As an SLP, I see these struggles firsthand. It’s easy to feel like we’re fighting a losing battle against screens, instant gratification, and a perceived societal slide. But what if these feelings, while valid, aren’t actually new? What if the “kids these days” lament is as old as the institution of schooling itself?

This question sent me down a fascinating rabbit hole into the history of education, specifically the turn of the 20th century (roughly 1890-1920). It was an era of immense change: industrialization, urbanization, mass immigration, and the rapid expansion of public schooling. And guess what? Teachers then were airing strikingly similar grievances.

Far from a silent golden age of respectful, diligent students, historical records reveal a different picture. Teachers, often young women, were facing packed classrooms of diverse learners. They battled daily with issues that sound eerily familiar. Our panic about generational language issues is definitely not new.

Generational Decline Then vs. Now: Specific Examples:

Let’s break down some of those “turn of the century” complaints and see how they mirror our present-day struggles. You might be surprised by how little the core issues have changed, proving that today’s “brain rot” in youth is not new:

The Loss of Conversation: From “Cheap Novels” to Cellphones

• Then (c. 1900): Teachers and parents feared students were wasting their minds on the era’s new, pervasive, and easily accessible media: cheap fiction novels and sensational newspapers. They worried these “over-stimulating” print materials were corrupting the youth, pulling their focus from family interaction, academic study, and proper social conversation. The concern was that constant private reading would lead to social isolation.
• Now (c. 2020): We lament that cellphones, social media, and gaming have captured student attention, leading to a decline in face-to-face social skills, difficulty maintaining eye contact, and a loss of focused conversation. The fear is that the screen is isolating students and killing their ability to communicate in depth.
• The Constant: The Loss of the Shared Social Space. Adults worry when youth attention is captured by a new, easily accessible, and unsupervised medium that pulls them away from traditional, adult-sanctioned interaction. The anxiety is identical: a new technology is diverting youth attention and killing conversation and focused thought.

The Scourge of Slang: Language Decay Myth

• Then (c. 1900): Educators constantly fought against the “corruption” of the English language through slang and regional vernacular. This informal street language and emerging youth culture were viewed as a sign of poor intellectual discipline, illiteracy, and a direct threat to proper grammar and vocabulary in the classroom.
• Now (c. 2020): We worry about “brain rot” manifested as students using acronyms, “text-speak,” and minimalist language. We view the over-reliance on AI for writing and shorthand communication as proof of intellectual laziness and a devastating decline in the ability to construct a coherent, sophisticated sentence.
• The Constant: The Linguistic Turf War. The older generation, which defines the “rules” of language, feels threatened by the rapid, creative, and efficient linguistic innovations of the youth. What one generation views as degradation, the younger often sees as efficiency, social belonging, and evolution. The adult disapproval of the change is a constant fixture of the generational divide.

The Battle for Attention: “Unruly” vs. “Distracted”

• Then (c. 1900): Teachers complained vociferously about “unruly” and defiant older boys, especially in mixed-grade rural schools, who would openly challenge authority, flirt, or cause general disruption. Maintaining order often required corporal punishment. Students struggled with the monotonous rote memorization that defined much of the curriculum.
• Now (c. 2020): We lament short attention spans, the constant pull of phones, and students who seem unable to focus on a single task for more than a few minutes. Teachers battle apathy and a perceived lack of respect.
• The Constant: The younger generation naturally resists methods and structures they find unengaging or authoritarian. Their attention is drawn to dynamic, personally relevant stimuli – whether that was pushing boundaries with a teacher or scrolling through TikTok. The expression of disengagement changes, but the root of it often remains the same: a mismatch between intrinsic motivation and imposed task. Analyzing the history of social change shows the fundamental challenge remains the same: engaging the student.

Competing Demands: “Farm Work” vs. “Side Hustles”

• Then (c. 1900): A major headache for teachers was chronic absenteeism due to child labor. Kids were pulled from school for weeks at a time to work on farms during planting/harvesting seasons or to contribute to family income in factories. Their primary focus was often outside the classroom.
• Now (c. 2020): While child labor is (thankfully) not the same issue, teachers still face students who prioritize outside commitments – part-time jobs, demanding sports schedules, extensive extracurriculars, or even gaming – over schoolwork. Their energy and focus are split.
• The Constant: Life outside school has always competed fiercely for students’ time and mental energy. The “teacher’s priority” is often just one of many, and not always the dominant one, in a young person’s life.

The “Degradation” of Language & Skills: From “Rote” to “Rot”

• Then (c. 1900): Progressive educators and frustrated teachers argued vehemently against the prevailing rote memorization model, believing it failed to teach students practical skills, critical thinking, or genuine understanding. They believed students weren’t truly learning what they needed for the modern world.
• Now (c. 2020): This is where the “brain rot” and language degradation arguments truly hit home. We worry about students’ inability to write coherently, their reliance on text-speak, AI for essays, or their struggles with complex reasoning. We hear, “They just can’t think anymore!”
• The Constant: Every generation defines “essential skills” and “proper language” by its own standards. What one era sees as practical, another sees as outdated. What one generation considers a conversational shortcut (e.g., shorthand in the early 1900s, texting abbreviations today), another deems a symptom of intellectual decay. The anxiety around changing communication styles and perceived declining rigor is a generational echo.

The Original Brain Rot: Luxury and Contempt for Authority

“The children now love luxury; they have bad manners, contempt for authority; they show disrespect for elders and love chatter in place of exercise. Children are now tyrants, not the servants of their households. They no longer rise when elders enter the room. They contradict their parents, chatter before company, gobble up dainties at the table, cross their legs, and tyrannize their teachers.”

• Then (c. 4th Century BC): The greatest thinkers of Ancient Greece—Socrates, Plato, and Aristotle—complained extensively about the youth. While this famous viral quote is often misattributed (it was actually penned in 1907), the sentiment of generational language panic is real. Scholars even then complained about the decay of the youth. Critically, Socrates was famously executed, in part, for the crime of “corrupting the youth” by teaching them to question their elders and the established order.
• Now (c. 2020): These are nearly verbatim the complaints you hear today. Students are seen as entitled, unwilling to follow rules, glued to their phones (chatter), and disrespecting traditional structures. The modern equivalent of “corrupting the youth” is the anxiety over teaching critical race theory or complex social justice issues—anything that encourages students to question and critique the beliefs of the previous generation.
• The Constant: The Fear of the Successor. The oldest generation’s deepest fear is that the rising generation will reject the hard-won values, discipline, and institutions they built. In every era, teaching youth to think differently than the previous generation is perceived by some established adults as the ultimate act of “corruption.”

The Underlying Force behind “Brain Rot” Myth: Generational Tension

What these historical parallels underscore is not a continuous, linear decline in human intellect or student quality. Instead, they point to a fundamental, ever-present phenomenon: generational tension.

This tension isn’t about one generation being inherently “better” or “worse” than another. It’s about:

• Different Lived Experiences: Each generation grows up in a unique technological, social, and economic landscape, shaping their worldviews, priorities, and learning styles.
• Mismatched Expectations: Educators, as members of an older generation, naturally teach and assess based on the norms, skills, and values they were taught. Students, operating within their own contemporary reality, respond differently.
• The Nature of Youth: Youth, by its very nature, involves questioning, exploring, and pushing boundaries. This manifests as “unruly” behavior or “distracted” minds, depending on the era’s context.

Adapt instead of panic: Generational Language

So, the next time you feel that pang of despair about supposed “brain rot” or the state of modern education, take a deep breath. Acknowledge the very real challenges we face today – screens are powerful distractors, and mental health is a major concern. But also, take solace in knowing that you’re part of a long, distinguished lineage of educators who have felt similar frustrations.

Our job isn’t to bemoan the “decline,” but to understand the nature of this perennial generational tension. By doing so, we can shift our focus from complaining about what students aren’t to creatively finding ways to meet them where they are. We should adapt our strategies, and leverage their unique generational strengths to foster true learning.

For us as SLPs and educators, this historical context shifts our job description. Instead of fighting text-speak, we can view it as a linguistic window. We can use our expertise to bridge the gap between efficient social language and sophisticated academic language. Our goal remains the same: fostering effective communication across all contexts.

The kids aren’t “brain rotted”; they’re just kids, living in their time, and challenging us to evolve, just as kids have always done.

Want to learn more? See these posts:

• Middle School Language Development: What They Don’t Know May Surprise you!
• Beyond “Spill the Beans”: Why Teaching Idioms Needs a Modern Glow-Up

Leave your thoughts!

What historical or modern “kid complaints” resonate most with you? Share your thoughts in the comments below!

Further Reading:

• https://www.pbs.org/onlyateacher/timeline.html
• https://www.encyclopedia.com/social-sciences/culture-magazines/1910s-education-topics-news
• https://nces.ed.gov/pubs93/93442.pdf
• https://www.rd.com/list/what-school-was-like-100-years-ago/
• https://historyhustle.com/2500-years-of-people-complaining-about-the-younger-generation/
• https://slate.com/technology/2017/08/the-19th-century-moral-panic-over-paper-technology.html

The post The Generational Language Panic: Why ‘Brain Rot’ is as Old as Education appeared first on Mrs. Speech Online.

In Post 4, we saw how AI can be your clinical sidekick—sparking lesson ideas, streamlining documentation, and tackling admin tasks. SLP AI prompt writing is essential for maximizing these benefits. But here’s the truth: AI is only as good as the conversation you start. The magic isn’t in its existence; it’s in how you wield it.

Think of AI as an incredibly intelligent, but frustratingly literal, intern. It operates on your instructions. This is where AI prompt engineering for SLPs comes in—the art and science of communicating effectively with large language models (LLMs). The better your prompt, the more tailored, useful, and relevant the AI’s output will be.

🛑 STOP! The Golden Rule: PHI and AI (Crucial Disclaimer)

Before we dive into prompt perfection, let’s firmly reiterate the absolute necessity: NEVER, EVER input Protected Health Information (PHI) or any client-specific identifying data (such as names, baselines, unique characteristics, or highly specific details that could lead to identification) into general-purpose AI models like CoPilot, ChatGPT, Bard/Gemini’s public interfaces, or similar tools that do not have a specific Business Associate Agreement (BAA) with your organization covering PHI.

Your company’s specific guidance on compliant AI use (especially for integrated tools like Google Workspace’s Gemini) is paramount. Always, always, always prioritize client privacy and confidentiality.

Ready to unlock AI’s full potential? Let’s refine your prompting skills!

6 Principles for Mastering AI Prompts for Speech Therapy

To get the most out of AI, keep these essential principles in mind:

1. Clarity, Conciseness, & Specificity

Vague input equals generic output. The more targeted your request, the more tailored and useful the AI’s response.

• Vague: “Give me therapy ideas.”
• Specific: “Generate 5 engaging speech therapy activities for 7-year-olds working on initial /s/ blends, suitable for a 30-minute session, using a ‘superhero’ theme. List required materials for each.”

2. Assign a Persona (Role & Context)

Tell the AI who it is (e.g., “Act as an experienced pediatric SLP”) and provide relevant background. This is arguably the most crucial step! By assigning a role, you’re pulling from a specialized language subset, which drastically improves the quality and relevance of the output. This is key to effective SLP AI promts.

• Generic: “Write a lesson plan.”
• Contextualized: “Act as an experienced pediatric SLP working in a school setting. Create a 45-minute lesson plan for a small group of 2nd graders targeting narrative language skills, focusing on sequencing events and character emotions. Include a clear objective, suggested materials, step-by-step activities, and differentiation ideas.”

3. Define Output Format & Length

Don’t leave the output format to chance. Tell the AI exactly how you want the information organized (e.g., bullet points, table, short paragraph, email draft).

• Unspecified: “Tell me about dysphagia.”
• Formatted: “Summarize key differences between oral phase and pharyngeal phase dysphagia in a bulleted list, suitable for a 1-page handout for speech therapy graduate students.”

4. Specify Constraints & Exclusions

Tell the AI what not to include, or what limitations to follow. This helps filter out irrelevant or inappropriate information for your client’s needs.

• General: “Give me articulation sentences for /l/.”
• Constrained: “Generate 10 articulation drill sentences for initial /l/ sounds for a 4-year-old, but exclude any words related to food or animals, and ensure sentences are no more than 5 words long.”

5. Iterate & Refine (It’s a Conversation)

Prompting is rarely a one-shot deal. Think of it as a Socratic dialogue—start with a broader request, then refine the AI’s initial response with follow-up instructions until you hit perfection. This process of refining AI prompts for SLP output is essential.

• Iteration Example:
  • You: “Give me goals for preschoolers.”
  • AI: (Provides very general goals)
  • You: “Okay, now make those goals SMART goals for receptive language, focusing on following 2-step directions.”
  • AI: (Provides more specific, measurable goals)

✨ Pro-Tip: Meta-Prompting (Make AI Write Your SLP Prompts)

If you are struggling to craft a detailed prompt, turn the tables and ask the AI to help you! This is a fast track to using all the principles above without having to think of every detail yourself.

• Prompt to Refine Your Prompt (Ask for Clarification): Use this when you have a good idea, but aren’t sure what specific details the AI needs, or are unsure if you’ve thought of everything.
  • “You are an expert prompt engineer for speech-language pathology. I want to create a 30-minute therapy plan for a 5th grader working on figurative language. Based on this goal, ask me 5 questions to clarify what you need to write the perfect, detailed prompt.”
• Prompt to Generate a Prompt: Use this to ensure your request includes all the necessary components (role, format, constraints).
  • “Act as an AI prompt expert. Write a detailed, effective prompt that will generate a handout for parents explaining the difference between an articulation disorder and a phonological disorder. The final prompt must include a specific role, a format, and a suggested reading level.”

6. Consider Tone & Audience

If you’re drafting communication for others, specify the desired tone and intended audience.

• Prompt Example: “Draft a short email to a general education teacher explaining the process of a speech-language screening, using a friendly and informative tone, and inviting them to share any initial concerns.”

Applied Prompt Engineering: AI Strategies for Common SLP Tasks

Let’s apply these principles to the types of tasks that eat up your time, including those that help you build materials! These strategies lead to time-saving AI prompts for SLPs.

Therapy Ideas & Lesson Plans:

• Include: Client age/grade, specific speech/language goal, preferred theme, session length, group size, required materials you have on hand.
  • Example: “Act as an experienced SLP. Create a 30-minute narrative therapy session for a group of three 3rd graders working on story grammar (characters, setting, problem, solution). Use a ‘detective’ theme. Include warm-up, main activity, and cool-down. Suggest print-and-go materials and a simple data collection sheet format.”

Goal Wording:

• Specify: Skill area, target population, desired components (e.g., SMART goals, specific measurable elements), context.
  • Example: “Generate 3 measurable, long-term speech therapy goals for an elementary student working on pragmatic language skills, focusing on initiating conversations and turn-taking, suitable for an IEP. Then, critique each goal for measurability and compliance.”

Content Adaptation & Materials Creation:

• Key Components: Original content (paste or summarize), target audience, desired reading level, specific language features to focus on.
  • Example (Great for TPT!): “Generate a simple 4-page articulation resource for initial /k/, suitable for a third-grade reading level. Format the content as three short reading passages followed by comprehension questions.”

Task Analysis / Prompt Hierarchies:

• Clearly define: The skill to be broken down, the target age/developmental level, the desired number of steps, and the type of prompting.
  • Example: “Provide a detailed task analysis for teaching a 5-year-old to correctly produce 3-4 word sentences using correct subject-verb agreement. Include 5-7 steps and suggest different levels of verbal and gestural prompts for each step.”

Administrative Tasks:

• Be precise about: The type of document, the data you’re working with, the desired function, and the output format.
  • Example: “I need an Excel formula. I have a list of dates in Column A and attendance marked ‘P’ or ‘A’ in Column B. Give me a formula to count the total number of ‘P’s for the month of March in Column C.”

⚠️ The Guardrails: Where AI Falls Short for SLPs

While AI is a powerful assistant, it’s crucial to understand where its current capabilities fall short. Remember that even with the most effective SLP AI prompts, your clinical judgment is irreplaceable.

• Phonetics and Articulation Nuance: AI operates on text strings, not the underlying speech sounds, articulatory placements, or distinctive features. It can’t “hear” a velar fronting error. This means word lists for specific phonetic contexts (e.g., specific minimal pairs, /r/ contexts) often miss the mark. Always check its work!
• Age/Grade Level Nuance for Language/Vocabulary: While AI can attempt to “simplify” language, its understanding of developmental language milestones, typical vocabulary acquisition, and the subtle nuances of age-appropriate content, syntax and semantics can be limited. Always review carefully for true developmental appropriateness.
• Clinical Judgment Remains Yours: AI lacks clinical reasoning, empathy, and the ability to interpret non-verbal cues or individual client needs. Its output is based on patterns in the data it was trained on, not genuine understanding of a client. Your license, and your client’s well-being, is your responsibility.

The Empowered SLP: An AI Prompting Pro

Mastering prompt engineering is the final step in turning AI from a simple chatbot into your powerful, personalized SLP assistant. This skill won’t replace your expertise, but it will save you time, spark creativity, and allow you to dedicate more of your precious energy to what matters most: the art and science of speech-language pathology. Start experimenting with SLP AI prompt engineering today!

Want a quick reference to help you on your AI prompting journey? This visual provides a 6-step, hierarchical template that teaches SLPs how to define the role, constraints, and format needed to get accurate, clinically relevant output from AI. Only available to Subscribers!

In Post 6, we’ll explore specific AI tools and platforms that SLPs can safely and effectively integrate into their workflow (always with the BAA and privacy rules in mind!).

Next in the Series

• Part 1: AI & Clinical Data Privacy
  • This foundational post explores AI training data, client privacy, and HIPAA compliance for SLPs, including the non-negotiable role of BAAs.
• Part 2: Separating AI Truth vs Myth 
  • We debunk common AI myths in SLP practice. Get a realistic understanding of AI’s true role and capabilities.
• Part 3: How AI Tools Work 
  • Get a clear, jargon-free explanation of how large language models function. Understand their capabilities and limitations.
• Part 4: AI for Clinical Spark & Efficiency
  • Discover ethical ways to use AI. Brainstorm, overcome planning hurdles, and refine non-clinical communications.
• Part 5: Mastering AI Prompts (this post!)
  • Learn prompt engineering. Communicate effectively with AI models to get tailored, useful results for SLP needs.
• Part 6: Compliant AI Platforms & Tools
  • This post guides you through AI tools. Learn key factors for ethically and compliantly selecting platforms for your SLP practice.
• Part 7: Ethical & Responsible AI Use
  • This crucial post delves into broader ethical responsibilities for SLPs using AI. It covers principles beyond data privacy.
• Part 8: The Future of AI
  • This concluding post explores emerging AI trends and future possibilities in Speech-Language Pathology. Prepare to adapt, innovate, and lead responsible AI integration.

The post Mastering SLP AI Prompt Writing (AI & SLPs: Part 5) appeared first on Mrs. Speech Online.

Welcome back, fellow SLPs! In our last two posts, we tackled the crucial topic of AI and Clinical Data, as well as AI Truths & Myths. We learned that responsible AI use starts with safeguarding our clients’ privacy and understanding how AI works in practice.

We’ve debunked some common myths and explored the complex questions surrounding AI and data security. Now, let’s pull back the curtain and take a look at the mechanics room. In this post, we’ll demystify how AI tools actually work, providing a clear and simple explanation for SLPs.

Artificial intelligence can sometimes feel like magic, especially when it comes to generating coherent text for notes, therapy ideas, or reports. You type in a prompt, and seemingly out of nowhere, clinically relevant content appears. But behind this impressive capability lies a fascinating, albeit complex, system built on specific AI principles.

As SLPs, understanding the basics of how AI tools function is essential. It can not only alleviate some of the mystery, but also empower us to use these tools more effectively and with realistic expectations. So, let’s peek under the hood and demystify the mechanics of AI.

The Foundation: Large Language Models (LLMs)

To truly understand how AI works, you must first understand its base. At the heart of most AI tools you encounter that generate text are Large Language Models (LLMs). Think of these LLMs as incredibly advanced prediction machines for language.

They’re not thinking, feeling beings; instead, they are sophisticated algorithms. They are often built on a “transformer” architecture, that have learned to predict what word or sequence of words is most likely to come next. This ability to predict is the foundation of how they generate paragraphs, articles, notes, and even initial drafts of reports.

The Training Process: Learning from Text Patterns

The secret to this predictive power lies in the training process. LLMs are trained on truly massive amounts of text data – billions upon billions of words scraped from books, articles, websites, code, and just about any other digital text you can imagine. For models used in healthcare or clinical research, this could also include vast quantities of de-identified research papers, medical journals, and clinical guidelines.

During this training, the AI doesn’t process this raw text directly. Instead, it goes through a crucial step called tokenization.

What is Tokenization?

Tokenization is the process of breaking down the text into smaller, manageable units called tokens. These tokens can be whole words (“the,” “client”), parts of words (“-ing,” “re-“), or even individual characters or punctuation marks. The way text is tokenized can vary between different AI models, but the fundamental idea is to convert human language into a numerical format that the AI can process.

Think of tokenization like the raw data stream in the movie The Matrix. Instead of seeing words and sentences, the AI sees a constant flow of these individual numerical tokens. This numerical representation is the fundamental language that the AI understands and manipulates.

Each unique token in the AI’s vast vocabulary is then assigned a numerical ID. Therefore, AI operates at this granular level of tokens and learns statistical relationships between them. It doesn’t typically “hold” or store entire books, articles, or clinical records as copies. Instead, it retains the learned patterns and probabilities of token sequences.

How is Tokenization Used?

Once the text is tokenized and converted into these numerical representations, the AI analyzes this vast ocean of language, identifying patterns. It learns the statistical probability of certain tokens appearing together. This includes the common structures of sentences and paragraphs, and typical ways humans express different ideas in various contexts (e.g., academic writing, informal speech, or clinical documentation).

For example, the AI learns that after the tokens “Client” followed by “demonstrated,” the token “progress” has a very high probability of appearing next in a clinical note. It learns the statistical relationships between diagnostic terms and common intervention strategies.

It’s all about recognizing these statistical relationships between these numerical tokens. It’s crucial to remember that the AI doesn’t “understand” these relationships in the way a human clinician does. It doesn’t grasp the clinical meaning, the client’s emotional state, or the unique context of a therapy session. It simply recognizes that, based on the numerical sequences it has processed, certain token sequences are more probable than others.

Mechanics of AI Text Generation: Prediction in Action

So, how does this learned knowledge translate into generated text that can assist an SLP? Let’s discuss the AI principles at work. First, you give an AI a prompt – a request, a question, or even just a few keywords (e.g., “Draft a SOAP note for a 5-year-old with articulation goals for /r/”). Then, the AI first tokenizes your input.

After that, it processes its learned patterns and the numerical IDs of these tokens. It then predicts the most likely next token (represented by its numerical ID). This prediction is heavily influenced by the parameters of the LLM. Think of these parameters, often billions or even trillions, as the internal “knobs and dials”, like the Oz Wizard. The AI adjusts these during its training to learn the strength of the statistical relationships between tokens. The more parameters an AI has, generally the more nuanced and sophisticated its predictions can be.

The Output of the AI Machine

The AI takes that newly predicted token. It compares the original prompt and the token it just produced. Then it predicts the next most likely token, again relying on its vast network of parameters. This process continues, token by token, until the AI determines it has reached a stopping point. Finally, these numerical tokens are converted back into human-readable text.

Think of it like a super-powered version of the autocomplete feature you might use when typing. However, it operates at the level of fundamental text units, and is guided by an incredibly complex web of learned relationships stored within its parameters. The “creativity” or “clinical relevance” we sometimes see in AI-generated text isn’t true clinical reasoning in the human sense. Rather, it is the result of the sheer vastness of the data it has been trained on. It has learned the intricate statistical relationships between these tokens. It is all governed by its numerous parameters.

What AI Isn’t: Understanding the Clinical Limitations

Finally, it’s vital to reiterate what AI isn’t, especially from an SLP perspective. Even understanding the mechanics of AI, its human-like responses can often muddy the waters.

• It isn’t conscious. It doesn’t have emotions, personal experiences, or clinical judgment to draw upon.
• It cannot understand or provide the nuances of human communication. Sarcasm, irony, or the subtle emotional context of a client’s utterance are often difficult for AI to understand. They are even harder for AI to create (don’t ask it to generate jokes).
• It is limited in understanding highly nuanced linguistic elements like prosody, intonation, or specific phonetic realizations (e.g., truly hearing and analyzing a distorted /s/ or a lateral lisp). These areas are critical for SLP assessment and intervention, but challenging for current AI to grasp fully and accurately.
• It cannot build genuine therapeutic rapport or provide the empathetic connection essential for effective therapy.
• It cannot make a differential diagnosis or independently formulate a comprehensive, individualized treatment plan based on dynamic clinical interactions.
• AI can’t handle very large chunks of information. This is a significant limitation to remember, especially when working with long documents. More advanced and often paid AI versions, which are hopefully HIPAA-compliant, can process larger numbers of tokens.

Its output, however impressive, is ultimately based on the patterns it has learned from the text it has been trained on. You must remember that it is processed at the level of tokens and statistical probabilities, not genuine clinical understanding. You MUST always double-check output for accuracy, completeness, and bias!

Looking Ahead: Understanding AI as Your SLP’s Toolbox

Understanding the core mechanics of AI—that it’s a sophisticated text prediction machine built on statistical patterns—is the key to unlocking its potential without falling for the hype. This knowledge empowers us to see AI not as a magical entity, but as a powerful tool in our clinical process. It’s an assistant that can handle routine tasks, potentially allowing us to save precious time and redirect our energy to where it matters most: our clients.

Now that we’ve peeked under the hood, what are your initial reactions? Has demystifying AI’s inner workings changed your perception of its potential uses (or limitations) in SLP? Share your thoughts in the comments below, and then weigh in with your perspective in our quick poll! Results will be shared at the end of the series.

AI & SLPs Poll 3

I’d love to hear your thoughts after reading this post! Please answer these 4 questions; your valuable input will help shape my series’ final insights. To keep the poll fair and ensure unique responses, a Google account sign-in is required. Be assured, your email address is neither collected nor visible to me.

The AI & SLPs Series: Your Comprehensive Guide

Welcome to the AI & SLPs Series! Over the next eight weeks, we’ll delve deep into how Artificial Intelligence is shaping the world of speech-language pathology. Here’s what you can expect:

• Part 1: AI & Clinical Data Privacy
  • This foundational post explores AI training data, client privacy, and HIPAA compliance for SLPs, including the non-negotiable role of BAAs.
• Part 2: Separating Truth vs Myth 
  • We debunk common AI myths in SLP practice. Get a realistic understanding of AI’s true role and capabilities.
• Part 3: How AI Tools Work (current post)
  • Get a clear, jargon-free explanation of how large language models function. Understand their capabilities and limitations.
• Part 4: AI for Clinical Spark & Efficiency
  • Discover ethical ways to use AI. Brainstorm, overcome planning hurdles, and refine non-clinical communications.
• Part 5: Mastering Prompts 
  • Learn prompt engineering. Communicate effectively with AI models to get tailored, useful results for SLP needs.
• Part 6: Compliant Platforms & Tools
  • This post guides you through AI tools. Learn key factors for ethically and compliantly selecting platforms for your SLP practice.
• Part 7: Ethical & Responsible Use
  • This crucial post delves into broader ethical responsibilities for SLPs using AI. It covers principles beyond data privacy.
• Part 8: The Future of AI
  • This concluding post explores emerging AI trends and future possibilities in Speech-Language Pathology. Prepare to adapt, innovate, and lead responsible AI integration.

Stick around as we keep figuring out this whole thing together, giving SLPs the knowledge they need and helping us all find a balanced way to think about AI in the future of speech-language pathology. There is a lot of gray area and strong opinions, and I hope I can provide some facts to help you make informed choices that correspond with your own values.

Keep on clickin’!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post AI & SLPs Series, Part 3: How These Tools Actually Work appeared first on Mrs. Speech Online.

Motivators

Just like our younger clients, older students love a good reward at the end of a challenging session. The beauty? They’re experts at navigating YouTube, so they can easily cue up their favorite vids. But wait, there’s more! I love introducing them to some lesser-known gems that pack a powerful punch:

Flexible thinking and how the mind learns new things:

Backwards bicycle: this was mind-blowing to watch!

How mistakes are okay and help you learn:

OK Go Rube Goldberg Machine (I talk about how you can see the evidence of how many previous tries – 85 to be exact – they had to get it right, but how awesome it was when they got it right.  BTW, the song itself has a great message of how bad things are only temporary.) It’s also useful to see the TEDTalk on how it was engineered. (Caution, the TEDTalk has one minor cuss word and the band is having a drink of champagne at the end.)  If you don’t know what a Rube Goldberg machine is, it is a YouTube rabbit hole.  I warned you.

The Power of a Stutter

A TedTalk on how accepting your insecurities and even embracing them allows us to become better communicators.  How it frees us from worrying about hiding them to think about how we can speak to and help others. (BTW, she has a very noticeable stutter so this is an excellent video for your fluency students.)

Teaching Support

How to make sounds

I’m probably not alone when I say that I turn to these when I have a kid I just can’t get to make the sound, especially now that I am wholly teletherapy.  My camera just isn’t as professional as what I can find on YouTube.  The two best sources for sound instruction I’ve found are Sharon Turner, who has a animated video model of the tongue inside the mouth for each sound, and Peachie Speechie, who has great teaching videos for each sound.  But there are many, many options to choose from.

Read-Alouds

I’m using short stories in most of my older groups.  When we first read a story, I want it to be a dramatic, cohesive reading, so I actually don’t want the students to read it.  I want them to listen and be drawn into the story.   But you know, a day of that and my voice gets tired.  Cue YouTube read-alouds!  You can find an audiobook of most popular short stories on YouTube pretty easily.  And bonus – most you can turn on Closed Captioning so students can read-along if you don’t have a text that matches well.  And the students actually love being read to.  If I have a student who needs to read for a goal, then I can stop and have them read a paragraph or so, then return to the read aloud. I have playlists of some of my favorites at http://www.youtube.com/@Mrs.Speech-wk4mr.

Background Knowledge

To go along with the read-alouds, a well-made video to give background knowledge is worth so much more than me droning on about what life in a lighthouse is like.  You know what they say, “A picture is worth a thousand words.”  Well, a video must be worth a million, right?!  And they are so much more willing to watch a video than listen to me (and let’s be honest, it gives my voice a break).

Movies

And if at all possible, I like to find at least a clip of a movie or animation to go with the story.  It provides so many opportunities for language-rich discussion, with opinions (Which did you like better, and why?) comparing and contrasting, and inferencing (Why do you think the director made this change?).

Social Skills

There are SOOOO many social skills videos out there.  Some of them are tailored toward our autistic population, some are more for introverted young adults, and some are for the ESL population.  Don’t just stick to the videos that tell how-to do something.  Sometimes the awkward videos offer great teaching moments too.  This one is one of my favorites.  While I do touch on what he does wrong, I mainly use it to talk about other people’s responses, and how they are generally kind about it and make an effort to not make him feel bad even though everyone feels awkward.  People are typically kind, so you might as well go out there and try.

Pro Tips 

Now, I mentioned in Read-Alouds to turn on the Closed Captioning if you don’t have a text that matches the reading.  It might be useful to do so with the other videos as well, to make the speech/text connection and fill in any missing gaps in the auditory information.  

I also suggest you turn the speed to 75%.  This is usually not noticeable to the kids, but it allows them more time to process what is being said so they get a better understanding of the information.  

I have more tips in my previous post: Unlocking Language Learning with YouTube: A Speech Therapist’s Guide.

Update 12/24

I recently found the free internet browser Brave and have been using it the past couple of weeks.  It was simple to move my Google bookmarks into Brave, and I am using it solely for use with the kids, so it streamlines my therapy sessions too.  I haven’t had a single youtube ad, and I haven’t noticed other ads popping up on websites.  I will say that, while it does block the ad on a website, there is often still the space where the ad would be.  Often, a reader extension like ReadBee will remove those spaces and focus on the text.

So, there you have it, folks! These are just a few ways to leverage the power of YouTube in therapy sessions with older students. But hey, the possibilities are endless! Got some killer ideas of your own? Drop ’em in the comments below!

Until next time, my e-speechies – keep on clickin’!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post YouTube in Therapy: Engaging Older Students with Smart Strategies appeared first on Mrs. Speech Online.

Teleconferencing has become a significant part of many educators’ and therapists’ lives. While it presents unique challenges, it also offers incredible flexibility. Here are some essential teleconferencing tips and tricks I’ve learned during my time providing full-time teletherapy services to school-aged children:

Invest in a Second Monitor (A Big One!)

This is a game-changer! I use my laptop screen for the Zoom window, one side of the TV for displaying therapy materials (flashcards, videos, etc.), and the other side for my therapy portal (to track student goals and document sessions). I often have two windows that I screenshare, if I have a visual aid for the activity or am giving students choices between activities.  This also means you can keep your icons to a minimum on your tv desktop.

Read my post on Unlocking Language with Youtube for Youtube specific tips, such as Youtube settings and some invaluable playlists.  I also have a post Youtube in Therapy for Older Students.

You might need to adjust the TV height to prevent your laptop screen from blocking the view. Experiment with resolutions to find a comfortable balance between readability and screen real estate.

Prioritize Audio Quality

Invest in a good quality headset with a microphone. While your laptop’s built-in microphone and speakers may suffice, higher-quality audio is crucial, especially for working on articulation skills with young children. Encourage students to use headphones with microphones as well, which can help minimize distractions and keep them engaged.

Bonus remote meeting advice: Noise reduction features are often enabled by default in conferencing apps and computer settings. However, these algorithms can inadvertently cut off crucial sounds, such as the beginnings and ends of words, particularly fricatives like /s/. This can be incredibly frustrating when working on specific speech sounds. Ensure noise reduction is disabled on both your device and the student’s device.

Embrace Ad Blockers

Online resources like YouTube are invaluable for therapy activities, but those pesky ads can be disruptive. I highly recommend using an ad blocker. 

I personally use the free browser “Brave,” which effectively eliminates most ads, including those that appear within videos. It leaves a small white space where the ad would have been. As a bonus, using a dedicated browser for therapy helps keep your bookmarks organized and streamlined.

Turn Your Phone into a Document Camera

Many of us have accumulated a wealth of physical therapy materials over the years. Instead of letting them gather dust or (illegally) scanning them, repurpose them with a document camera. While there are some relatively inexpensive options out there, you can use your phone or another device to capture images or videos of your materials. (This is a great use for those older, unused devices, just connect them to your wireless connection). 

There are numerous online tutorials available to guide you through the setup process, although most are from the COVID epidemic so the technology may have changed somewhat.  I found this one particularly helpful. This is especially beneficial for teaching students using Augmentative and Alternative Communication (AAC) systems.  You might even consider asking for the same setup on the other side, especially if you are testing!

Background Leverage

Don’t just settle for a boring background! Get creative and use it as a teaching tool. You could use an underwater scene for a unit on ocean life, a construction scene for construction vocabulary.  Maybe you post a timeline for the session, or another visual aid.  

FYI – if you have your video mirrored (most of us do), it will appear backwards in your video view, but the right way on your students’ view.

I incorporate a “Pun of the Day” with a themed visual background to encourage flexible language use and explore multiple meanings of words, not to mention starting therapy off with a smile!  *whisper* I have a 56 pages of puns (21 pages of holiday-themed) in my TPT store – It’s So Punny!

Maximize Your Mouse Pointer

Enlarging your mouse pointer makes it easier to locate on the larger screen and improves its effectiveness for pointing out items to students.

Master Video Conferencing Tools

Explore and utilize the built-in tools within your chosen conferencing platform (Zoom, Google Meet, etc.). The whiteboard function is excellent for quick demonstrations and brainstorming, and many students prefer drawing on it to playing online games. The annotation feature allows you to draw or type directly onto any screen-shared content.

Lighting

You want good lighting so students can see your face well.  The room I use as my office is rather dark.  I’ve tried ring lights, and lamps, but they produce strong shadows unless they are low enough that I can’t really tell a difference in my camera, and even then they are rather blinding.  I’ve even tried facing them away from me, toward the wall behind the big screen.  The best solution I’ve found is dispersed light with multiple sources, pointing up or toward a wall, and thoroughly checking the video settings in both my computer and Zoom.  I’ll update with any other options!

Understand Your Students’ Setups

Before the initial therapy session, have a brief conversation with the student or their caregiver to understand their technology setup.

• Device: Are they using a laptop, tablet, or *shudder* a phone? The size of your share screen will differ according to the size of their device, so consider adjusting your materials accordingly.
• Input Methods: Do they have touch screen, trackpad, or mouse control? How comfortable are they with their chosen input method?
• Conferencing App Configuration: How is the conferencing app configured (e.g., speaker view, gallery view)? Will you be sharing your screen during the session?
• Environment: Are they in a shared space, and if so, what steps can be taken to minimize distractions (e.g., headphones, quiet corner, clear communication with other household members)?
• Internet Connectivity: Briefly inquire about their internet connection to anticipate potential connectivity issues. For example, if they have a slower connection, you may want to consider activities with a lower bandwidth demand, such as games or activities that don’t rely heavily on video.

Student Support System

• Adult Supervision: For safety reasons, it’s crucial to ensure that an adult is always present and supervising the child during teleconferencing sessions.
• Behavior Support: Do they have any behavior support available during sessions (e.g., a parent, teacher, or paraprofessional)?
• Technical Support: Do they have access to any technical support (e.g., a parent, teacher, or school IT support) if they encounter difficulties?

By gathering this information beforehand, you can proactively address potential challenges and ensure a smoother and more effective teletherapy session for both you and your student.

Consider sharing control

Kids are way more into therapy when they feel like they have some control. Sharing your screen can be a game-changer! Let them explore interactive websites, pick their own activities, or even guide the presentation. It makes things more fun and helps them feel like they’re in charge (in a good way!).

Keep in mind that when a student has control of the mouse, it prevents you from using it for other things like entering therapy notes or navigating to other resources.  Having them play a game while you enter notes sounds like a great idea, but I haven’t found a way to split control.

Sometimes you might need to gently remind them to let you take back the mouse, but usually, it’s worth it for the extra engagement and motivation.

Key Telework Pointers: Health & Wellness

Teletherapy can present unique ergonomic challenges. Since you’re likely sitting in front of your computer for extended periods, prioritizing your health and wellness is crucial.

Ergonomics: 

• Chair and Desk Height: Ensure your chair and desk are at the correct height to maintain proper posture. Your feet should be flat on the floor, and your forearms should be parallel to the ground when typing.  You might find a footrest useful.
• Mouse and Keyboard Positioning: Position your keyboard and mouse close to your body to minimize reaching and maintain a neutral wrist position. Consider using a wrist rest for added support.
• Camera Positioning: Position your camera at eye level to maintain natural eye contact with your students.  Keep your conference video at eye level to increase eye contact.

Minimize Eye Strain:

• Blue Light Filter: Use a blue light filter on your computer screen to reduce eye strain. This can be done through your computer’s display settings or by using a dedicated software application. (I also prefer Dark Mode.)
• 20-20-20 Rule: Follow the 20-20-20 rule: Every 20 minutes, look at something 20 feet away for 20 seconds.

Incorporate Movement: 

Schedule regular movement breaks throughout your workday. Stand up, stretch, walk around, or do some simple exercises.

Stay Hydrated: 

Keep a water bottle nearby and sip water throughout the day to stay hydrated.

Set Boundaries:  

Establish clear boundaries between work and personal time.  When you’re not working, disconnect from technology and engage in activities that you enjoy.

By prioritizing your own health and wellness, you’ll be better equipped to provide high-quality teletherapy services to your students and avoid burnout.

Collaborate and Share

Teletherapy presents unique challenges, but it also offers opportunities for collaboration and shared learning. Connect with other educators and therapists online to exchange tips, share resources, and support one another.

By incorporating these indispensable video conferencing strategies into your teletherapy practice, you can create engaging and effective learning experiences for your students, even from a distance.

I’d love to hear about your own teletherapy tips and tricks! Please share your insights in the comments below.

If you found these tips helpful, you might be interested in my comprehensive 140+ page guide, “So You Want to Be a Teletherapist.” It covers all these topics and more, including setting up your workspace, navigating legal documents like BAAs, and building a secure and efficient digital practice from the ground up!

Happy conferencing!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Essential Teleconferencing Tips for SLPs and Teachers appeared first on Mrs. Speech Online.

The buzz around artificial intelligence (AI) has hit pretty much every corner of life these days. Speech-language pathology (SLP) is no different. For us clinicians, these new AI tools have brought a real mix of feelings. There’s certainly curiosity, but also a good chunk of “Wait, what?” Maybe you feel some apprehension and, yes, let’s be honest, even some straight-up fear.  How do we even begin to separate AI Truth vs AI Myth?

Ads scream about AI writing full reports in minutes, and professional communities discuss blanket policies on AI use. It’s easy to get caught up in a swirl of misunderstandings about what this technology actually is, and what it means for SLPs.

This is the second of an 8-part weekly series on AI. See the bottom of this post for a full list of planned posts in this series. Each post ends with a quick 3-4 question poll that will be reported in the final part.

In this post, we’re going to cut through all the noise and tackle some of the most common myths floating around about AI and clinical practice. Our goal is to clarify AI’s true capabilities and limitations. I aim to help you navigate this changing scene with solid information and perspectives for informed decision-making.

AI Truth or Myth 1: AI will replace human SLPs.

Myth Debunked – This is probably the biggest worry. Will AI make human speech-language pathologists a thing of the past?

The truth is, AI can generate text, analyze patterns, and even provide basic feedback. However, there is a fundamental difference between artificial intelligence and human clinical expertise.

Our work as SLPs often comes from our own lived experiences, deep empathy, unique ways of understanding human communication. We strive to foster growth and connection in complex individuals in an even more complex society.

AI, as it stands, simply doesn’t possess that. It operates by identifying patterns from vast amounts of data, but it lacks genuine thoughts, emotions, or lived experiences to draw upon. That nuanced assessment, the understanding of client needs and motivations, and truly original, resonant therapy approaches? That’s human SLP territory, and it’s irreplaceable.

AI Truth or Myth 2: Using AI goes against HIPAA and client confidentiality.

Myth Debunked – This is a paramount concern for SLPs, and rightly so. The myth suggests that any use of AI tools inherently breaches client privacy regulations like HIPAA. It’s true that using public, unsecured AI models with protected health information (PHI) would be a severe violation. However, the reality is far more nuanced.

Responsible and ethical AI integration within an SLP practice is entirely possible. It involves understanding and utilizing secure, HIPAA-compliant AI tools. You must fully de-identifying data before inputting it into less secure models, and always adhere to established privacy protocols. This series will delve deeper into safeguarding client data. For now, understand that the myth of blanket violation is a misrepresentation.

AI Truth or Myth 3: AI use is unprofessional or inherently unethical for SLPs.

Myth Debunked – Viewing AI as a compromise of professional standards overlooks its significant potential as a powerful tool. Think of it like a massive clinical resource. It’s an advanced documentation assistant, or a brainstorming partner. These are resources SLPs have utilized for ages to enhance their work.

When used in a responsible and transparent way, AI can assist with many clinical tasks. It’s adept at brainstorming therapy ideas, drafting session notes, creating client education materials, or summarizing research. The crucial difference lies in how you use it.

Attempting to pass off AI-written material as your own unreviewed clinical work is certainly unethical. However, using AI to augment your own skills, streamline certain tasks, or provide initial drafts can actually be very beneficial. It can allow you more time for direct client interaction and clinical reasoning.

AI Truth or Myth 4: AI-generated clinical content (e.g., notes, therapy plans, materials) is undependable or inaccurate.

Myth Confirmed – Thinking AI can just instantly produce perfect, clinically sound content without any effort? That’s not truly how it works. AI can certainly assemble grammatically correct sentences for notes or even mimic certain therapy activity styles. What it often lacks is genuine clinical depth, a sense of individualized client needs, and that unique insight that makes therapy truly effective.

AI-generated text can sometimes sound generic, repeat itself, or even introduce clinical inaccuracies or inappropriate suggestions (called “hallucinations”). Fact-checking, personalization, and adaptation to ensure the materials are truly appropriate, accurate, and ready for use are critical. AI is a drafting assistant, not a final clinical decision-maker.

AI Truth or Myth 5: AI can provide definitive diagnoses or independently determine treatment plans.

Myth Debunked – This is a critical misconception. AI models can process vast amounts of medical and clinical data, identify patterns, and flag potential concerns. However, they cannot perform differential diagnoses or independently create comprehensive, individualized treatment plans. AI lacks clinical reasoning and cannot integrate diverse assessment data from multiple modalities. It also lacks nuanced human behavior understanding, missing the ethical responsibility required for core SLP functions.

AI can be a powerful support tool for clinicians. It can summarize research, analyze speech samples for patterns, or brainstorm intervention strategies. It’s critical to remember that the SLP remains solely responsible for all diagnostic conclusions, treatment planning, and ultimate clinical decisions.

AI Truth or Myth 6: AI-powered tools will make therapy impersonal and reduce human connection.

Myth Debunked – The fear that technology will diminish the crucial human element of therapy is understandable. However, this myth overlooks how AI can actually enhance human connection. The truth is, by automating or streamlining repetitive administrative and preparatory tasks, AI can free up valuable time.

This freed-up time means SLPs can dedicate more energy to direct client interaction, building rapport, engaging in personalized therapy activities, and providing the deeply empathetic support that defines our profession. Therefore, AI becomes a tool to optimize our time, allowing us to be more present and connected with our clients, not less.

AI Truth or Myth 7: AI can perfectly understand and replicate human speech, including nuances like accent, dialect, or prosody.

Myth Debunked – Automatic Speech Recognition (ASR) technology has made incredible strides. However, the myth of its universal flawlessness is untrue. It is not unbiased for all populations.

Current AI models can struggle with diverse accents, non-standard dialects, and speech sound disorders. Subtle but critical emotional and linguistic nuances like sarcasm, intonation, or pitch variations are also frequently missed.

For SLPs, relying solely on flawed ASR for diagnostic or therapeutic purposes could lead to misinterpretations, inaccurate assessments, or inappropriate intervention strategies. This is especially true when working with culturally and linguistically diverse populations. The SLP’s ear and clinical expertise remain paramount for accurate phonetic, phonological, and prosodic analysis.

AI Truth or Myth 8: Using AI requires extensive tech expertise or coding skills.

Myth Debunked – Many SLPs may feel intimidated by AI, believing it demands a deep understanding of computer science or programming. The myth suggests that only tech-savvy individuals can leverage AI in their practice. The reality, however, is that most common generative AI tools are designed with user-friendly interfaces that resemble simple chat programs.

You interact with them using natural language prompts, much like you would talk to a colleague. While understanding how to prompt effectively is key (a topic we’ll cover later in this series!), it requires no coding skills whatsoever. This accessibility makes AI a tool that can be integrated by any SLP, regardless of their tech background.

AI Truth or Myth 9: AI is only beneficial for a small niche of SLP practice (e.g., articulation or language).

Myth Debunked – The misconception here is that AI’s utility is narrowly confined to specific areas of communication disorders. In reality, AI’s potential applications span the vast breadth of SLP practice. Beyond generating articulation drills or language activities, AI can assist in areas such as:

• Social communication: Brainstorming social scripts or narrative scenarios.
• Fluency: Organizing research or drafting educational materials on disfluencies.
• Voice: Summarizing literature on vocal hygiene or voice therapy techniques.
• Dysphagia: Assisting with literature reviews or creating patient education handouts.
• AAC: Generating ideas for symbol sets or communication board layouts.
• Professional Development: Summarizing research articles or creating CEU presentation outlines.

AI is a versatile assistant that can be adapted to enhance efficiency and creativity across virtually all domains of speech-language pathology.

Moving Forward with Clarity and Facts:

It’s crucially important for us SLPs to gain a clear understanding of what AI can and can’t do right now. By busting these common myths, we can begin to see AI is not something that’s going to take our jobs. Instead, it is a tool that might actually prove helpful in our clinical process, allowing us to spend more time where it matters most: directly with our clients.

What are your initial reactions to the AI fact and fiction we’ve outlined? Are there other common beliefs or fears about AI in SLP practice that you’ve encountered or that worry you personally? Share your thoughts in the comments below, and then share your perspective in our quick poll! Results will be shared at the end of the series!

AI & SLPs Poll 2

I’d love to hear your thoughts after reading this post! Please answer these 4 questions; your valuable input will help shape my series’ final insights. To keep the poll fair and ensure unique responses, a Google account sign-in is required. Be assured, your email address is neither collected nor visible to me.

Ready to keep the facts straight? To help you quickly recall and share AI Truth vs Myth, I’ve created a ‘Quick-Check AI Myth Buster Cheat Sheet for SLPs’. This valuable resource condenses all 9 myths and their factual realities into a handy, single-page reference, and it’s an exclusive for my subscribers!

Want to get your hands on this cheat sheet and navigate the AI landscape with confidence? Simply subscribe using the form below to gain instant access!

The AI & SLPs Series: Your Comprehensive Guide

Welcome to the AI & SLPs Series! Over the next eight weeks, we’ll delve deep into how Artificial Intelligence is shaping the world of speech-language pathology. Here’s what you can expect:

• Part 1: AI & Clinical Data Privacy
  • This foundational post explores AI training data, client privacy, and HIPAA compliance for SLPs, including the non-negotiable role of BAAs.
• Part 2: Separating Truth vs Myth 
  • We debunk common AI myths in SLP practice. Get a realistic understanding of AI’s true role and capabilities.
• Part 3: How AI Tools Work 
  • Get a clear, jargon-free explanation of how large language models function. Understand their capabilities and limitations.
• Part 4: AI for Clinical Spark & Efficiency
  • Discover ethical ways to use AI. Brainstorm, overcome planning hurdles, and refine non-clinical communications.
• Part 5: Mastering Prompts 
  • Learn prompt engineering. Communicate effectively with AI models to get tailored, useful results for SLP needs.
• Part 6: Compliant Platforms & Tools
  • This post guides you through AI tools. Learn key factors for ethically and compliantly selecting platforms for your SLP practice.
• Part 7: Ethical & Responsible Use
  • This crucial post delves into broader ethical responsibilities for SLPs using AI. It covers principles beyond data privacy.
• Part 8: The Future of AI
  • This concluding post explores emerging AI trends and future possibilities in Speech-Language Pathology. Prepare to adapt, innovate, and lead responsible AI integration.

Stick around as we keep figuring out this whole thing together, giving SLPs the knowledge they need and helping us all find a balanced way to think about AI in the future of speech-language pathology. There is a lot of gray area and strong opinions, and I hope I can provide some facts to help you make informed choices that correspond with your own values.

Keep on clickin’!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post AI & SLPs Series, Part 2: Separating Fact from Fiction appeared first on Mrs. Speech Online.

In my last post, HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security, we got real about HIPAA compliance for home offices and personal devices. We covered that many of us are HIPAA Covered Entities and how crucial it is to safeguard Protected Health Information (PHI) wherever we practice, even at home. Navigating Business Associate Agreements as SLPs is an important piece of that compliance.

Today, we’re zooming in on one of the most critical, yet often overlooked, pieces of that HIPAA puzzle: the Business Associate Agreement (BAA). Think of it as your golden ticket to legally sharing PHI with necessary service providers, while ensuring that data stays locked down.

I’ll be the first to tell you, this is a new topic for me. I was unaware of most of this information just a few weeks ago! My eyes have really been opened and I’m changing the way I work based on this new information. Especially as a teletherapy contractor, I’ve been working to upgrade my services to business grade. (You can read all about it here: My Personal HIPAA Compliance Journey: Steps to Secure Data)

Disclaimer:

The information provided in this blog post is for informational and educational purposes only and is not intended to constitute legal or professional advice. HIPAA compliance is complex and constantly evolving. While efforts have been made to ensure the accuracy of the information presented, it may not reflect the most current legal developments, nor is it guaranteed to be complete or applicable to your specific situation.As a healthcare professional, it is your responsibility to understand and comply with all applicable federal, state, and local laws and regulations, including HIPAA. This content should not be used as a substitute for seeking qualified legal counsel from an attorney specializing in healthcare law, particularly concerning your individual practice, specific vendor relationships, or unique circumstances. Reliance on any information provided in this post is solely at your own risk.

What Exactly IS a Business Associate Agreement (BAA)?

At its core, a Business Associate Agreement (BAA) is a formal, legally binding contract between you (the Covered Entity) and any person or entity (the Business Associate) that performs services for you that involve the creation, receipt, maintenance, or transmission of Protected Health Information (PHI).

Why do I need a BAA as an SLP? 

The BAA is HIPAA’s way of extending the privacy and security obligations beyond just your practice. It legally obligates your Business Associates to:

• Safeguard PHI: They must implement their own administrative, physical, and technical safeguards to protect PHI, just like you do.
• Limit Use/Disclosure: They can only use or disclose PHI as permitted by the BAA and HIPAA regulations.
• Report Breaches: They must notify you if they discover a breach of unsecured PHI.
• Cooperate with Audits/Investigations: They may be subject to direct enforcement actions by the Department of Health and Human Services (HHS).
• Flow-Down Rule: If they use subcontractors who access PHI, they must have a BAA with their subcontractors too!

In short: No BAA, No PHI Exchange. You cannot share PHI with a service provider unless you have a signed BAA in place, or that provider falls under a very narrow exception. Failing to get a required BAA can lead to significant fines and penalties for your practice if a breach occurs.

What Does a BAA Actually Look Like? Key Sections to Expect

While the exact wording of a BAA can vary between vendors, they generally follow a standard structure and include specific clauses mandated by HIPAA regulations, as outlined by the U.S. Department of Health & Human Services (HHS). When you receive one, here’s what you can expect to see:

I. Core Agreement Details

These sections lay out the basic framework and definitions of the Business Associate Agreement.

• Introduction & Parties:
  • Purpose: States the agreement’s goal (to comply with HIPAA by protecting PHI).
  • Effective Date: When the BAA officially begins.
  • Parties Involved: Clearly identifies you (the Covered Entity) and the vendor (the Business Associate) by their full legal names and addresses.
• Definitions:
  • This section will define key HIPAA terms as they apply to the agreement, such as “Protected Health Information (PHI),” “Electronic PHI (ePHI),” “Covered Entity,” “Business Associate,” “Breach,” “Security Incident,” and the “HIPAA Rules” (Privacy, Security, and Breach Notification Rules). This ensures both parties are on the same page legally.

II. PHI Usage & Protection Obligations

This crucial category outlines how the Business Associate is permitted to use PHI and the safeguards they must have in place.

• Permitted and Required Uses and Disclosures of PHI by the Business Associate:
  • This is a core section. It specifies exactly how the Business Associate is allowed to use and disclose PHI to perform the services for which you hired them. For example, an EHR vendor’s BAA would permit them to store, process, and transmit PHI for your charting and billing.
  • It will also outline any disclosures required by law (e.g., to the Secretary of HHS for compliance investigations).
  • Crucially, it will state that the BA cannot use or disclose PHI in any way that would violate HIPAA if done by you, the Covered Entity.
• Obligations of the Business Associate (Safeguards):
  • This section details the security measures the Business Associate must implement to protect PHI. It often references the HIPAA Security Rule and its requirements for administrative, physical, and technical safeguards.
  • Key phrases you’ll see include commitments to:
    • “Implement appropriate safeguards to prevent unauthorized use or disclosure of PHI.”
    • “Comply with the HIPAA Security Rule with respect to electronic PHI.”
    • “Ensure the confidentiality, integrity, and availability of ePHI.”

III. Breach Reporting & Compliance Provisions

This category covers what happens in case of a security incident or breach. It also describes how the Business Associate handles relationships with their own subcontractors.

• Reporting Obligations (Breaches and Security Incidents):
  • A critical component. The BAA will clearly define the Business Associate’s responsibility to report any “Security Incidents” (e.g., failed login attempts, malware attacks that might affect PHI) and, more importantly, any confirmed “Breaches of Unsecured PHI.”
  • It will specify the timeframe for reporting (e.g., “without unreasonable delay,” often 10-15 business days from discovery) and what information they must provide in the breach notification.
• Subcontractors:
  • This clause is essential. It requires the Business Associate to ensure that any of their subcontractors who create, receive, maintain, or transmit PHI on behalf of the Business Associate also agree in writing to the same HIPAA restrictions and conditions that apply to the Business Associate. This is often called the “flow-down” provision.

IV. Client Rights & Agreement Management

These sections ensure client rights regarding their PHI are upheld and define the terms for the BAA’s lifespan.

• Access, Amendment, and Accounting of Disclosures:
  • The BAA will ensure that the Business Associate cooperates with your obligations to individuals regarding their PHI, such as allowing individuals to access, amend, or receive an accounting of disclosures of their PHI.
• Termination:
  • Outlines the conditions under which the agreement can be terminated (e.g., for material breach of contract).
  • Crucially, it details the Business Associate’s responsibilities upon termination, which typically include returning or securely destroying all PHI received from or created on behalf of the Covered Entity, if feasible. If not feasible, they must continue to protect the PHI.
• Miscellaneous Provisions:
  • Standard legal clauses like governing law (which state’s laws apply), notices, and how amendments to the BAA will be made.

Important Note: You won’t usually negotiate a BAA provided by a large vendor like Google or an EHR. Their BAAs are standardized. Your role in a BAA as an SLP is to read it carefully to ensure it meets HIPAA’s requirements and your understanding of the service. If you have any concerns or complex situations, consulting an attorney specializing in healthcare law is always advisable.

• Google has a publicly available HIPAA Compliance help page with a link to their BAA.

Who Do You Need a BAA With? The “Access to PHI” Rule

This is the million-dollar question! The key is whether a service provider, in the course of performing services for you, has “access to” PHI. This “access” is much broader than just storing or directly viewing the data. It includes any service that processes, handles, or routinely interacts with PHI.

Here are common service categories where you absolutely need a Business Associate Agreement as an SLP:

Services Directly Managing Client Data & Communication

Electronic Health Record (EHR) / Practice Management Systems:

• Why: These are the central hubs for all your client data, including diagnoses, treatment plans, notes, and billing information. The vendor maintains and processes all this PHI.
• Examples: SimplePractice, TherapyNotes, TheraPlatform, ClinicSource, or any specialized EHR/PM system you use.

Telehealth / Video Conferencing Platforms:

• Why: When you conduct teletherapy sessions, PHI (audio, video, screen shares, chat messages) is transmitted through and processed by the platform’s servers. Even if they don’t store the video, the transmission involves access.
• Examples: Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, or any specific HIPAA-compliant telehealth solution.
• Crucial Note: Free, consumer versions of platforms like standard Zoom, Google Meet, or FaceTime are NOT HIPAA compliant and will not sign a BAA. Never use these for PHI.

Cloud Storage & Productivity Suites:

• Why: If you save any client notes, reports, scanned documents, or other files containing PHI to a cloud drive, or use cloud-based email/document services where PHI might reside or pass through.
• Examples: Google Workspace (formerly G Suite), Microsoft 365 (formerly Office 365), Dropbox Business.
• Crucial Note: You must have the business or enterprise versions of these services, and you must specifically request and sign their BAA. Standard consumer accounts (e.g., free Gmail, personal Dropbox) do NOT offer BAAs and are not HIPAA compliant for PHI.

Email Marketing & Communication Platforms (if used for client communications):

• Why: If you use an email service to send appointment reminders, share resources, or communicate anything with clients that could be considered PHI (even indirectly), your email provider needs a BAA. Your personal Gmail or Outlook.com accounts are out!
• Examples: Certain secure email providers often bundled with EHRs or business productivity suites.
• Crucial Note: Again, consumer email services are generally not HIPAA compliant for handling PHI, as they typically do not provide the necessary Business Associate Agreements. Ensure your email provider offers a BAA.

Billing & Claims Processing Services:

• Why: These services handle all the financial PHI related to your clients, including diagnoses, procedure codes, and personal identifying information.
• Examples: Any third-party billing company or clearinghouse you use to submit claims.

Infrastructure & Support Services with PHI Access

These services may not directly process your core client notes. However, they have access to the underlying systems, devices, or physical records that contain PHI. This makes a BAA essential for SLPs that use them.

Antivirus and Endpoint Security Solutions:

• Why: This one often surprises people! Antivirus software constantly scans and interacts with all files on your hard drive, including those that may temporarily contain PHI. It monitors network traffic where PHI is transmitted. Many also send telemetry data back to their servers, potentially including fragments of PHI. Because of this direct and persistent access to data on devices that handle PHI, the antivirus vendor becomes a Business Associate.
• Examples: Business-grade versions of solutions like Trend Micro Apex One, Bitdefender GravityZone, ESET Endpoint Security, CrowdStrike, or Symantec Endpoint Protection.
• Crucial Note: Most free or consumer-grade antivirus products (like the version of Avast we discussed) are not suitable for devices handling PHI because they typically do not offer BAAs. (I’m having trouble finding one that offers a BAA for a sole entity.)

IT Support / Managed Service Providers (MSPs):

• Why: If an IT professional accesses your computer systems, servers, or network to perform maintenance, updates, or troubleshooting, and those systems contain or access PHI, they are a Business Associate. They have access to the underlying infrastructure that houses your PHI.
• Examples: Any company or individual you hire to manage your practice’s technology infrastructure.

Physical Document Shredding/Disposal Services:

• Why: If you use a third-party service to shred or dispose of paper records containing PHI, they are handling and destroying that PHI on your behalf.
• Examples: Shred-it or local shredding services.

Who Doesn’t Need a BAA? The “Conduit Exception”

Not every single service you deal with as an SLP needs a BAA (Whew!). The most common exception is for entities that merely act as a “conduit.”  This is a principle often referred to as the “Conduit Exception Rule,” as further detailed by the HIPAA Journal..

• Internet Service Providers (ISPs): Your home internet provider (e.g., Comcast, AT&T, Spectrum) typically does NOT need a BAA with you. Their role is limited to transmitting information, like a digital postal service. Any access they might have to the content of your data is transient and incidental, simply for the purpose of moving the data. They aren’t storing or processing the PHI itself.
  • Important Caveat: While the ISP itself doesn’t need a BAA, you are still responsible for securing your own home network (strong Wi-Fi passwords, updated router firmware, firewalls). The data you send should be encrypted by the services you’re using (EHR, telehealth, etc.) before it travels across the internet.
• The U.S. Postal Service (USPS) or other mail couriers (e.g., FedEx, UPS): If you mail physical documents containing PHI (securely, of course!), these services are considered conduits.

The School SLP, BAAs & Educational Platforms (Google Workspace, Microsoft 365, etc.) Deep Dive:

If you’re an SLP working with a school district that uses Google Workspace for Education or Microsoft 365 Education (or similar educational platforms), here’s your specific action plan for BAAs and handling PHI:

• The School’s BAA with the Platform Provider: Your absolute first step is to confirm with the school district’s IT department or administration if they have a BAA in place. Both Google and Microsoft do offer BAAs for their education editions (from what I could find). However, the school administrator must specifically enable HIPAA compliance settings and accept the BAA for it to be active. Without this, the platform is NOT HIPAA compliant for PHI.
• Your Use within Their System: IYou might be covered under your school’s HIPAA umbrella, provided these conditions are met:
  • The school has a Business Associate Agreement (BAA) with the platform provider.
  • Your use of their provided account (e.g., your school district Google or Microsoft account) falls under their defined, HIPAA-compliant policies. It’s crucial that you adhere strictly to the school’s internal policies and procedures for handling student health information within these platforms.
• No BAA from School? Big Problem! If the school district does not have a BAA in place with Google, Microsoft, or any other cloud service they’re making you use for PHI, you cannot legally use those services for PHI. You would need to advocate strongly for them to become compliant or use alternative, secure methods for your PHI handling that are sanctioned by the school and meet HIPAA standards. Using non-compliant platforms for PHI, even if mandated by a school, could put your personal license and practice at risk if you are a Covered Entity.

Working At Home: SLP Security Beyond a BAA

Taking Work Home/Using Personal Devices

This is a common scenario and a significant HIPAA risk. If you take work home that involves PHI (e.g., student health records, IEPs with medical details, notes with diagnoses) and use personal devices or home networks:

• No PHI on Personal Devices (Unless Controlled): Ideally, avoid storing or processing any PHI on your personal computer, tablet, or phone unless these devices are explicitly managed by the school’s IT department with appropriate security configurations (encryption, remote wipe capabilities, etc.) and covered under their HIPAA compliance program.
• Secure Remote Access: If you must access school-based PHI from home, you should only do so via secure, encrypted channels provided by the school (e.g., a Virtual Private Network (VPN) connection to the school’s server, or accessing cloud-based platforms directly through a web browser on a school-managed or properly secured device).
• Physical Security: If you bring physical documents containing PHI home, they must be stored securely (e.g., in a locked filing cabinet) and never left visible or accessible to others in your household. Any physical PHI you need to dispose of at home must be shredded securely, not just thrown in the trash.
• Home Network Security: Ensure your home Wi-Fi network is password-protected with a strong, unique password and that your router firmware is up to date.

Your Personal Private Practice/Billing (if applicable)

If you, as an individual SLP, have a private practice, even a few hours a month, and bill Medicaid or other health plans electronically, you are unequivocally a HIPAA Covered Entity. If you use any Google Workspace or Microsoft 365 features (even if provided by the school) for your private practice PHI that isn’t part of the school’s “education record” (e.g., your own private therapy notes for direct billing, your own client contact lists), you need to be very clear about how that PHI is handled. It’s often safest and most advisable to maintain entirely separate, fully BAA-covered systems for your SLP work to avoid commingling data and potential compliance issues.

The Risks of Skipping a BAA for SLPs: Why It Matters to YOU

You might be thinking, “This is a lot of paperwork! It’s just little ole me!” But the consequences of not having a required BAA can be severe:

• Hefty Fines & Penalties: The HHS Office for Civil Rights (OCR) can impose significant civil monetary penalties for HIPAA violations. Failing to have a BAA is a direct violation. Fines range from hundreds to hundreds of thousands of dollars per violation, potentially reaching millions annually.
  • Real-World Example: Reports from sources like Paubox highlight documented cases of covered entities facing substantial fines (e.g., hundreds of thousands to millions of dollars) for failing to execute BAAs with vendors who then experienced a breach. For instance, in one case, a medical center paid $240,000 for HIPAA Security Rule failures, including issues with a Business Associate Agreement. Another entity paid $500,000 for PHI exposure due to the absence of a BAA with a medical billing contractor.
• Legal Liability: If a Business Associate mishandles PHI and you don’t have a BAA in place, you (the Covered Entity) can be held directly liable for their actions. This could lead to lawsuits from affected clients.
• Increased Data Breach Vulnerability: Without a BAA, you have no contractual assurance that your vendor is implementing the necessary security safeguards. This leaves your clients’ sensitive information vulnerable.
• Reputational Damage: A data breach or HIPAA violation severely erodes client trust and can lead to significant reputational harm, impacting your ability to attract and retain clients.
• Audit Red Flag: During an OCR audit or investigation, one of the first things they’ll check for is signed BAAs. Missing BAAs are an immediate red flag that can trigger deeper scrutiny and more severe penalties, as discussed by Secureframe and other compliance resources.

Best Practices for Managing Your BAAs

Once you start collecting BAAs, effective management is key:

• Create a Vendor Inventory: Maintain a clear, organized list of all your service providers. For each, note:
  • Vendor Name
  • Service Provided
  • PHI Accessed (e.g., clinical notes, billing data, demographics)
  • BAA Status (Yes/No)
  • Date BAA Signed
  • Date for Next Review (e.g., annually, or upon contract renewal)
  • Location of Signed BAA (digital file path or physical folder)
• Due Diligence is Key: Don’t just get a signed BAA; conduct basic due diligence. While you don’t need to perform a full security audit, ask questions about their security practices (e.g., do they encrypt data? do they have strong access controls? do they perform their own risk assessments?). A good BAA means they’ve agreed to protect PHI, but you should still have a reasonable assurance that they can and do.
• Regular Review and Update: Your practice and the services you use will evolve. Review your vendor inventory and all BAAs annually, or whenever:
  • You change a service provider.
  • A vendor changes the services they provide.
  • HIPAA regulations are updated.
  • There’s a significant change in your practice operations.
• Document Everything: Keep all signed BAAs, vendor communications about security, and your internal review notes meticulously organized. In the event of an audit, documentation is your best friend.

Your Action Steps for BAA Compliance as an SLP:

1. Inventory Your Vendors: Make a list of every service provider (including software and online platforms) that interacts with PHI in your practice.
2. Assess “Access to PHI”: For each vendor, ask: “Does this service create, receive, maintain, or transmit PHI on my behalf, or does it have persistent access to PHI?”
3. Request a BAA: If the answer to #2 is “yes,” contact the vendor and request their BAA. Most legitimate business-grade services for healthcare will have one ready.
4. Read and Understand: Don’t just sign! Read the BAA carefully to understand your and their responsibilities.
5. Document: Keep all signed BAAs on file as part of your HIPAA compliance documentation.
6. Regular Review: Revisit your vendor list and BAAs annually, or whenever you add a new service or there’s a significant change in your practice or technology.

You can do it!

Navigating Business Associate Agreements as an SLP can feel overwhelming, but it’s a critical aspect of being a responsible and compliant healthcare provider. By taking these proactive steps, you’re building a strong foundation of trust and security for your clients and your practice.

Want to know more? Check out these posts!

• My Personal HIPAA Compliance Journey: Steps to Secure Data
• HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security

What other HIPAA questions are on your mind? Share in the comments!

Don’t forget to download your free HIPAA Home Office Policies & Procedures Worksheet to help you get started on your internal documentation! Sign up below for Exclusive access to my Subscriber Freebies page, newsletter, blog updates, and special announcements!

Disclaimer:

The information provided in this blog post is for informational and educational purposes only and is not intended to constitute legal or professional advice. HIPAA compliance is complex and constantly evolving. While efforts have been made to ensure the accuracy of the information presented, it may not reflect the most current legal developments, nor is it guaranteed to be complete or applicable to your specific situation. As a healthcare professional, it is your responsibility to understand and comply with all applicable federal, state, and local laws and regulations, including HIPAA. This content should not be used as a substitute for seeking qualified legal counsel from an attorney specializing in healthcare law, particularly concerning your individual practice, specific vendor relationships, or unique circumstances. Reliance on any information provided in this post is solely at your own risk.

References:

• U.S. Department of Health & Human Services (HHS).Business Associate Contracts. Retrieved from https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
• U.S. Department of Health & Human Services (HHS).Business Associates. Retrieved from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
• HIPAA Journal. HIPAA Conduit Exception Rule and Transmission of PHI: 2025 Update. (Updated January 2, 2025). Retrieved from https://www.hipaajournal.com/hipaa-conduit-exception-rule/
• Paubox. HIPAA lessons learned: A review of HHS resolution agreements. (Updated January 23, 2025). Retrieved from https://www.paubox.com/blog/hipaa-lessons-learned-a-review-of-hhs-resolution-agreements
• Secureframe. HIPAA Violations: Examples, Fines + 5 Cases to Learn From. Retrieved from https://secureframe.com/hub/hipaa/violations

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Navigating Business Associate Agreements as an SLP: Your HIPAA BAA Guide appeared first on Mrs. Speech Online.

Hey fellow SLPs and healthcare pros! Today, I want to share some insights from my personal journey towards HIPAA compliance.

In my last two posts, we delved into the crucial topic of HIPAA compliance for telepractice. They covered the “what” and the “why.”

• HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security
• Navigating Business Associate Agreements as an SLP: Your HIPAA BAA Guide

Today, I want to share the “how” – my personal journey of putting these principles into practice! I’ve been diving deep into my tech setup to make sure it’s not just functional, but also rock-solid HIPAA compliant. For example, as a teletherapist, some of my schools don’t invite me into their workspace. This leaves it up to me to securely manage all my client notes and materials. This kind of gap is precisely what drove me to build a truly robust system.

It might sound daunting, but trust me, it’s all about peace of mind for both you and your clients. I wanted to share a rundown of what I’ve done. More importantly, I want to share why I’ve done it, in case it helps you level up your practice too!

The “Why” Behind My Personal HIPAA Compliance Journey

My biggest drive was simple. I needed to know, without any doubt, that I was protecting my clients’ sensitive information to the highest standard. HIPAA isn’t just a checkbox; it’s about building trust. First, conducted a thorough risk analysis of my setup to identify any potential vulnerabilities.

I’ve now meticulously created and am maintaining a detailed “Security Policies and Procedures” document that guides all my practices. Plus, having everything clearly documented helps me sleep better at night!

Honestly, it wasn’t that long ago, a few weeks, that I wasn’t even aware of all of this. I didn’t know about Business Associate Agreements (BAAs), or their critical role. My previous security stance of “just don’t share client info” felt sufficient. Since then, I’ve realized how nebulous and insufficient that really was for both cloud-based and desktop information. 

How It All Started

So, if I wasn’t born with this wealth of knowledge, and it wasn’t covered in grad school, what happened? Well, I discovered that simply removing what I thought was identifying information was not sufficient for HIPAA de-identification. That realization truly sent me down this “rabbit hole” of learning and implementing everything you’re about to read!

Honestly, as a single user, all this might seem like overkill at times. That is, until I really think about the potential cost and repercussions of a HIPAA violation. That quickly puts things into perspective!

Here’s information and tips I’ve learned on this individual HIPAA compliance trek. (No, I’m not affiliated with, or sponsored by, Google in any way, it was just easier to work with.)

The Secure Foundation: My Google Workspace Enterprise Standard

Before even setting up my specific security rules, choosing the right Google Workspace edition was crucial. There are several tiers, and it’s not just about how many emails you can send! For me, picking Enterprise Standard was absolutely essential because of the level of HIPAA security I was comfortable with.

• Pro-Tip on Choosing a Platform: I actually considered Microsoft 365 Business plans, as they also offer BAAs. However, I was already using and familiar with Google’s interface. More importantly, I found it much easier to get clear information about Google’s BAA and HIPAA-included functionality upfront. Microsoft seems to hide their BAA documentation behind a subscriber wall, making it difficult to fully vet before committing. This ease of information access, combined with my familiarity, ultimately swayed my decision towards Google.  Basically, it looks like any paid workspace can have a BAA:   https://support.google.com/a/answer/2888485?sjid=14092164238884574583-NC

Here’s why I landed on it during my own HIPAA compliance trip, and what foundational elements it provides:

The Non-Negotiable BAA

This was the top priority. Enterprise Standard definitely comes with a Business Associate Agreement (BAA). This gives me that crucial legal agreement with Google to handle Protected Health Information. This is absolutely non-negotiable for anyone handling PHI with Google Workspace. (You can find Google’s BAA here: https://workspace.google.com/terms/2015/1/hipaa_baa/).

• Pro-Tip on Choosing a Tier – I actually started with the cheapest business tier (Business Starter $7/mo), which I can confirm offers a BAA. However, after really digging into the features, I chose to upgrade to Enterprise Standard. It offered much better control over information and more robust policy enforcement options. These ultimately felt essential for protecting client PHI effectively.  Google Tiers & Pricing 
• Don’t Forget Your Domain Name! A domain name is an additional, but necessary, cost for any Google Workspace Business account. While Google offers to sell you one directly, I opted to buy my domain through Cloudflare for just $10.44/year. This was a cost-effective choice since I already used Cloudflare for other services.

Serious Pooled Storage

Enterprise Standard offers a massive 5 TB of pooled storage per user. (Just a heads-up: This pooled storage gets released in stages after payments, so my Drive initially showed less!). This is more than enough space for all my therapy materials and client files.

Google Vault for Ironclad Data Retention

This was a game-changer! Enterprise Standard includes Google Vault, which allows me to set an indefinite retention policy for all my Google data. This ensures I meet and exceed HIPAA’s minimum six-year data retention requirement. It’s like a super-secure, always-on backup for everything.

Advanced Data Loss Prevention (DLP)

This tier gives me access to advanced DLP rules for Gmail and Drive, which are central to my security strategy. These are the powerful rules that can warn me if I try to share sensitive files externally.

Comprehensive Security Controls

Enterprise Standard unlocks a lot of the granular administrative controls I needed. This allowed me to configure things like forcing 2FA, setting strong password policies, and disabling third-party apps.

Basically, for handling PHI and needing robust, auditable security features, Enterprise Standard provided the comprehensive toolkit I needed to feel confident and stay compliant. It’s an investment at $27/mo, but one that’s absolutely worth it for peace of mind and professional responsibility.

The Core Pillars of My Personal HIPAA Compliance Policy:

Here’s a look at the specific configurations I implemented (See Google’s HIPAA Implementation Guide:  https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf):

1. Bulletproof Access Control (Who Gets In? Only Me!)

• 2-Step Verification (2FA) is Mandatory: No exceptions! I enforced 2FA for all account access. This is your absolute best defense against unauthorized logins.
• Strong Passwords, Always: My system enforces strong password policies, requiring a minimum length of 16 characters and prompting for a refresh every 180 days. No weak links here!

• Third-Party Apps? Deny by Default! My policy is strict: all third-party app access is blocked by default. If I ever need an app, it goes through a security review and is force-installed by me, the admin. This prevents unvetted apps from touching my client data.
• Strictly BAA-Covered Services Only: As part of my setup, I went into my Google Admin Console and literally turned OFF any Google services that aren’t explicitly covered by the BAA (like Google Photos, YouTube, etc.). Why? To make sure no PHI accidentally ends up in a non-compliant service. (You can find a list of Google’s HIPAA Included Functionality and BAA-covered services here: https://workspace.google.com/terms/2015/1/hipaa_functionality/).

2. Smart Data Protection (No Accidental Leaks!)

• Gmail Content Compliance: I set up an automated rule in Gmail that quarantines any outbound email containing PHI-related keywords if it’s addressed to a domain not on my pre-approved “Trusted School Districts” list. It’s a huge safety net!
• Drive DLP (Data Loss Prevention) Rule: For Google Drive, I have a rule that gives me a real-time warning if I ever try to externally share a file containing PHI keywords. It’s an extra “Are you sure?” before a potential mishap.
• Always Use Secure Communication Channels: Beyond these automated rules, I always ensure that any direct client communication involving PHI occurs only through secure, HIPAA-compliant platforms (like my employer’s therapy portal). I now avoid using regular email, text messages, or consumer video calls for sensitive information.

3. Endpoint & Browser Security (My Laptop & Chrome)

• My Laptop is Encrypted & Protected: My main computer has full-disk encryption (BitLocker/FileVault) and a robust antivirus solution. I’m currently using Norton Small Business ($59/1st year with $119/year renewal) for this, primarily for its strong endpoint protection. While I’m actively looking into BAA-covered antivirus and endpoint detection & response (EDR) solutions, it’s been a real challenge to find providers willing to work with a single user. For now, Norton Business helps secure my device itself. I had to specifically disable its cloud backup features to prevent any PHI from being stored on non-BAA servers.  I’ve also upgraded my mouse to use Logi Bolt technology for a more secure wireless connection.
• Physical Security for My Home Office: Beyond digital protection, I also ensure any limited physical PHI (like printed notes) is kept in a locked file box when unattended, and my work area is secured to prevent unauthorized access. I’ve even rearranged my office so that my computer screen is not visible from the doorway, even though I always make sure to close the door when I’m with clients.
• Dedicated Chrome Profiles: This is a big one! I have separate Chrome browser profiles. One just for my professional Workspace (where I handle PHI), and others for personal stuff or employer-provided Outlook/therapy portals. This completely isolates data and workflows.
  • Updated to add – I’ve now gone a step farther and added another Windows user to my computer. This way all therapy stuff stays in the therapy user.
• Chrome Policies Enforced: My professional Google Workspace Chrome profile has Enhanced Safe Browse, “Always use secure connections” (HTTPS), and strict extension blocking enforced by policy. This means my browser is secured from the top down.
• Windows Settings Tuned: Beyond the basics, I dove into Windows settings to ensure my device is locked down. Strong PIN/Windows Hello, Dynamic Lock (locks when I walk away), automatic screen lock, firewall active, and app permissions reviewed app-by-app.

4. Tackling Existing Data & Migration

This was a big project, especially for older files, and probably the hardest part in my HIPAA compliance trek!

• Consolidating All My Data (PHI & Non-PHI): I meticulously went through all my files, both on my computer’s desktop and in my Drive. I identified any possible PHI or general therapy materials. That data was then securely moved to my professional Drive, ensuring it was consolidated into my compliant environment.
• No More OneDrive Sync: I’ve also disabled Microsoft OneDrive’s automatic PC folder backup. I’m in the process of moving those files from the OneDrive synced location back to my local user’s root folders. This ensures no client data is inadvertently stored or synced to a non-BAA cloud service.

Google Drive Settings and Workarounds

• Google Drive for Desktop (Strategically!): I used Google Drive for Desktop for efficiency with many files, but with a key rule. I keep it on “stream files” mode. This means files are only downloaded when I open them, minimizing PHI stored locally on my hard drive. I also keep its “offline access” feature for PHI files disabled in the Admin Console to prevent local copies, unless absolutely necessary and then with extreme care.
• Native Google Docs/Sheets/Slides: This was tricky! I learned you can’t just drag-and-drop native Google files between different accounts using Drive for Desktop. For these, especially if they contained PHI, I had to download them in Microsoft Office format from my personal Drive. Then I re-uploaded them to my professional Google Workspace Drive. This ensured ownership transferred correctly and, crucially, kept the PHI handling within my secured processes.
• Unzipping Files: Since Google Drive doesn’t have a built-in unzipper, I securely downloaded ZIP files to my local, encrypted computer. I unzipped them using Windows’ built-in function, and then re-uploaded the extracted files to my professional Google Workspace Drive.
• Disconnecting My Personal Drive: Once the transfer was done, I disconnected my personal Google Drive account from Google Drive for Desktop. Why? Fewer accounts connected equals less potential risk.
• Cleaning Up My Personal Drive (Carefully!): After moving all PHI, I used a cloud cleaner like Norton Cloud Cleaner on my personal Google Drive to remove duplicates and old non-PHI files. NEVER use such a tool on any PHI files or folders due to compliance risks, if it’s not covered by a BAA.

Involving Others in My Personal HIPPA Journey

• Dealing with Shared PHI from Others: I found some old PHI-containing files in my personal Gmail’s “Shared with me” section, shared by a school district. I immediately downloaded these to my professional Google Workspace Drive, securely deleted them from my personal Drive and my local computer. Then I reached out to the owner (politely!) asking them to remove my personal Gmail from the access list. This is an active and ongoing effort where I’m proactively contacting owners to ensure my access is removed. I’m documenting all my attempts as part of my due diligence, especially if I encounter non-responsive contacts or technical difficulties.
• Updating My Employer: I proactively contacted my employer to update my email address for all Google Drive file sharing. I specifically requested that anything with sensitive client info go to my new, secure professional email address (e.g., your.professional.email@yourdomain.com). This helps them send things to the right place from the start.

My Ongoing Commitment:

This isn’t a one-and-one project! I’ve also built in:

• Annual Policy Review: I’ll review my entire security policy document at least once a year.
• Self-Education: Staying informed about HIPAA and cybersecurity is an ongoing task. I’ve even been learning about specific processes like the HIPAA de-identification process.
• Basic Incident Response: I have a plan for what to do if something ever goes wrong, including who to notify.
• Learning Curve: I won’t lie, all these tech skills required some serious reading up and a lot of help (shout out to Gemini! ?). It’s a journey, not a sprint, but totally doable!

Setting all this up has been a journey, but it’s given me immense confidence in my practice’s security. If you’re an SLP (or any healthcare professional) using tech in your practice, I highly encourage you to take a look at your own setup. It’s worth every bit of effort for your peace of mind and, most importantly, for your clients’ privacy!

Here’s to HIPAA Happiness!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post My Personal HIPAA Compliance Journey: Steps to Secure Data appeared first on Mrs. Speech Online.