if we have a problem?
Be honest with yourself.  Is your office visually appealing? Does it feel clean? Does it feel safe and inviting? If the answer is no to any of those questions, you need to address the problems immediately and then move on to the next advice.  If you answered yes, then you need to examine your marketing to make sure that your website and other collateral material convey the same message. If your office has a rugged outdoor feel, then your website and marketing should mimic this experience pulling the colors and design elements from your theme. Or if your office is modern and techy, then your website should have the same modern feel. This helps patients select a healthcare experience that is going to be a good fit for themselves and/or their families.

Does it really matter?
Setting expectations is important.  A patient that enters your office with realistic expectations is much easier to please.  We recently encountered a practice who was not setting realistic expectations for her patients.  This resulted in some really awful online reviews.  One of the reviews said, “xxxxx dentistry looks good online, but my visit was worse than going to Tijuana to see a dentist.”  The review went on to describe how the office was dirty and the staff was unprofessional.  Online reviews like this can be incredibly damaging.  Each month, over 150 people were viewing the profile for which you could find this embarrassing review. This 150 people is a mixture of potential patients and existing patients both of which can be easily convinced to go elsewhere for care.

To make matters worse, this review was just one over nearly a dozen similar reviews that all indicated how horrible the office experience was at this healthcare office.  At this point, burying these reviews will be difficult.  The negative patient experience has caused long-term damage to the marketing of this healthcare office that will be very, very difficult to repair. Don’t put yourself in the same position.

How do we fix it?
For each practice, the steps are a bit different.  Start by analyzing your office experience. Ask for feedback from patients and listen to the feedback they are already giving you.  Invest in creating a consistent experience at every touchpoint between your practice and your patients.

Most importantly, make sure that what you are marketing is what you are providing.  Don’t have a spa-like website if that isn’t the type of care you provide.  Make sure that your website and marketing materials match closely with the experience patients will have at the office, and make it personalized.

Read More
escort bursa