I’m Mrs. Speech, and for years, I’ve relied on daily jokes to raise the bar for vocabulary and linguistic flexibility school-wide. You can see my previous post on the topic, Why I had a joke board (And you should too), where I discuss the benefits to the school community. Today, I want to talk about the speech and language benefits to a daily joke.

The Cognitive Workout of a Joke

Jokes aren’t just funny; they are highly effective, embedded metacognition activities for SLPs. To understand a pun, riddle, or knock-knock joke, the brain must quickly engage in several complex therapeutic tasks:

Multiple Meaning & Semantic Flexibility

The core of most humor is the ambiguity of language. The student must simultaneously hold two meanings of a word (the literal and the figurative/unexpected) in mind. As I often ask my students, “What makes it funny? It’s the brain not being sure which meaning is correct!” This rapid shifting of focus is directly tied to reading comprehension and the ability to process novel vocabulary. (Example: “Why was the cyclops such a good teacher? He only had one pupil.”)

Inference and Abstract Thinking

Jokes almost always rely on unstated assumptions. Students must make a rapid inference—a cognitive leap—to bridge the gap between the setup and the punchline, a skill that directly transfers to narrative comprehension and problem-solving across all academic areas.

Sequencing, Memory & Retrieval

Telling or retelling a joke encourages the commitment of specific phrasing, vocabulary, and sequence to memory, building both auditory memory and verbal retrieval skills. This focus on structured language helps build stronger retrieval pathways.

Social-Pragmatic & Expressive Gains of Humor

The value of humor extends beyond words; it’s a powerful social lubricant that targets specific communication goals. Humor in speech therapy also provides these benefits:

Rapport and Low-Pressure Engagement

Humor builds a crucial bridge between students and teachers. For a shy or anxious child, having a simple joke to share provides a low-pressure entry point for conversation, drastically reducing the intimidation factor involved in practicing turn-taking and sustained conversation.

Intonation, Pacing & Fluency

Successfully delivering a punchline requires conscious control over prosody. Students naturally practice fluency skills like appropriate pacing and varying intonation to maximize the joke’s impact. This gives you a fun, motivating context to target speaking rate and voice modulation.

Perspective-Taking

Understanding why someone else doesn’t “get” a joke forces perspective-taking—identifying what specific context, vocabulary, or background knowledge they might be missing. This develops crucial social awareness.

Easy-Prep, High-Impact Routine: Jokes for SLPs

The great news is that getting started is easy. All you need is a poster-sized whiteboard and 30 seconds! (I used removable 3M velcro strips to avoid wall damage and permission issues.) You can start immediately by doing a quick online search for jokes, adding “for kids” to your query.

However, the challenge quickly becomes consistency and curation. I used to print out my joke document at the beginning of the year and place a checkmark next to jokes when I used them to avoid repetition.

If you want to maximize the therapeutic and school-wide benefits of humor (which also drastically improves your visibility as an SLP, as discussed in my previous post!), I’ve done the hard work for you:

🤩 Ready-Made Joke Products: Zero-Prep, Maximum Impact on Metacognition

I’ve collected, curated, and formatted my favorite jokes into resources designed to be instantly used on any platform. Bring the metacognitive benefits of humor into your classroom today! You can purchase the joke bank alone, or grab the highly visual backgrounds optimized for today’s digital classroom:

1. The Joke Bank (Core Content)

It’s So Punny! The Ultimate Joke Bank: This is the original, over 50-page document of school-appropriate, kid-friendly jokes. This is your foundation for building a routine, ensuring you never run out of quality material.

2. The Digital Classroom Application

Jokes/Puns on Themed Backgrounds – A Growing Bundle! (3 Themes & Counting!): This bundle is the easiest way to display your jokes! It includes ready-to-use image files for seamless integration into Zoom, Google Meet, or your Smartboard, and can also be printed. Themes currently include Back-to-School, Winter, and the new Halloween set (which includes the unique hidden-punchline feature!). Buy the growing bundle now to lock in the lowest price before more seasonal themes are added!

3. Ready-to-Use Freebie!

FREE! Pirate-Themed Jokes with Background (formatted for teleconferencing) (8 Jokes): Looking to try the format before you buy? Grab my free set of 8 Pirate-Themed Joke Backgrounds to test the immediate engagement and ease of use in your classroom today!

Ready to leverage the benefits of humor in your speech therapy? Check out my store and start laughing your way to better outcomes!

Keep that funny bone tickled,

Social Media Icons: designed by rawpixel.com – Freepik.com

The post 🧠 Why Jokes Are the Best Zero-Prep Language Tool You’re Not Using appeared first on Mrs. Speech Online.

Motivators

Just like our younger clients, older students love a good reward at the end of a challenging session. The beauty? They’re experts at navigating YouTube, so they can easily cue up their favorite vids. But wait, there’s more! I love introducing them to some lesser-known gems that pack a powerful punch:

Flexible thinking and how the mind learns new things:

Backwards bicycle: this was mind-blowing to watch!

How mistakes are okay and help you learn:

OK Go Rube Goldberg Machine (I talk about how you can see the evidence of how many previous tries – 85 to be exact – they had to get it right, but how awesome it was when they got it right.  BTW, the song itself has a great message of how bad things are only temporary.) It’s also useful to see the TEDTalk on how it was engineered. (Caution, the TEDTalk has one minor cuss word and the band is having a drink of champagne at the end.)  If you don’t know what a Rube Goldberg machine is, it is a YouTube rabbit hole.  I warned you.

The Power of a Stutter

A TedTalk on how accepting your insecurities and even embracing them allows us to become better communicators.  How it frees us from worrying about hiding them to think about how we can speak to and help others. (BTW, she has a very noticeable stutter so this is an excellent video for your fluency students.)

Teaching Support

How to make sounds

I’m probably not alone when I say that I turn to these when I have a kid I just can’t get to make the sound, especially now that I am wholly teletherapy.  My camera just isn’t as professional as what I can find on YouTube.  The two best sources for sound instruction I’ve found are Sharon Turner, who has a animated video model of the tongue inside the mouth for each sound, and Peachie Speechie, who has great teaching videos for each sound.  But there are many, many options to choose from.

Read-Alouds

I’m using short stories in most of my older groups.  When we first read a story, I want it to be a dramatic, cohesive reading, so I actually don’t want the students to read it.  I want them to listen and be drawn into the story.   But you know, a day of that and my voice gets tired.  Cue YouTube read-alouds!  You can find an audiobook of most popular short stories on YouTube pretty easily.  And bonus – most you can turn on Closed Captioning so students can read-along if you don’t have a text that matches well.  And the students actually love being read to.  If I have a student who needs to read for a goal, then I can stop and have them read a paragraph or so, then return to the read aloud. I have playlists of some of my favorites at http://www.youtube.com/@Mrs.Speech-wk4mr.

Background Knowledge

To go along with the read-alouds, a well-made video to give background knowledge is worth so much more than me droning on about what life in a lighthouse is like.  You know what they say, “A picture is worth a thousand words.”  Well, a video must be worth a million, right?!  And they are so much more willing to watch a video than listen to me (and let’s be honest, it gives my voice a break).

Movies

And if at all possible, I like to find at least a clip of a movie or animation to go with the story.  It provides so many opportunities for language-rich discussion, with opinions (Which did you like better, and why?) comparing and contrasting, and inferencing (Why do you think the director made this change?).

Social Skills

There are SOOOO many social skills videos out there.  Some of them are tailored toward our autistic population, some are more for introverted young adults, and some are for the ESL population.  Don’t just stick to the videos that tell how-to do something.  Sometimes the awkward videos offer great teaching moments too.  This one is one of my favorites.  While I do touch on what he does wrong, I mainly use it to talk about other people’s responses, and how they are generally kind about it and make an effort to not make him feel bad even though everyone feels awkward.  People are typically kind, so you might as well go out there and try.

Pro Tips 

Now, I mentioned in Read-Alouds to turn on the Closed Captioning if you don’t have a text that matches the reading.  It might be useful to do so with the other videos as well, to make the speech/text connection and fill in any missing gaps in the auditory information.  

I also suggest you turn the speed to 75%.  This is usually not noticeable to the kids, but it allows them more time to process what is being said so they get a better understanding of the information.  

I have more tips in my previous post: Unlocking Language Learning with YouTube: A Speech Therapist’s Guide.

Update 12/24

I recently found the free internet browser Brave and have been using it the past couple of weeks.  It was simple to move my Google bookmarks into Brave, and I am using it solely for use with the kids, so it streamlines my therapy sessions too.  I haven’t had a single youtube ad, and I haven’t noticed other ads popping up on websites.  I will say that, while it does block the ad on a website, there is often still the space where the ad would be.  Often, a reader extension like ReadBee will remove those spaces and focus on the text.

So, there you have it, folks! These are just a few ways to leverage the power of YouTube in therapy sessions with older students. But hey, the possibilities are endless! Got some killer ideas of your own? Drop ’em in the comments below!

Until next time, my e-speechies – keep on clickin’!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post YouTube in Therapy: Engaging Older Students with Smart Strategies appeared first on Mrs. Speech Online.

Now, I know what you’re thinking: “We’ve all used YouTube with kids before.” But bear with me, because there’s more to it than just plopping them in front of the screen while we sip our coffee (although, let’s be honest, sometimes that’s exactly what we need).

Here’s some of the things I’ve found out there in the big wide ‘Tube.

So…while nothing I share here is exactly news-breaking, I hope I have some ideas and links that give you a bit of a boost to your everyday!

Youtube for motivation

First off, there’s the motivator videos, the ones we can offer as rewards or to have kids request. We all know the kids love the great fun stuff out there, and it can be tricky finding what catches each kid’s attention – and it can change rapidly (because nothing is easy!). Depending on what each student likes or needs, it can range from the catchy, energetic songs…

…to repetitive, predictable, calming sensory videos (seriously, I sit back and watch these and am surprised when I look back at the clock at how much time has passed)…

YouTube for concept teaching

Then we have the fun concept teaching videos. These teach concepts in an enjoyable, engaging way that kids don’t realize they are learning. The repetition of each concept is what makes it beautiful, and more often than not, the children will be imitating by the end of the song.  We have core vocabulary songs…

More and All Done Sign Song

…body part songs…

FUN parts of your body song

…Farm animal songs…

Old MacDonald | Real Animals | Jack Hartmann (Love this one, because so many of our kids haven’t actually seen a real pig, let alone heard one)

…Action word songs…

If You’re Happy and You Know It

Story Videos

But what I like best are the story videos, that offer a treasure-trove of language-rich content.  Some of them are musical, like Pete the Cat and Chicka Chicka Boom Boom…

Pete the Cat: I Love My White Shoes

…And others are simply retold with animation. I love the learning English videos, like the ones from English SingSing…

The Three Little Pigs

I find that switching between all of these, and using a mix of planning and using my super SLP thinking skills (because we all know how these best laid plans often go, especially with kids involved), I can hit so many emerging language goals like attending, labelling, requesting and commenting. 

Pro tips for YouTube in therapy

Interactive Viewing

You can pause the video and talk about it, or wait for a request. Or you can watch the whole thing at one time, then use the precise seeking (or link at different times in the video) to go back to different moments to talk about.

Slow it down

Another great thing about many of the English learning videos is that they are told at a slightly slower rate of speech.  But if they aren’t, experiment with using the speed setting.  I find that going to 75% doesn’t usually affect the quality of the speech, but allows the listener more time to process. 

Split your screen 

Divide your screen into two, as to display two different videos side by side, as seen in the first screenshot at the top of this post. This gives. kids a visual choice so they can see what you are offering and point. You can find screen split options by hovering over the square next to the close window ‘x’, as seen in the partial screenshot to the side.  

Theatre Mode

And if you’re worried about distractions, try Theater Mode view to help keep things focused.  It presents the video screen the entire width of the window, so it squeezes out the ads on the side.  

So if I’m able to to have a few moments to reset things before a session, I have the screen split to show two videos side by side in Theater Mode so the child can make a choice.  

If you select full screen, it will fill the entire screen, regardless of whether it is split or not.  So I use that after the child has chosen.  Then I hit escape when we are ready for another choice, to return back to the split screen.

Reduce Inappropriate Ads

Create a separate “school” YouTube account to help reduce the number of inappropriate ads and video suggestions.  

Advertising Hacks

Now, there are some tricks for eliminating ads from YouTube videos, like adding a dash to the url or using a website or browser extension.  Unfortunately, I’ve found that they either don’t work with the Kids videos or they are so unwieldy to use with the short attention spans that it isn’t worth it.  Not to mention YouTube is actively working to block the adblockers.  But you can definitely try them if you’d like!

Update 12/24

I recently found the free internet browser Brave and have been using it the past couple of weeks. It was simple to move my Google bookmarks into Brave, and I am using it solely for use with the kids, so it streamlines my therapy sessions too. I haven’t had a single YouTube ad, and I haven’t noticed other ads popping up on websites.

I will say that, while it does block the ad on a website, there is often still the space where the ad would be. Often, a reader extension like ReadBee will remove those spaces and focus on the text.

Turn Autoplay Off

You don’t want your videos moving on without you.  Go to the settings icon to turn autoplay off.

Organization Tips for Therapy Videos

Now, I know what you’re thinking: how do I keep track of all these fantastic videos? 

Playlists

Yes, YouTube has playlists, and those are great, if you can use them.  Unfortunately, most of these videos are considered YouTube Kids videos, which means you can’t save them to a playlist.

Quick-Access Links – Essential Hack for YouTube in Therapy

Well, fear not! While you can’t save kid videos to your YouTube playlists, you can easily share them, copy the link, and paste it into a handy document for future reference. Don’t forget to set the start time for an even more streamlined list.

I have a document for my Emerging Language Classes that I keep on Outline Mode, and each of the above videos are under their own headings, so they are easy to find while I’m in a session.  It’s a simple trick that keeps everything organized and ready to roll whenever you need it.   

Want to see my list?  Subscribe below for my Early Learning Links and other exclusive freebies.  

Oh, and here’s a bonus hack: before you share and copy the link, set the video to start at exactly the right second to skip any unnecessary chatter at the beginning. Efficiency at its finest!

Want more Youtube resources for therapy?

Visit my Mrs. Speech Youtube Channel for playlists, or check out my next article: YouTube in Therapy for Older Students.

So, there you have it—YouTube isn’t just a time-sucking vortex; it’s a valuable tool for nurturing language development in our young ones. So go ahead, dive into the ‘Tube, and let the learning—and the fun—begin!

Until next time, my e-speechies,

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Unlocking Language Learning with YouTube: A Speech Therapist’s Guide appeared first on Mrs. Speech Online.

Ways to Use Pinterest Pictures

Now, we all know the drill with Pinterest – it’s the go-to hub for all things DIY, recipes, and yes, even therapy ideas! But let me tell you how I’ve been using it to spice up my therapy sessions.

Picture this: I’ve got boards filled to the brim with stimuli. They cover everything from articulation practice to critical thinking and social skills. We could get into a 10 minute discussion on whether it is photoshopped or real on some of these. Or discuss what makes it interesting, or brainstorm what you would do if you were walking around and saw it in person.

So MANY speech and language goals can be addressed with these open-ended materials. They are so much more fun than reading a card or doing a worksheet. Your kids may not even realize they are “working.”

Seriously, my Picture Prompts boards are like a treasure trove for your therapy sessions. Once you get used to using them, and the types of questioning you can use, you will find yourself using them more and more. For now, I have them separated into just a younger board and an older board. However, I have so many pins, I am going to have to separate them further. 

You guys have to come take a peek! Just make sure you set a timer because you will seriously get sucked into the rabbit hole – LOL!

Multiple Meaning Words

One thing my kids LOVE is when I open up the Visual Puns board. It’s a great way to work on multiple meanings and figurative or non-literal language. Not to mention the sheer fun of figuring out what makes each pun tick. The engagement and comprehension seems to skyrocket when I address language goals this way. And the best part – it’s so effortless it seems like a free day for both me and my students!

Tech Tips

Here’s the kicker – using Pinterest in therapy takes a bit of tweaking. But once you get the hang of it, it is smooth sailing, I promise. First, make sure your view options are set for Default, not Compact. You can choose this by using the little slider button in the top left of your board, as you can see in this screenshot.

I like to zoom in until only one or two images are visible. This makes those images pop and limits what my kiddos are focusing on. Ctrl and + on Windows, Cmd and + on Mac – you get the drift. Most browsers also have their own zoom controls.

Why Pinterest for Your Speech Sessions?

Now, why go through all this trouble instead of just hitting that good ol’ Save button? Well, for starters, it saves me from diving into the murky waters of copyright laws. Ain’t nobody got time for that! Plus, who wants to spend hours copy, pasting, and formatting when Pinterest does the heavy lifting for you?

And as we all know, adding to our boards is as easy as pie. I’m constantly stumbling upon gems while tumbling down the internet rabbit hole. With a click here and a pin there, my collection keeps growing faster than I can say “therapy time.” So much easier than trying to add to a document or slideshow or however else you try to organize saved images.

So, there you have it – Pinterest in speech-language therapy. Who knew? But hey, when it works like magic, who am I to argue?

Happy pinning, my fellow e-speechies!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Pinterest in Therapy, No Way! appeared first on Mrs. Speech Online.

Then life threw a curveball, and I resigned from the schools.  I ended up taking a position with a teletherapy company and providing services to various schools.  I was hesitant at first, but after working as a teletherapist for six months, I can say I completely LOVE it!

Comfort

Need I say it? Yoga pants!!!  Business on top, (slumber) party on bottom, am I right?!!  I had a 40 minute, each way, commute before, now I walk down the hall to my office.  I can run to the bathroom or to get a coffee refill or a snack whenever I need.  And have I mentioned no boogers on my stuff?!  I haven’t had a sick day from any child-borne illnesses so far!

Variety

Not all teletherapists have the variety I do, but I have students ranging from mild middle school students to non-verbal kindergarteners.  I enjoy the different caseloads, although it does mean a bit more prep as there is more diversity in goals and materials.  In the morning I get to talk about animal sounds, and in the afternoon I get to teach /r/, and the next day I’m teaching a great short story to work on language skills.

Use of Time

When I worked in the schools, a good part of my time was spent doing duty, attending teacher meetings, filling out paperwork required by the district, completing screenings I was unable to take any action on, performing before or after school requirements such as parent-teacher meetings whether or not I actually had any parents wishing to meet.  Since I was on a contract, I was paid by year, and these times were all under a blanket “duties of the position” statement.

As a teletherapist, I am paid for indirect time as well as direct time.  This differs somewhat from one teletherapy company from another, but from my, admittedly limited, experience, this is typical.  I only attend meetings that directly affect my students.  I feel like I am able to return back to my actual occupation!

Freedom of Scheduling

Along the same lines, I get to draw the lines of my schedule.  I don’t want to work past three?  Then I say I’m not willing to.  I only want to work 30 hours a week?  Then that’s what we shoot for.  I’ve also found that the schools that I work with are more willing to work with me as far as scheduling than I experienced when I worked in a district.  Perhaps I’m just in a sweet spot?  Time will tell.  But I’m loving it right now!

Less Drama

All those powerplays that you couldn’t keep out of in the schools are far less apparent as a teletherapist.  Because we aren’t physically there, we don’t hear the conversations in the halls or the teacher’s lounge. It’s much the same as being at a school part time, where you see your handful of kids and leave.  This, for me, was a fantastic load off my shoulders, because that kind of conflict stresses me out – and there was always someone who was running to me complaining about something.  Now, this can be a drawback as well, especially if you thrive on those connections.  But you can also make connections with your team of teletherapists.

Efficacy of Therapy

Now, do I think I can do therapy as well through a computer as I can in-person?  Yes!  Now, that being said, there are, of course, some caveats.  The method of therapy should be considered for each client just as the time, length and frequency of therapy should be considered.  Often, as my younger students have, a facilitator may be present to aid the client in attention and accessing the technology. 

Other clients may need a different service model that is more of a parent training model.  A setup that includes a separate camera that shows the student’s AAC device so you can see their key presses, or other modifications might be necessary.  With flexibility and creativity, there really is a lot more you can do in teletherapy than you ever thought!

Drawbacks

Ok, yes, I miss the goodies in the teachers’ lounge.  And I REALLY miss the hugs and actually seeing my kiddos.  Sometimes, it is challenging when I have a student that just can’t get a specific speech sound…but I’m not sure being in person would help that either.  Tech issues can be frustrating, when the microphone isn’t catching a nuance of sound or the connection isn’t good.  But there were also times when the hallway outside my room, or the room beside my room, or the restroom beside my room, were so loud that I had trouble then too.  So I might be comparing apples and oranges there.

I’m not necessarily writing this to convert any of ya’ll from in-person therapists to teletherapists, but definitely, should it come to you, don’t be afraid of it.  It could be your next great thing!

If you want to know more about teletherapy, or the company I contract with (starting on my third year with them), feel free to reach out!

If you are interested in the topic of teletherapy, you might also be interested in my comprehensive guide, “So You Want to Be a Teletherapist.” It covers all these topics and more, including setting up your workspace, navigating legal documents like BAAs, and building a secure and efficient digital practice from the ground up!

Want a taste? Subscribe to my newsletter today to get the entire Chapter 3! This 26-page guide walks you through setting up your home office with the right hardware and peripherals to optimize your virtual practice while staying HIPAA-compliant.

Until next time, keep on clicking, my e-speechies!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Why I Love Being a Teletherapist: From Skeptic to Superfan appeared first on Mrs. Speech Online.

Teleconferencing has become a significant part of many educators’ and therapists’ lives. While it presents unique challenges, it also offers incredible flexibility. Here are some essential teleconferencing tips and tricks I’ve learned during my time providing full-time teletherapy services to school-aged children:

Invest in a Second Monitor (A Big One!)

This is a game-changer! I use my laptop screen for the Zoom window, one side of the TV for displaying therapy materials (flashcards, videos, etc.), and the other side for my therapy portal (to track student goals and document sessions). I often have two windows that I screenshare, if I have a visual aid for the activity or am giving students choices between activities.  This also means you can keep your icons to a minimum on your tv desktop.

Read my post on Unlocking Language with Youtube for Youtube specific tips, such as Youtube settings and some invaluable playlists.  I also have a post Youtube in Therapy for Older Students.

You might need to adjust the TV height to prevent your laptop screen from blocking the view. Experiment with resolutions to find a comfortable balance between readability and screen real estate.

Prioritize Audio Quality

Invest in a good quality headset with a microphone. While your laptop’s built-in microphone and speakers may suffice, higher-quality audio is crucial, especially for working on articulation skills with young children. Encourage students to use headphones with microphones as well, which can help minimize distractions and keep them engaged.

Bonus remote meeting advice: Noise reduction features are often enabled by default in conferencing apps and computer settings. However, these algorithms can inadvertently cut off crucial sounds, such as the beginnings and ends of words, particularly fricatives like /s/. This can be incredibly frustrating when working on specific speech sounds. Ensure noise reduction is disabled on both your device and the student’s device.

Embrace Ad Blockers

Online resources like YouTube are invaluable for therapy activities, but those pesky ads can be disruptive. I highly recommend using an ad blocker. 

I personally use the free browser “Brave,” which effectively eliminates most ads, including those that appear within videos. It leaves a small white space where the ad would have been. As a bonus, using a dedicated browser for therapy helps keep your bookmarks organized and streamlined.

Turn Your Phone into a Document Camera

Many of us have accumulated a wealth of physical therapy materials over the years. Instead of letting them gather dust or (illegally) scanning them, repurpose them with a document camera. While there are some relatively inexpensive options out there, you can use your phone or another device to capture images or videos of your materials. (This is a great use for those older, unused devices, just connect them to your wireless connection). 

There are numerous online tutorials available to guide you through the setup process, although most are from the COVID epidemic so the technology may have changed somewhat.  I found this one particularly helpful. This is especially beneficial for teaching students using Augmentative and Alternative Communication (AAC) systems.  You might even consider asking for the same setup on the other side, especially if you are testing!

Background Leverage

Don’t just settle for a boring background! Get creative and use it as a teaching tool. You could use an underwater scene for a unit on ocean life, a construction scene for construction vocabulary.  Maybe you post a timeline for the session, or another visual aid.  

FYI – if you have your video mirrored (most of us do), it will appear backwards in your video view, but the right way on your students’ view.

I incorporate a “Pun of the Day” with a themed visual background to encourage flexible language use and explore multiple meanings of words, not to mention starting therapy off with a smile!  *whisper* I have a 56 pages of puns (21 pages of holiday-themed) in my TPT store – It’s So Punny!

Maximize Your Mouse Pointer

Enlarging your mouse pointer makes it easier to locate on the larger screen and improves its effectiveness for pointing out items to students.

Master Video Conferencing Tools

Explore and utilize the built-in tools within your chosen conferencing platform (Zoom, Google Meet, etc.). The whiteboard function is excellent for quick demonstrations and brainstorming, and many students prefer drawing on it to playing online games. The annotation feature allows you to draw or type directly onto any screen-shared content.

Lighting

You want good lighting so students can see your face well.  The room I use as my office is rather dark.  I’ve tried ring lights, and lamps, but they produce strong shadows unless they are low enough that I can’t really tell a difference in my camera, and even then they are rather blinding.  I’ve even tried facing them away from me, toward the wall behind the big screen.  The best solution I’ve found is dispersed light with multiple sources, pointing up or toward a wall, and thoroughly checking the video settings in both my computer and Zoom.  I’ll update with any other options!

Understand Your Students’ Setups

Before the initial therapy session, have a brief conversation with the student or their caregiver to understand their technology setup.

• Device: Are they using a laptop, tablet, or *shudder* a phone? The size of your share screen will differ according to the size of their device, so consider adjusting your materials accordingly.
• Input Methods: Do they have touch screen, trackpad, or mouse control? How comfortable are they with their chosen input method?
• Conferencing App Configuration: How is the conferencing app configured (e.g., speaker view, gallery view)? Will you be sharing your screen during the session?
• Environment: Are they in a shared space, and if so, what steps can be taken to minimize distractions (e.g., headphones, quiet corner, clear communication with other household members)?
• Internet Connectivity: Briefly inquire about their internet connection to anticipate potential connectivity issues. For example, if they have a slower connection, you may want to consider activities with a lower bandwidth demand, such as games or activities that don’t rely heavily on video.

Student Support System

• Adult Supervision: For safety reasons, it’s crucial to ensure that an adult is always present and supervising the child during teleconferencing sessions.
• Behavior Support: Do they have any behavior support available during sessions (e.g., a parent, teacher, or paraprofessional)?
• Technical Support: Do they have access to any technical support (e.g., a parent, teacher, or school IT support) if they encounter difficulties?

By gathering this information beforehand, you can proactively address potential challenges and ensure a smoother and more effective teletherapy session for both you and your student.

Consider sharing control

Kids are way more into therapy when they feel like they have some control. Sharing your screen can be a game-changer! Let them explore interactive websites, pick their own activities, or even guide the presentation. It makes things more fun and helps them feel like they’re in charge (in a good way!).

Keep in mind that when a student has control of the mouse, it prevents you from using it for other things like entering therapy notes or navigating to other resources.  Having them play a game while you enter notes sounds like a great idea, but I haven’t found a way to split control.

Sometimes you might need to gently remind them to let you take back the mouse, but usually, it’s worth it for the extra engagement and motivation.

Key Telework Pointers: Health & Wellness

Teletherapy can present unique ergonomic challenges. Since you’re likely sitting in front of your computer for extended periods, prioritizing your health and wellness is crucial.

Ergonomics: 

• Chair and Desk Height: Ensure your chair and desk are at the correct height to maintain proper posture. Your feet should be flat on the floor, and your forearms should be parallel to the ground when typing.  You might find a footrest useful.
• Mouse and Keyboard Positioning: Position your keyboard and mouse close to your body to minimize reaching and maintain a neutral wrist position. Consider using a wrist rest for added support.
• Camera Positioning: Position your camera at eye level to maintain natural eye contact with your students.  Keep your conference video at eye level to increase eye contact.

Minimize Eye Strain:

• Blue Light Filter: Use a blue light filter on your computer screen to reduce eye strain. This can be done through your computer’s display settings or by using a dedicated software application. (I also prefer Dark Mode.)
• 20-20-20 Rule: Follow the 20-20-20 rule: Every 20 minutes, look at something 20 feet away for 20 seconds.

Incorporate Movement: 

Schedule regular movement breaks throughout your workday. Stand up, stretch, walk around, or do some simple exercises.

Stay Hydrated: 

Keep a water bottle nearby and sip water throughout the day to stay hydrated.

Set Boundaries:  

Establish clear boundaries between work and personal time.  When you’re not working, disconnect from technology and engage in activities that you enjoy.

By prioritizing your own health and wellness, you’ll be better equipped to provide high-quality teletherapy services to your students and avoid burnout.

Collaborate and Share

Teletherapy presents unique challenges, but it also offers opportunities for collaboration and shared learning. Connect with other educators and therapists online to exchange tips, share resources, and support one another.

By incorporating these indispensable video conferencing strategies into your teletherapy practice, you can create engaging and effective learning experiences for your students, even from a distance.

I’d love to hear about your own teletherapy tips and tricks! Please share your insights in the comments below.

If you found these tips helpful, you might be interested in my comprehensive 140+ page guide, “So You Want to Be a Teletherapist.” It covers all these topics and more, including setting up your workspace, navigating legal documents like BAAs, and building a secure and efficient digital practice from the ground up!

Happy conferencing!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Essential Teleconferencing Tips for SLPs and Teachers appeared first on Mrs. Speech Online.

Hey SLP fam!

Let’s talk about HIPAA compliance at home. I know it’s something that might make your brain do a little loop-de-loop! Whether you’re rocking the teletherapy life from your home office, hustling in a school building, or bringing a stack of papers (or digital files!) home to tackle after hours, you’re dealing with sensitive information.

I remember grad school, taking out the black Sharpie to strike through names and addresses on stacks of papers. It’s what we did, back in the day, to share ideas about goals and treatment plans without breaking client confidentiality. Even with extensive redactions like those seen here, simply blacking out information may not be enough to meet HIPAA’s stringent de-identification requirements. And in the digital age… well, let me share with you.

My HIPAA Compliance wake-up call:

I recently had a bit of an “aha!” moment (or maybe more of an “uh-oh!” moment) for HIPAA compliance at home. I don’t even remember how I found out, but I realized my free Google account wasn’t exactly HIPAA-compliant for handling student info. And that got me thinking… if I was a bit fuzzy on this, how many of us are? Especially when we step outside the secure walls of our schools or clinics?

It turns out, even when you’re comfy in your PJs or working from your kitchen table after school, you’re still 100% responsible for protecting your clients’ Protected Health Information (PHI), even from your family members (who could probably care less). HIPAA doesn’t care if you’re in a fancy clinic, a bustling school, or your spare bedroom – the rules are the same for how you handle that information.

To help you navigate this essential topic, I’ve even created a free worksheet to guide you in developing your own HIPAA policies and procedures for your home-based work environment!  Let’s break down some key areas, with a special spotlight on those cloud services many of us use daily.

HIPAA Compliance In The Cloud: Google, Microsoft 365, and the BAA

This is where it gets real. Many of us use Google Workspace (Gmail, Docs, Drive) or Microsoft 365 (Outlook, Word, OneDrive) for our personal lives, and our schools or districts often use them too. They’re super convenient, right?

But here’s the kicker: your personal Google or Microsoft account is NOT HIPAA compliant for handling PHI. Full stop.

Why? HIPAA compliance when dealing with PHI requires a Business Associate Agreement (BAA) with third parties (like Google). A BAA is a legally binding contract that outlines how a third-party service provider will protect PHI on your behalf. Without one, you’re on shaky ground.

Districts Using Cloud Services: A Critical Distinction

So, what about districts using Google Workspace or Microsoft 365? 

This is a critical point. While most paid educational plans (often covered by FERPA – the Family Educational Rights and Privacy Act, which governs educational records) offer robust privacy, FERPA compliance doesn’t automatically mean HIPAA compliance for you. 

PHI in a school setting often includes health diagnoses, medical history, or therapy notes related to health conditions. While these are typically considered education records under FERPA, as an SLP, if you bill Medicaid or other health plans, you are a HIPAA Covered Entity. This means the specific health information you handle is subject to HIPAA regulations, even within a FERPA-governed school environment.

For a district’s Google Workspace or Microsoft 365 environment to be HIPAA compliant for PHI, they need to have specifically configured their accounts for HIPAA. Crucially, they need a signed BAA with Google or Microsoft for that specific enterprise-level service.

Your HIPAA Compliance at Home Takeaway:

Don’t assume. If you’re using a district’s cloud services for anything that involves PHI (even if it’s just student names and health-related goals within an IEP), it’s your responsibility to confirm that the district has a BAA in place with their cloud provider for that specific service. 

And critically, confirm that the specific features and services you use are explicitly covered by that BAA. If they are not, or if no BAA is in place, you need to adjust your practices.  This might mean only using district-approved, HIPAA-compliant EHRs,  purchasing your own subscription, or secure local storage, such as the free LibreOffice Suite (See Technical Safeguards below).

Fortunately, I’d been super cautious and hadn’t used my personal accounts frequently for student information, but it was a good wake-up call!

Beyond the Cloud: Other Key Considerations for HIPAA Happiness

While cloud services are a big piece of the puzzle, let’s not forget the other vital aspects of keeping PHI safe, whether you’re working at school or from home.

Core Pillars for HIPAA Compliance at Home

Risk Analysis (aka “Playing Detective with Your Practice”)

Before you even start working remotely or bringing files home, take a good look at your home setup. Where are the potential weak spots? Is your home Wi-Fi secure? Are your personal devices encrypted? Could your nosy family member or roommate accidentally see your screen? Identify these risks and make a plan to fix them. Document everything!

Workforce Training (Yes, You’re the Workforce!)

Even if it’s just you, train yourself! Stay up-to-date on HIPAA and your own policies. And guess what? Document that training too!

Policies and Procedures (Your Personal HIPAA Rulebook)

You’re the boss of your home workspace, so write down your rules! How do you handle PHI on your personal devices? Where do you store it? What’s your plan if something goes wrong (a “breach”)? Having these written policies keeps you consistent and gives you a roadmap in a pinch. You should also be intimately familiar with your employer’s HIPAA policies, if applicable.

Business Associate Agreements (BAAs)

We talked about this with cloud services, but it applies to almost any third-party service you independently contract that touches PHI. Your teletherapy platform (if you use one), your EHR, your billing service, even encrypted email services – they all need a BAA. Beware of “free” or even personal versions of platforms; they usually do NOT offer BAAs.

Incident Response Plan (Your “Oh Crap” Protocol)

What if your personal laptop gets stolen? What if you accidentally email PHI to the wrong person? Have a clear plan for what to do: contain the issue, investigate, notify affected individuals (and potentially HHS), and prevent it from happening again. Your district should also have a plan; know it!

Physical & Technical Considerations for HIPAA Compliance At Home

Physical Safeguards (Lock it Up!)

• Ensure your home workspace is private.
• Close the door and position your screen away from prying eyes.
• Lock up any physical paper records containing PHI.
• Shred unneeded documents securely when done.
• Never leave PHI visible or accessible to others in your home.

Technical Safeguards (Your Digital Fort Knox)

• Encrypt EVERYTHING: All devices (laptops, desktops, external drives, mobile devices) storing or accessing PHI must be encrypted. This is crucial if a device is lost or stolen.
• Strong Passwords & MFA: Use complex, unique passwords. Enable multi-factor authentication (MFA) everywhere possible for accounts with PHI.
• Antivirus/Firewall: Keep your software updated and firewalls active.
• Secure Network: Use a strong, secure home Wi-Fi connection. NEVER handle PHI on public Wi-Fi. If connecting to your school’s network from home, always use their provided VPN if available.
• HIPAA-Compliant Platforms: For teletherapy, use platforms specifically designed for HIPAA compliance, with end-to-end encryption and a BAA.
• Secure Communication: Stick to secure messaging within your EHR/school system or encrypted email for PHI. Avoid regular email, WhatsApp, or FaceTime for anything confidential.

A Crucial Note on “De-identification” and AI Tools

Here’s a big one that’s becoming more relevant with the rise of AI…

**Simply removing a client’s or student’s name or a few obvious identifiers does NOT make the information safe to use.**

General-purpose, free AI tools like Gemini or ChatGPT, or even education tools like MagicSchool.ai, are NOT HIPPA compliant. Even if you pay for Gemini Pro, there is no BAA unless it comes with a Workspace plan.

HIPAA De-identification is Stringent

HIPAA has very specific and stringent rules for what constitutes truly “de-identified” information. It’s far more complex than just deleting a name. If you use PHI, even seemingly “de-identified,” with a service that doesn’t have a BAA and isn’t designed for PHI, you’re risking a breach. This means:

Do NOT copy/paste session notes, IEP sections, or any other PHI, even with names removed, into general AI tools like Gemini, ChatGPT, or other free online summarizers to help you write notes, develop goals, or for any other purpose. These services do not typically offer BAAs and are not designed to protect PHI.

The data you input into these tools can become part of their training data, meaning your client’s potentially re-identifiable information could be exposed or used in ways you can’t control.

When in doubt, don’t put it in a service without a BAA! This applies whether you’re trying to draft a progress note at home or summarize a student’s history.

Ready to HIPAA-Happy Your Home Office?

Developing comprehensive HIPAA policies and procedures for home can feel daunting, but it’s a crucial step in safeguarding your clients’/students’ PHI. To make it easier, I’ve created a free, actionable worksheet to guide you through identifying your unique risks and writing down your specific policies for working from home.

Sign up to Download Your Free HIPAA Compliance Home Office Policies & Procedures Worksheet!

The Bottom Line

HIPAA compliance in the cloud or at home can feel overwhelming, but it’s crucial for protecting our clients/students and our professional integrity. Take it step-by-step. Conduct that risk analysis, get those BAAs in place for any services you control, and secure your devices and workspace. Always defer to and understand your district’s policies first and foremost.

It’s a journey, not a destination, so stay informed and don’t be afraid to consult legal counsel or your district’s HIPAA compliance officer if you have specific questions about your practice.

Want to know more?  Check out Navigating Business Associate Agreements as an SLP: Your HIPAA BAA Guide.

What are your biggest HIPAA challenges as an SLP, whether in a school or teletherapy setting? Is there anything you’d like to know more about?  Share your thoughts in the comments below!

Coming up next – an 8-part series on AI & SLPs!

Remember, you are awesome because you do the best with what you know – and taking steps toward HIPAA compliance at home is truly doing your best for your clients.

Keep up the amazing work!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security appeared first on Mrs. Speech Online.

In my last post, HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security, we got real about HIPAA compliance for home offices and personal devices. We covered that many of us are HIPAA Covered Entities and how crucial it is to safeguard Protected Health Information (PHI) wherever we practice, even at home. Navigating Business Associate Agreements as SLPs is an important piece of that compliance.

Today, we’re zooming in on one of the most critical, yet often overlooked, pieces of that HIPAA puzzle: the Business Associate Agreement (BAA). Think of it as your golden ticket to legally sharing PHI with necessary service providers, while ensuring that data stays locked down.

I’ll be the first to tell you, this is a new topic for me. I was unaware of most of this information just a few weeks ago! My eyes have really been opened and I’m changing the way I work based on this new information. Especially as a teletherapy contractor, I’ve been working to upgrade my services to business grade. (You can read all about it here: My Personal HIPAA Compliance Journey: Steps to Secure Data)

Disclaimer:

The information provided in this blog post is for informational and educational purposes only and is not intended to constitute legal or professional advice. HIPAA compliance is complex and constantly evolving. While efforts have been made to ensure the accuracy of the information presented, it may not reflect the most current legal developments, nor is it guaranteed to be complete or applicable to your specific situation.As a healthcare professional, it is your responsibility to understand and comply with all applicable federal, state, and local laws and regulations, including HIPAA. This content should not be used as a substitute for seeking qualified legal counsel from an attorney specializing in healthcare law, particularly concerning your individual practice, specific vendor relationships, or unique circumstances. Reliance on any information provided in this post is solely at your own risk.

What Exactly IS a Business Associate Agreement (BAA)?

At its core, a Business Associate Agreement (BAA) is a formal, legally binding contract between you (the Covered Entity) and any person or entity (the Business Associate) that performs services for you that involve the creation, receipt, maintenance, or transmission of Protected Health Information (PHI).

Why do I need a BAA as an SLP? 

The BAA is HIPAA’s way of extending the privacy and security obligations beyond just your practice. It legally obligates your Business Associates to:

• Safeguard PHI: They must implement their own administrative, physical, and technical safeguards to protect PHI, just like you do.
• Limit Use/Disclosure: They can only use or disclose PHI as permitted by the BAA and HIPAA regulations.
• Report Breaches: They must notify you if they discover a breach of unsecured PHI.
• Cooperate with Audits/Investigations: They may be subject to direct enforcement actions by the Department of Health and Human Services (HHS).
• Flow-Down Rule: If they use subcontractors who access PHI, they must have a BAA with their subcontractors too!

In short: No BAA, No PHI Exchange. You cannot share PHI with a service provider unless you have a signed BAA in place, or that provider falls under a very narrow exception. Failing to get a required BAA can lead to significant fines and penalties for your practice if a breach occurs.

What Does a BAA Actually Look Like? Key Sections to Expect

While the exact wording of a BAA can vary between vendors, they generally follow a standard structure and include specific clauses mandated by HIPAA regulations, as outlined by the U.S. Department of Health & Human Services (HHS). When you receive one, here’s what you can expect to see:

I. Core Agreement Details

These sections lay out the basic framework and definitions of the Business Associate Agreement.

• Introduction & Parties:
  • Purpose: States the agreement’s goal (to comply with HIPAA by protecting PHI).
  • Effective Date: When the BAA officially begins.
  • Parties Involved: Clearly identifies you (the Covered Entity) and the vendor (the Business Associate) by their full legal names and addresses.
• Definitions:
  • This section will define key HIPAA terms as they apply to the agreement, such as “Protected Health Information (PHI),” “Electronic PHI (ePHI),” “Covered Entity,” “Business Associate,” “Breach,” “Security Incident,” and the “HIPAA Rules” (Privacy, Security, and Breach Notification Rules). This ensures both parties are on the same page legally.

II. PHI Usage & Protection Obligations

This crucial category outlines how the Business Associate is permitted to use PHI and the safeguards they must have in place.

• Permitted and Required Uses and Disclosures of PHI by the Business Associate:
  • This is a core section. It specifies exactly how the Business Associate is allowed to use and disclose PHI to perform the services for which you hired them. For example, an EHR vendor’s BAA would permit them to store, process, and transmit PHI for your charting and billing.
  • It will also outline any disclosures required by law (e.g., to the Secretary of HHS for compliance investigations).
  • Crucially, it will state that the BA cannot use or disclose PHI in any way that would violate HIPAA if done by you, the Covered Entity.
• Obligations of the Business Associate (Safeguards):
  • This section details the security measures the Business Associate must implement to protect PHI. It often references the HIPAA Security Rule and its requirements for administrative, physical, and technical safeguards.
  • Key phrases you’ll see include commitments to:
    • “Implement appropriate safeguards to prevent unauthorized use or disclosure of PHI.”
    • “Comply with the HIPAA Security Rule with respect to electronic PHI.”
    • “Ensure the confidentiality, integrity, and availability of ePHI.”

III. Breach Reporting & Compliance Provisions

This category covers what happens in case of a security incident or breach. It also describes how the Business Associate handles relationships with their own subcontractors.

• Reporting Obligations (Breaches and Security Incidents):
  • A critical component. The BAA will clearly define the Business Associate’s responsibility to report any “Security Incidents” (e.g., failed login attempts, malware attacks that might affect PHI) and, more importantly, any confirmed “Breaches of Unsecured PHI.”
  • It will specify the timeframe for reporting (e.g., “without unreasonable delay,” often 10-15 business days from discovery) and what information they must provide in the breach notification.
• Subcontractors:
  • This clause is essential. It requires the Business Associate to ensure that any of their subcontractors who create, receive, maintain, or transmit PHI on behalf of the Business Associate also agree in writing to the same HIPAA restrictions and conditions that apply to the Business Associate. This is often called the “flow-down” provision.

IV. Client Rights & Agreement Management

These sections ensure client rights regarding their PHI are upheld and define the terms for the BAA’s lifespan.

• Access, Amendment, and Accounting of Disclosures:
  • The BAA will ensure that the Business Associate cooperates with your obligations to individuals regarding their PHI, such as allowing individuals to access, amend, or receive an accounting of disclosures of their PHI.
• Termination:
  • Outlines the conditions under which the agreement can be terminated (e.g., for material breach of contract).
  • Crucially, it details the Business Associate’s responsibilities upon termination, which typically include returning or securely destroying all PHI received from or created on behalf of the Covered Entity, if feasible. If not feasible, they must continue to protect the PHI.
• Miscellaneous Provisions:
  • Standard legal clauses like governing law (which state’s laws apply), notices, and how amendments to the BAA will be made.

Important Note: You won’t usually negotiate a BAA provided by a large vendor like Google or an EHR. Their BAAs are standardized. Your role in a BAA as an SLP is to read it carefully to ensure it meets HIPAA’s requirements and your understanding of the service. If you have any concerns or complex situations, consulting an attorney specializing in healthcare law is always advisable.

• Google has a publicly available HIPAA Compliance help page with a link to their BAA.

Who Do You Need a BAA With? The “Access to PHI” Rule

This is the million-dollar question! The key is whether a service provider, in the course of performing services for you, has “access to” PHI. This “access” is much broader than just storing or directly viewing the data. It includes any service that processes, handles, or routinely interacts with PHI.

Here are common service categories where you absolutely need a Business Associate Agreement as an SLP:

Services Directly Managing Client Data & Communication

Electronic Health Record (EHR) / Practice Management Systems:

• Why: These are the central hubs for all your client data, including diagnoses, treatment plans, notes, and billing information. The vendor maintains and processes all this PHI.
• Examples: SimplePractice, TherapyNotes, TheraPlatform, ClinicSource, or any specialized EHR/PM system you use.

Telehealth / Video Conferencing Platforms:

• Why: When you conduct teletherapy sessions, PHI (audio, video, screen shares, chat messages) is transmitted through and processed by the platform’s servers. Even if they don’t store the video, the transmission involves access.
• Examples: Zoom for Healthcare, Doxy.me, SimplePractice Telehealth, or any specific HIPAA-compliant telehealth solution.
• Crucial Note: Free, consumer versions of platforms like standard Zoom, Google Meet, or FaceTime are NOT HIPAA compliant and will not sign a BAA. Never use these for PHI.

Cloud Storage & Productivity Suites:

• Why: If you save any client notes, reports, scanned documents, or other files containing PHI to a cloud drive, or use cloud-based email/document services where PHI might reside or pass through.
• Examples: Google Workspace (formerly G Suite), Microsoft 365 (formerly Office 365), Dropbox Business.
• Crucial Note: You must have the business or enterprise versions of these services, and you must specifically request and sign their BAA. Standard consumer accounts (e.g., free Gmail, personal Dropbox) do NOT offer BAAs and are not HIPAA compliant for PHI.

Email Marketing & Communication Platforms (if used for client communications):

• Why: If you use an email service to send appointment reminders, share resources, or communicate anything with clients that could be considered PHI (even indirectly), your email provider needs a BAA. Your personal Gmail or Outlook.com accounts are out!
• Examples: Certain secure email providers often bundled with EHRs or business productivity suites.
• Crucial Note: Again, consumer email services are generally not HIPAA compliant for handling PHI, as they typically do not provide the necessary Business Associate Agreements. Ensure your email provider offers a BAA.

Billing & Claims Processing Services:

• Why: These services handle all the financial PHI related to your clients, including diagnoses, procedure codes, and personal identifying information.
• Examples: Any third-party billing company or clearinghouse you use to submit claims.

Infrastructure & Support Services with PHI Access

These services may not directly process your core client notes. However, they have access to the underlying systems, devices, or physical records that contain PHI. This makes a BAA essential for SLPs that use them.

Antivirus and Endpoint Security Solutions:

• Why: This one often surprises people! Antivirus software constantly scans and interacts with all files on your hard drive, including those that may temporarily contain PHI. It monitors network traffic where PHI is transmitted. Many also send telemetry data back to their servers, potentially including fragments of PHI. Because of this direct and persistent access to data on devices that handle PHI, the antivirus vendor becomes a Business Associate.
• Examples: Business-grade versions of solutions like Trend Micro Apex One, Bitdefender GravityZone, ESET Endpoint Security, CrowdStrike, or Symantec Endpoint Protection.
• Crucial Note: Most free or consumer-grade antivirus products (like the version of Avast we discussed) are not suitable for devices handling PHI because they typically do not offer BAAs. (I’m having trouble finding one that offers a BAA for a sole entity.)

IT Support / Managed Service Providers (MSPs):

• Why: If an IT professional accesses your computer systems, servers, or network to perform maintenance, updates, or troubleshooting, and those systems contain or access PHI, they are a Business Associate. They have access to the underlying infrastructure that houses your PHI.
• Examples: Any company or individual you hire to manage your practice’s technology infrastructure.

Physical Document Shredding/Disposal Services:

• Why: If you use a third-party service to shred or dispose of paper records containing PHI, they are handling and destroying that PHI on your behalf.
• Examples: Shred-it or local shredding services.

Who Doesn’t Need a BAA? The “Conduit Exception”

Not every single service you deal with as an SLP needs a BAA (Whew!). The most common exception is for entities that merely act as a “conduit.”  This is a principle often referred to as the “Conduit Exception Rule,” as further detailed by the HIPAA Journal..

• Internet Service Providers (ISPs): Your home internet provider (e.g., Comcast, AT&T, Spectrum) typically does NOT need a BAA with you. Their role is limited to transmitting information, like a digital postal service. Any access they might have to the content of your data is transient and incidental, simply for the purpose of moving the data. They aren’t storing or processing the PHI itself.
  • Important Caveat: While the ISP itself doesn’t need a BAA, you are still responsible for securing your own home network (strong Wi-Fi passwords, updated router firmware, firewalls). The data you send should be encrypted by the services you’re using (EHR, telehealth, etc.) before it travels across the internet.
• The U.S. Postal Service (USPS) or other mail couriers (e.g., FedEx, UPS): If you mail physical documents containing PHI (securely, of course!), these services are considered conduits.

The School SLP, BAAs & Educational Platforms (Google Workspace, Microsoft 365, etc.) Deep Dive:

If you’re an SLP working with a school district that uses Google Workspace for Education or Microsoft 365 Education (or similar educational platforms), here’s your specific action plan for BAAs and handling PHI:

• The School’s BAA with the Platform Provider: Your absolute first step is to confirm with the school district’s IT department or administration if they have a BAA in place. Both Google and Microsoft do offer BAAs for their education editions (from what I could find). However, the school administrator must specifically enable HIPAA compliance settings and accept the BAA for it to be active. Without this, the platform is NOT HIPAA compliant for PHI.
• Your Use within Their System: IYou might be covered under your school’s HIPAA umbrella, provided these conditions are met:
  • The school has a Business Associate Agreement (BAA) with the platform provider.
  • Your use of their provided account (e.g., your school district Google or Microsoft account) falls under their defined, HIPAA-compliant policies. It’s crucial that you adhere strictly to the school’s internal policies and procedures for handling student health information within these platforms.
• No BAA from School? Big Problem! If the school district does not have a BAA in place with Google, Microsoft, or any other cloud service they’re making you use for PHI, you cannot legally use those services for PHI. You would need to advocate strongly for them to become compliant or use alternative, secure methods for your PHI handling that are sanctioned by the school and meet HIPAA standards. Using non-compliant platforms for PHI, even if mandated by a school, could put your personal license and practice at risk if you are a Covered Entity.

Working At Home: SLP Security Beyond a BAA

Taking Work Home/Using Personal Devices

This is a common scenario and a significant HIPAA risk. If you take work home that involves PHI (e.g., student health records, IEPs with medical details, notes with diagnoses) and use personal devices or home networks:

• No PHI on Personal Devices (Unless Controlled): Ideally, avoid storing or processing any PHI on your personal computer, tablet, or phone unless these devices are explicitly managed by the school’s IT department with appropriate security configurations (encryption, remote wipe capabilities, etc.) and covered under their HIPAA compliance program.
• Secure Remote Access: If you must access school-based PHI from home, you should only do so via secure, encrypted channels provided by the school (e.g., a Virtual Private Network (VPN) connection to the school’s server, or accessing cloud-based platforms directly through a web browser on a school-managed or properly secured device).
• Physical Security: If you bring physical documents containing PHI home, they must be stored securely (e.g., in a locked filing cabinet) and never left visible or accessible to others in your household. Any physical PHI you need to dispose of at home must be shredded securely, not just thrown in the trash.
• Home Network Security: Ensure your home Wi-Fi network is password-protected with a strong, unique password and that your router firmware is up to date.

Your Personal Private Practice/Billing (if applicable)

If you, as an individual SLP, have a private practice, even a few hours a month, and bill Medicaid or other health plans electronically, you are unequivocally a HIPAA Covered Entity. If you use any Google Workspace or Microsoft 365 features (even if provided by the school) for your private practice PHI that isn’t part of the school’s “education record” (e.g., your own private therapy notes for direct billing, your own client contact lists), you need to be very clear about how that PHI is handled. It’s often safest and most advisable to maintain entirely separate, fully BAA-covered systems for your SLP work to avoid commingling data and potential compliance issues.

The Risks of Skipping a BAA for SLPs: Why It Matters to YOU

You might be thinking, “This is a lot of paperwork! It’s just little ole me!” But the consequences of not having a required BAA can be severe:

• Hefty Fines & Penalties: The HHS Office for Civil Rights (OCR) can impose significant civil monetary penalties for HIPAA violations. Failing to have a BAA is a direct violation. Fines range from hundreds to hundreds of thousands of dollars per violation, potentially reaching millions annually.
  • Real-World Example: Reports from sources like Paubox highlight documented cases of covered entities facing substantial fines (e.g., hundreds of thousands to millions of dollars) for failing to execute BAAs with vendors who then experienced a breach. For instance, in one case, a medical center paid $240,000 for HIPAA Security Rule failures, including issues with a Business Associate Agreement. Another entity paid $500,000 for PHI exposure due to the absence of a BAA with a medical billing contractor.
• Legal Liability: If a Business Associate mishandles PHI and you don’t have a BAA in place, you (the Covered Entity) can be held directly liable for their actions. This could lead to lawsuits from affected clients.
• Increased Data Breach Vulnerability: Without a BAA, you have no contractual assurance that your vendor is implementing the necessary security safeguards. This leaves your clients’ sensitive information vulnerable.
• Reputational Damage: A data breach or HIPAA violation severely erodes client trust and can lead to significant reputational harm, impacting your ability to attract and retain clients.
• Audit Red Flag: During an OCR audit or investigation, one of the first things they’ll check for is signed BAAs. Missing BAAs are an immediate red flag that can trigger deeper scrutiny and more severe penalties, as discussed by Secureframe and other compliance resources.

Best Practices for Managing Your BAAs

Once you start collecting BAAs, effective management is key:

• Create a Vendor Inventory: Maintain a clear, organized list of all your service providers. For each, note:
  • Vendor Name
  • Service Provided
  • PHI Accessed (e.g., clinical notes, billing data, demographics)
  • BAA Status (Yes/No)
  • Date BAA Signed
  • Date for Next Review (e.g., annually, or upon contract renewal)
  • Location of Signed BAA (digital file path or physical folder)
• Due Diligence is Key: Don’t just get a signed BAA; conduct basic due diligence. While you don’t need to perform a full security audit, ask questions about their security practices (e.g., do they encrypt data? do they have strong access controls? do they perform their own risk assessments?). A good BAA means they’ve agreed to protect PHI, but you should still have a reasonable assurance that they can and do.
• Regular Review and Update: Your practice and the services you use will evolve. Review your vendor inventory and all BAAs annually, or whenever:
  • You change a service provider.
  • A vendor changes the services they provide.
  • HIPAA regulations are updated.
  • There’s a significant change in your practice operations.
• Document Everything: Keep all signed BAAs, vendor communications about security, and your internal review notes meticulously organized. In the event of an audit, documentation is your best friend.

Your Action Steps for BAA Compliance as an SLP:

1. Inventory Your Vendors: Make a list of every service provider (including software and online platforms) that interacts with PHI in your practice.
2. Assess “Access to PHI”: For each vendor, ask: “Does this service create, receive, maintain, or transmit PHI on my behalf, or does it have persistent access to PHI?”
3. Request a BAA: If the answer to #2 is “yes,” contact the vendor and request their BAA. Most legitimate business-grade services for healthcare will have one ready.
4. Read and Understand: Don’t just sign! Read the BAA carefully to understand your and their responsibilities.
5. Document: Keep all signed BAAs on file as part of your HIPAA compliance documentation.
6. Regular Review: Revisit your vendor list and BAAs annually, or whenever you add a new service or there’s a significant change in your practice or technology.

You can do it!

Navigating Business Associate Agreements as an SLP can feel overwhelming, but it’s a critical aspect of being a responsible and compliant healthcare provider. By taking these proactive steps, you’re building a strong foundation of trust and security for your clients and your practice.

Want to know more? Check out these posts!

• My Personal HIPAA Compliance Journey: Steps to Secure Data
• HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security

What other HIPAA questions are on your mind? Share in the comments!

Don’t forget to download your free HIPAA Home Office Policies & Procedures Worksheet to help you get started on your internal documentation! Sign up below for Exclusive access to my Subscriber Freebies page, newsletter, blog updates, and special announcements!

Disclaimer:

The information provided in this blog post is for informational and educational purposes only and is not intended to constitute legal or professional advice. HIPAA compliance is complex and constantly evolving. While efforts have been made to ensure the accuracy of the information presented, it may not reflect the most current legal developments, nor is it guaranteed to be complete or applicable to your specific situation. As a healthcare professional, it is your responsibility to understand and comply with all applicable federal, state, and local laws and regulations, including HIPAA. This content should not be used as a substitute for seeking qualified legal counsel from an attorney specializing in healthcare law, particularly concerning your individual practice, specific vendor relationships, or unique circumstances. Reliance on any information provided in this post is solely at your own risk.

References:

• U.S. Department of Health & Human Services (HHS).Business Associate Contracts. Retrieved from https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
• U.S. Department of Health & Human Services (HHS).Business Associates. Retrieved from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
• HIPAA Journal. HIPAA Conduit Exception Rule and Transmission of PHI: 2025 Update. (Updated January 2, 2025). Retrieved from https://www.hipaajournal.com/hipaa-conduit-exception-rule/
• Paubox. HIPAA lessons learned: A review of HHS resolution agreements. (Updated January 23, 2025). Retrieved from https://www.paubox.com/blog/hipaa-lessons-learned-a-review-of-hhs-resolution-agreements
• Secureframe. HIPAA Violations: Examples, Fines + 5 Cases to Learn From. Retrieved from https://secureframe.com/hub/hipaa/violations

Social Media Icons: designed by rawpixel.com – Freepik.com

The post Navigating Business Associate Agreements as an SLP: Your HIPAA BAA Guide appeared first on Mrs. Speech Online.

Hey fellow SLPs and healthcare pros! Today, I want to share some insights from my personal journey towards HIPAA compliance.

In my last two posts, we delved into the crucial topic of HIPAA compliance for telepractice. They covered the “what” and the “why.”

• HIPAA Compliance At Home: Cloud, Schools, Teletherapy & PHI Security
• Navigating Business Associate Agreements as an SLP: Your HIPAA BAA Guide

Today, I want to share the “how” – my personal journey of putting these principles into practice! I’ve been diving deep into my tech setup to make sure it’s not just functional, but also rock-solid HIPAA compliant. For example, as a teletherapist, some of my schools don’t invite me into their workspace. This leaves it up to me to securely manage all my client notes and materials. This kind of gap is precisely what drove me to build a truly robust system.

It might sound daunting, but trust me, it’s all about peace of mind for both you and your clients. I wanted to share a rundown of what I’ve done. More importantly, I want to share why I’ve done it, in case it helps you level up your practice too!

The “Why” Behind My Personal HIPAA Compliance Journey

My biggest drive was simple. I needed to know, without any doubt, that I was protecting my clients’ sensitive information to the highest standard. HIPAA isn’t just a checkbox; it’s about building trust. First, conducted a thorough risk analysis of my setup to identify any potential vulnerabilities.

I’ve now meticulously created and am maintaining a detailed “Security Policies and Procedures” document that guides all my practices. Plus, having everything clearly documented helps me sleep better at night!

Honestly, it wasn’t that long ago, a few weeks, that I wasn’t even aware of all of this. I didn’t know about Business Associate Agreements (BAAs), or their critical role. My previous security stance of “just don’t share client info” felt sufficient. Since then, I’ve realized how nebulous and insufficient that really was for both cloud-based and desktop information. 

How It All Started

So, if I wasn’t born with this wealth of knowledge, and it wasn’t covered in grad school, what happened? Well, I discovered that simply removing what I thought was identifying information was not sufficient for HIPAA de-identification. That realization truly sent me down this “rabbit hole” of learning and implementing everything you’re about to read!

Honestly, as a single user, all this might seem like overkill at times. That is, until I really think about the potential cost and repercussions of a HIPAA violation. That quickly puts things into perspective!

Here’s information and tips I’ve learned on this individual HIPAA compliance trek. (No, I’m not affiliated with, or sponsored by, Google in any way, it was just easier to work with.)

The Secure Foundation: My Google Workspace Enterprise Standard

Before even setting up my specific security rules, choosing the right Google Workspace edition was crucial. There are several tiers, and it’s not just about how many emails you can send! For me, picking Enterprise Standard was absolutely essential because of the level of HIPAA security I was comfortable with.

• Pro-Tip on Choosing a Platform: I actually considered Microsoft 365 Business plans, as they also offer BAAs. However, I was already using and familiar with Google’s interface. More importantly, I found it much easier to get clear information about Google’s BAA and HIPAA-included functionality upfront. Microsoft seems to hide their BAA documentation behind a subscriber wall, making it difficult to fully vet before committing. This ease of information access, combined with my familiarity, ultimately swayed my decision towards Google.  Basically, it looks like any paid workspace can have a BAA:   https://support.google.com/a/answer/2888485?sjid=14092164238884574583-NC

Here’s why I landed on it during my own HIPAA compliance trip, and what foundational elements it provides:

The Non-Negotiable BAA

This was the top priority. Enterprise Standard definitely comes with a Business Associate Agreement (BAA). This gives me that crucial legal agreement with Google to handle Protected Health Information. This is absolutely non-negotiable for anyone handling PHI with Google Workspace. (You can find Google’s BAA here: https://workspace.google.com/terms/2015/1/hipaa_baa/).

• Pro-Tip on Choosing a Tier – I actually started with the cheapest business tier (Business Starter $7/mo), which I can confirm offers a BAA. However, after really digging into the features, I chose to upgrade to Enterprise Standard. It offered much better control over information and more robust policy enforcement options. These ultimately felt essential for protecting client PHI effectively.  Google Tiers & Pricing 
• Don’t Forget Your Domain Name! A domain name is an additional, but necessary, cost for any Google Workspace Business account. While Google offers to sell you one directly, I opted to buy my domain through Cloudflare for just $10.44/year. This was a cost-effective choice since I already used Cloudflare for other services.

Serious Pooled Storage

Enterprise Standard offers a massive 5 TB of pooled storage per user. (Just a heads-up: This pooled storage gets released in stages after payments, so my Drive initially showed less!). This is more than enough space for all my therapy materials and client files.

Google Vault for Ironclad Data Retention

This was a game-changer! Enterprise Standard includes Google Vault, which allows me to set an indefinite retention policy for all my Google data. This ensures I meet and exceed HIPAA’s minimum six-year data retention requirement. It’s like a super-secure, always-on backup for everything.

Advanced Data Loss Prevention (DLP)

This tier gives me access to advanced DLP rules for Gmail and Drive, which are central to my security strategy. These are the powerful rules that can warn me if I try to share sensitive files externally.

Comprehensive Security Controls

Enterprise Standard unlocks a lot of the granular administrative controls I needed. This allowed me to configure things like forcing 2FA, setting strong password policies, and disabling third-party apps.

Basically, for handling PHI and needing robust, auditable security features, Enterprise Standard provided the comprehensive toolkit I needed to feel confident and stay compliant. It’s an investment at $27/mo, but one that’s absolutely worth it for peace of mind and professional responsibility.

The Core Pillars of My Personal HIPAA Compliance Policy:

Here’s a look at the specific configurations I implemented (See Google’s HIPAA Implementation Guide:  https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf):

1. Bulletproof Access Control (Who Gets In? Only Me!)

• 2-Step Verification (2FA) is Mandatory: No exceptions! I enforced 2FA for all account access. This is your absolute best defense against unauthorized logins.
• Strong Passwords, Always: My system enforces strong password policies, requiring a minimum length of 16 characters and prompting for a refresh every 180 days. No weak links here!

• Third-Party Apps? Deny by Default! My policy is strict: all third-party app access is blocked by default. If I ever need an app, it goes through a security review and is force-installed by me, the admin. This prevents unvetted apps from touching my client data.
• Strictly BAA-Covered Services Only: As part of my setup, I went into my Google Admin Console and literally turned OFF any Google services that aren’t explicitly covered by the BAA (like Google Photos, YouTube, etc.). Why? To make sure no PHI accidentally ends up in a non-compliant service. (You can find a list of Google’s HIPAA Included Functionality and BAA-covered services here: https://workspace.google.com/terms/2015/1/hipaa_functionality/).

2. Smart Data Protection (No Accidental Leaks!)

• Gmail Content Compliance: I set up an automated rule in Gmail that quarantines any outbound email containing PHI-related keywords if it’s addressed to a domain not on my pre-approved “Trusted School Districts” list. It’s a huge safety net!
• Drive DLP (Data Loss Prevention) Rule: For Google Drive, I have a rule that gives me a real-time warning if I ever try to externally share a file containing PHI keywords. It’s an extra “Are you sure?” before a potential mishap.
• Always Use Secure Communication Channels: Beyond these automated rules, I always ensure that any direct client communication involving PHI occurs only through secure, HIPAA-compliant platforms (like my employer’s therapy portal). I now avoid using regular email, text messages, or consumer video calls for sensitive information.

3. Endpoint & Browser Security (My Laptop & Chrome)

• My Laptop is Encrypted & Protected: My main computer has full-disk encryption (BitLocker/FileVault) and a robust antivirus solution. I’m currently using Norton Small Business ($59/1st year with $119/year renewal) for this, primarily for its strong endpoint protection. While I’m actively looking into BAA-covered antivirus and endpoint detection & response (EDR) solutions, it’s been a real challenge to find providers willing to work with a single user. For now, Norton Business helps secure my device itself. I had to specifically disable its cloud backup features to prevent any PHI from being stored on non-BAA servers.  I’ve also upgraded my mouse to use Logi Bolt technology for a more secure wireless connection.
• Physical Security for My Home Office: Beyond digital protection, I also ensure any limited physical PHI (like printed notes) is kept in a locked file box when unattended, and my work area is secured to prevent unauthorized access. I’ve even rearranged my office so that my computer screen is not visible from the doorway, even though I always make sure to close the door when I’m with clients.
• Dedicated Chrome Profiles: This is a big one! I have separate Chrome browser profiles. One just for my professional Workspace (where I handle PHI), and others for personal stuff or employer-provided Outlook/therapy portals. This completely isolates data and workflows.
  • Updated to add – I’ve now gone a step farther and added another Windows user to my computer. This way all therapy stuff stays in the therapy user.
• Chrome Policies Enforced: My professional Google Workspace Chrome profile has Enhanced Safe Browse, “Always use secure connections” (HTTPS), and strict extension blocking enforced by policy. This means my browser is secured from the top down.
• Windows Settings Tuned: Beyond the basics, I dove into Windows settings to ensure my device is locked down. Strong PIN/Windows Hello, Dynamic Lock (locks when I walk away), automatic screen lock, firewall active, and app permissions reviewed app-by-app.

4. Tackling Existing Data & Migration

This was a big project, especially for older files, and probably the hardest part in my HIPAA compliance trek!

• Consolidating All My Data (PHI & Non-PHI): I meticulously went through all my files, both on my computer’s desktop and in my Drive. I identified any possible PHI or general therapy materials. That data was then securely moved to my professional Drive, ensuring it was consolidated into my compliant environment.
• No More OneDrive Sync: I’ve also disabled Microsoft OneDrive’s automatic PC folder backup. I’m in the process of moving those files from the OneDrive synced location back to my local user’s root folders. This ensures no client data is inadvertently stored or synced to a non-BAA cloud service.

Google Drive Settings and Workarounds

• Google Drive for Desktop (Strategically!): I used Google Drive for Desktop for efficiency with many files, but with a key rule. I keep it on “stream files” mode. This means files are only downloaded when I open them, minimizing PHI stored locally on my hard drive. I also keep its “offline access” feature for PHI files disabled in the Admin Console to prevent local copies, unless absolutely necessary and then with extreme care.
• Native Google Docs/Sheets/Slides: This was tricky! I learned you can’t just drag-and-drop native Google files between different accounts using Drive for Desktop. For these, especially if they contained PHI, I had to download them in Microsoft Office format from my personal Drive. Then I re-uploaded them to my professional Google Workspace Drive. This ensured ownership transferred correctly and, crucially, kept the PHI handling within my secured processes.
• Unzipping Files: Since Google Drive doesn’t have a built-in unzipper, I securely downloaded ZIP files to my local, encrypted computer. I unzipped them using Windows’ built-in function, and then re-uploaded the extracted files to my professional Google Workspace Drive.
• Disconnecting My Personal Drive: Once the transfer was done, I disconnected my personal Google Drive account from Google Drive for Desktop. Why? Fewer accounts connected equals less potential risk.
• Cleaning Up My Personal Drive (Carefully!): After moving all PHI, I used a cloud cleaner like Norton Cloud Cleaner on my personal Google Drive to remove duplicates and old non-PHI files. NEVER use such a tool on any PHI files or folders due to compliance risks, if it’s not covered by a BAA.

Involving Others in My Personal HIPPA Journey

• Dealing with Shared PHI from Others: I found some old PHI-containing files in my personal Gmail’s “Shared with me” section, shared by a school district. I immediately downloaded these to my professional Google Workspace Drive, securely deleted them from my personal Drive and my local computer. Then I reached out to the owner (politely!) asking them to remove my personal Gmail from the access list. This is an active and ongoing effort where I’m proactively contacting owners to ensure my access is removed. I’m documenting all my attempts as part of my due diligence, especially if I encounter non-responsive contacts or technical difficulties.
• Updating My Employer: I proactively contacted my employer to update my email address for all Google Drive file sharing. I specifically requested that anything with sensitive client info go to my new, secure professional email address (e.g., your.professional.email@yourdomain.com). This helps them send things to the right place from the start.

My Ongoing Commitment:

This isn’t a one-and-one project! I’ve also built in:

• Annual Policy Review: I’ll review my entire security policy document at least once a year.
• Self-Education: Staying informed about HIPAA and cybersecurity is an ongoing task. I’ve even been learning about specific processes like the HIPAA de-identification process.
• Basic Incident Response: I have a plan for what to do if something ever goes wrong, including who to notify.
• Learning Curve: I won’t lie, all these tech skills required some serious reading up and a lot of help (shout out to Gemini! ?). It’s a journey, not a sprint, but totally doable!

Setting all this up has been a journey, but it’s given me immense confidence in my practice’s security. If you’re an SLP (or any healthcare professional) using tech in your practice, I highly encourage you to take a look at your own setup. It’s worth every bit of effort for your peace of mind and, most importantly, for your clients’ privacy!

Here’s to HIPAA Happiness!

Social Media Icons: designed by rawpixel.com – Freepik.com

The post My Personal HIPAA Compliance Journey: Steps to Secure Data appeared first on Mrs. Speech Online.